Locked today. Readable in 2035.

Your Nostr DMs Are Locked Diaries — and Someone Already Photocopied Them

Nostr is a public square wearing a trench coat. Your "encrypted" messages quietly leak who you talk to today, and — thanks to a lock that quantum computers will one day pick — they can become fully readable in about a decade. Here's the plain-English why, and exactly what to do so your secrets stay secret.

Let's start with a picture an eight-year-old can hold in their head, because honestly it's the picture the grown-ups need too.

Imagine a giant bulletin board in the middle of town. Anyone can pin a note to it. Everyone walking by can read every note. That's Nostr — "Notes and Other Stuff Transmitted by Relays." It's a wonderfully simple, censorship-resistant way to publish to the world. You get a magic pen (your private key) that only you hold, and a name tag (your public key, the npub…) that everyone sees. The pen signs your notes so people know they're really from you. The name tag is your identity, forever.

For public posts, that's perfect. Shouting into a public square is the whole point. The trouble starts the moment you want to whisper.

The whisper problem, part 1: the envelope tells on you

Nostr has "encrypted direct messages." Sounds cozy and private, right? Here's the catch.

The original scheme, NIP-04, does lock the contents of your letter (it scrambles the words with AES-256). But it writes, in big friendly letters on the outside of the envelope: who it's from, who it's to, and when it was sent. The relays — think of them as the mail carriers — can't read your words, but they can see the whole pattern. Alice slipped Bob a note. Then another. Fourteen notes, every day, at 2 a.m. You don't need to read a single one to know exactly what's going on.

This isn't me being dramatic — it's in the spec. NIP-04's own text says it "leaks metadata in the events, therefore it must not be used for anything you really need to keep secret," and it admits it "does not go anywhere near what is considered the state-of-the-art." It is officially deprecated. And yet a lot of apps still use it, because backward compatibility is a hard habit to quit. (NIP-04)

Metadata — who talks to whom, when, how often, how much — is often more revealing than the messages themselves. Spies have known this for a century. It's why "we only collected metadata" was never as comforting as it sounded.

The good news: the Nostr community fixed the envelope. The modern scheme, NIP-17, wraps your message in NIP-59 "gift wrap" — a clever set of nested, re-signed envelopes so the mail carriers can see that you got a package, but not from whom or what kind. The social graph goes dark. (NIP-17, NIP-59)

So the envelope problem? Mostly solved — if you use a client that speaks NIP-17. Now for the part nobody solved.

The whisper problem, part 2: the lock has an expiry date

Here's the eight-year-old version. You have a diary with a little padlock. Today, that padlock is genuinely tough — nobody can pick it. So you feel safe.

But two things are true at once:

The mail carriers keep photocopies. Relays are public servers. They store your encrypted messages, and copies spread across many of them. Anyone can ask a relay for old events. So the locked diary pages are already sitting in a filing cabinet — lots of filing cabinets — waiting.
The padlock will become pickable. Every version of Nostr's private messaging — the old NIP-04, the shiny new NIP-44 — builds its lock the same way: it does a secret handshake between two keys using secp256k1 ECDH. That's elliptic-curve math, the same family that secures Bitcoin. It's excellent against today's computers. It is defenseless against a big enough quantum computer, which can run Shor's algorithm and turn two public keys back into the shared secret — i.e., pick the lock — in the cryptographic equivalent of an afternoon.

Put those together and you get the phrase that keeps cryptographers up at night: "harvest now, decrypt later." An adversary doesn't need a quantum computer today. They just need to copy your locked messages today and be patient. When a cryptographically-relevant quantum computer arrives — most serious forecasts say somewhere in the 2030s — they unlock the entire archive retroactively. Your 2026 "private" DMs get read in 2035.

And NIP-44, to be crystal clear, is good work — it upgraded the encryption to ChaCha20 with an HMAC-SHA256 authenticator and even pads messages to hide their length. (NIP-44) It fixed real problems. But the key agreement underneath is still classical elliptic curve. A beautiful vault door bolted onto a wall the future can walk through.

