SkateSpots/NIP-06-IMPLEMENTATION.md

NIP-06 Implementation Summary

✅ What We've Implemented

1. NIP-06 Key Derivation (/src/lib/nip06.ts)

• Full BIP39 mnemonic generation (12 or 24 words)
• BIP32 key derivation using path m/44'/1237'/0'/0/0
• Mnemonic validation and normalization
• Multi-account support (can derive account 0, 1, 2, etc.)
• Complete test coverage in nip06.test.ts

2. Mnemonic-Based Signup (/src/components/auth/MnemonicSignupDialog.tsx)

User Flow:

1. Click "Sign Up" → Choose "Recovery Phrase" (recommended)
2. Generate 12-word mnemonic automatically
3. Display words in a grid (numbered 1-12)
4. Backup options:
   • 📥 Download as .txt file
   • 📋 Copy to clipboard
   • 📱 Generate QR code (opens in new window for printing)
5. Verification quiz: User enters 3 random words to confirm backup
6. Auto-login after verification

Features:

• Show/hide mnemonic toggle
• Regenerate option if user isn't happy with words
• Clear security warnings
• QR code backup for easy mobile transfer

3. Mnemonic Recovery in Login (/src/components/auth/LoginDialog.tsx)

Updated Login Flow:

• "Key" tab now accepts BOTH nsec AND 12-word recovery phrases
• Auto-detects input type:
  • 12 or 24 words → Validates as mnemonic, derives key
  • Starts with nsec1 → Validates as nsec
• File upload accepts both mnemonic and nsec .txt files
• Helpful hint text: "💡 You can paste either your nsec key or 12-word recovery phrase"

4. Signup Method Selection (/src/components/auth/SignupMethodDialog.tsx)

Comparison Modal:

• Side-by-side comparison of mnemonic vs nsec
• Recovery Phrase marked as "Recommended"
  • ✓ Easy to write down
  • ✓ Works with other Nostr apps (NIP-06)
  • ✓ Can generate multiple accounts
  • ✓ Familiar to crypto users
• Secret Key (nsec) marked as "Advanced"
  • ✓ Direct cryptographic control
  • ✓ Compatible with all apps
  • ✓ Single string to backup
  • ✓ No derivation layer

5. Backup Reminder System (/src/components/BackupReminder.tsx)

Persistent Warning Banner:

• Shows at top of app after signup/login
• Displayed until user clicks "I've Backed It Up"
• Stores confirmation in localStorage
• Buttons:
  • "Backup Now" → Links to Settings
  • "I've Backed It Up" → Dismisses and saves confirmation
  • "X" → Temporary dismiss (shows again on next visit)

6. Security Settings Tab (/src/components/SecuritySettings.tsx)

New Security Tab in Settings:

• ✅/⚠️ Backup confirmation status
• Key security best practices:
  • ✍️ Write on paper
  • 💾 Multiple backups
  • 🔒 Never share
  • 🚫 Don't store in cloud unencrypted
  • 🔐 Use browser extensions
• Browser extension recommendations:
  • Alby (recommended, includes wallet)
  • Flamingo (simple, clean)
  • nos2x (minimal, advanced)
• Nostr Connect/bunker information:
  • nsec.app (popular)
  • Nostrum (mobile support)

7. Enhanced Bunker Login (/src/components/auth/LoginDialog.tsx)

Improved Nostr Connect Tab:

• Better UI with cloud icon and blue theme
• Clear explanation of what bunkers are
• Direct links to nsec.app and Nostrum
• Helpful instructions on how to get connection string

🔑 Storage & Security

Where Keys Are Stored:

• localStorage via @nostrify/react/login with key 'nostr:login'
• Keys stored as nsec (bech32-encoded)
• No encryption at rest (browser security model)
• Mnemonic phrases are NOT stored - only derived nsec

Security Model:

• Mnemonic → Private Key → nsec → localStorage
• User MUST backup mnemonic or nsec externally
• No password protection (relying on device security)
• Browser extensions recommended for better security

📝 User Experience Improvements

Before:

• Only nsec signup
• Download nsec file
• No verification
• No recovery phrase option

After:

• Choose mnemonic (recommended) or nsec (advanced)
• 12-word recovery phrase (easier to backup)
• Verification quiz ensures backup
• QR code option for physical backup
• Login accepts both mnemonic and nsec
• Persistent backup reminders
• Security best practices in settings
• Prominent Nostr Connect option

🔄 Backwards Compatibility

✅ Fully compatible with existing accounts:

• Old nsec-based accounts still work
• LoginDialog accepts both formats
• No migration needed
• Users can continue using nsec if they prefer

📱 Multi-Device Access

Options Provided:

1. Recovery Phrase - Write down 12 words, restore on any device
2. Nsec Backup - Download/copy nsec, paste on new device
3. Browser Extension - Sync via extension (Alby, etc.)
4. Nostr Connect - Use bunker for cloud-based signing

🎯 Next Steps (If Needed)

Future Enhancements:

• Multi-account UI (derive accounts 0, 1, 2 from one mnemonic)
• Encrypted localStorage with password unlock
• Social recovery / multi-sig (NIP-26)
• Passkey / WebAuthn support
• Weekly backup reminders
• Mnemonic strength indicator

🧪 Testing

Run the test suite to validate NIP-06 implementation:

npm test

The nip06.test.ts file includes:

• ✅ Mnemonic generation (12 and 24 words)
• ✅ Validation (correct and incorrect mnemonics)
• ✅ Key derivation (matches NIP-06 test vector)
• ✅ Multi-account derivation
• ✅ Normalization and utility functions
• ✅ Integration with nostr-tools (nsec encoding, public key derivation)

📚 Technical References

• NIP-06: https://github.com/nostr-protocol/nips/blob/master/06.md
• BIP39: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki
• BIP32: https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki
• SLIP44: https://github.com/satoshilabs/slips/blob/master/slip-0044.md (Nostr coin type: 1237)

🎨 UI/UX Features

• Visual word grid for mnemonic display
• Verification quiz with 3 random words
• QR code generation for physical backup
• Show/hide toggle for privacy
• Regenerate option if user doesn't like words
• Backup reminders until confirmed
• Security guidance throughout flow