Why Nostr makes this worse than most apps

Harvest-now-decrypt-later needs two ingredients: the ciphertext and your public key. On most platforms, an attacker has to work to get both. On Nostr, both are handed over gift-wrapped (pun intended):

The ciphertext is on public relays by design.
The public key isn't just exposed — it's your entire identity. Your npub is your username, your handle, your reputation, stapled to your forehead and published forever. You can't rotate it without becoming a stranger to everyone who follows you.

In most messengers your keys churn and expire. On Nostr, the one number an attacker needs most is the one you can never change and always advertise. It's like using your home address as your password and then printing it on your business cards.

What the grown-ups already did (and Nostr hasn't)

This isn't sci-fi paranoia; the biggest messengers already moved.

Signal shipped PQXDH in September 2023. Its initial key handshake is now a hybrid — the classic X25519 plus the post-quantum CRYSTALS-Kyber (Kyber-1024). To break it, you must break both. Signal built it explicitly to defeat harvest-now-decrypt-later. (Signal, "Quantum Resistance and the Signal Protocol")
Apple went further with PQ3 for iMessage in February 2024 — the first at-scale messenger to reach what it calls "Level 3," meaning it's post-quantum not just for the first handshake but for the ongoing re-keying of a conversation. Also hybrid: Kyber-style post-quantum crypto layered with elliptic curve. (Apple Security Research, "iMessage with PQ3")

Both lean on the algorithms the U.S. standards body NIST finalized in August 2024: ML-KEM (that's Kyber, standardized as FIPS 203) for key exchange, and its siblings ML-DSA and SLH-DSA for signatures. This is no longer research. It's the new normal — everywhere except, for now, Nostr's DMs, which have no standardized post-quantum scheme at all.

So what do you do? (The part you came for)

You don't have to quit Nostr. You just have to be honest about what it is and route your secrets accordingly.

1. The golden rule: treat every note and DM like a postcard that's locked today but readable later. If you'd be unhappy for it to be public in 2035, don't put it on a relay. This one habit protects you more than any setting.

2. If you must DM on Nostr, use NIP-17, not NIP-04. Prefer clients that support gift-wrapped private messages (for example 0xchat or Amethyst). It won't save you from the quantum problem, but it stops leaking your entire social graph right now — and that leak is a today-problem, not a someday-problem.

3. For anything that must stay secret for years, don't use Nostr DMs — use a post-quantum messenger. Signal (PQXDH) or iMessage (PQ3) are the pragmatic choices today. Boring advice, correct advice.

4. Belt and suspenders: encrypt the payload yourself, before it touches a relay. If a sensitive blob is wrapped in a post-quantum (or hybrid) scheme by you, then even a fully broken transport in 2035 reveals a box the attacker still can't open. More effort, but it's the only thing that makes a public relay safe for a real secret.

5. Push the ecosystem forward. The clean fix is a NIP that makes Nostr's key agreement hybrid — classic secp256k1 ECDH and ML-KEM, combined so an attacker must break both. That's exactly the move Signal and Apple made. If you build on Nostr, this is the proposal worth championing.

The one idea to remember

There's a principle called Mosca's inequality, and it's blunt: if the time your secret must stay secret, plus the time it takes to migrate your crypto, is longer than the time until a quantum computer exists — you're already late. You don't get to start when the quantum computer boots up. The photocopies were made years earlier.

Migrating early is a bit of engineering — annoying, recoverable, cheap. Migrating late is unrecoverable, because you cannot un-send a decade of "private" messages. That asymmetry, not any confident prediction about when, is the whole reason to act now.

Nostr got so much right: you own your identity, nobody can deplatform your voice, the whole thing runs on beautiful, simple cryptography. Let's just make sure the "private" part is still private the year your kids learn to read your old DMs.

Written by quantakrypto — an applied post-quantum cryptography practice. We audit real systems for exactly this class of harvest-now-decrypt-later exposure and help teams migrate to ML-KEM / ML-DSA / SLH-DSA before the deadline that was quietly set the day someone first hit "copy." → quantakrypto.com

Sources: NIP-04 · NIP-44 · NIP-17 · NIP-59 · Signal PQXDH · Apple iMessage PQ3 · NIST FIPS 203 (ML-KEM)