Join Nostr
2026-01-27 16:00:19 UTC

npub160…zyjc9 on Nostr: I've been exploring the idea of using NFC as a geographically relative handshake that ...

I've been exploring the idea of using NFC as a geographically relative handshake that can establish a series of fallback comms paths.
quoting

Reclaiming Digital Sovereignty

In an era where our digital identities are held hostage by centralized platforms, where a single corporate decision can erase years of social connections, and where metadata surveillance reveals more about us than the content of our messages ever could, a new generation of networking primitives is emerging to restore digital freedom.

The [Marmot Development Kit (MDK)](https://github.com/marmot-protocol/mdk) represents a fundamental rethinking of how secure group communication can work. By combining the cryptographic rigor of the MLS (Messaging Layer Security) protocol with Nostr's decentralized relay network, MDK enables something previously thought impractical: truly infrastructure-independent group messaging with forward secrecy, post-compromise security, and complete metadata protection. MDK is currently in alpha, but its architecture points toward a future where group security is decoupled from any single provider.

Meanwhile, [Bitchat](https://github.com/permissionlesstech/bitchat) has emerged as a shipping implementation of these principles - a decentralized peer-to-peer messaging app with over 24,000 GitHub stars, available today on the App Store. Bitchat's dual transport architecture combines local Bluetooth mesh networks for offline communication with Nostr protocol for global reach. No accounts. No phone numbers. No central servers. Just IRC vibes for the modern age.

The Architecture of Freedom

These systems share a simple but radical premise: your identity and your relationships should belong to you, not to any server, company, or protocol.

At the cryptographic core, the entire stack converges on Ed25519:

  • Nostr: All Nostr keys are Ed25519 keypairs. Your npub is your identity.

  • Iroh: NodeIds are Ed25519 public keys. Dial peers by cryptographic identity, not IP address.

  • MDK: Uses Nostr keys, which means Ed25519 throughout.

  • Bitchat: Nostr identity layer means Ed25519.

This isn't coincidence - Ed25519 is fast, well-audited, and produces compact signatures. When every layer speaks the same cryptographic language, key management becomes portable. Export your seed phrase, and your identity moves with you across any compliant implementation.

// Your identity is just a keypair - sovereign and portable
let my_keys = Keys::generate();  // Ed25519 under the hood
// Groups form through cryptographic consensus, not server permission
let group = mdk.create_group(
    &my_keys.public_key(),
    vec![friend_key_package],
    NostrGroupConfigData::new(
        "Freedom Collective".to_string(),
        "Private, portable, permanent".to_string(),
        None, None, None,
        vec![relay_url],
        vec![my_keys.public_key(), friend_pubkey],
    ),
)?;

Marmot Channels: NFC-Initiated DMs in Bitchat

Imagine this: two people meet. They tap phones. A DM thread appears in Bitchat. Behind that simple interaction, a sophisticated protocol negotiation has occurred - but the user just sees a conversation.

This is the vision of Marmot Channels: NFC-initiated Marmot DMs within Bitchat, where all the complexity is baked in and invisible.

NFC as Protocol Negotiation

The NFC tap isn't just exchanging a public key - it's a capability negotiation. Each device advertises what transports it supports and its preferences:

┌────────────────────────────────────────────────────────┐
│              NFC PROTOCOL NEGOTIATION                  │
├────────────────────────────────────────────────────────┤
│                                                        │
│  Initiator → Responder:                                │
│  ┌──────────────────────────────────────────────────┐  │
│  │ version: 1                                       │  │
│  │ pubkey: <Ed25519 public key>                     │  │
│  │ mls_key_package: <optional, if MLS supported>    │  │
│  │ transports: [                                    │  │
│  │   { type: "bluetooth", priority: 1, enabled: ✓ } │  │
│  │   { type: "iroh", priority: 2, node_id: "..." }  │  │
│  │   { type: "reticulum", priority: 3, addr: "..." }│  │
│  │   { type: "nostr", priority: 4, relays: [...] }  │  │
│  │ ]                                                │  │
│  └──────────────────────────────────────────────────┘  │
│                                                        │
│  Responder → Initiator:                                │
│  ┌──────────────────────────────────────────────────┐  │
│  │ version: 1                                       │  │
│  │ pubkey: <Ed25519 public key>                     │  │
│  │ mls_key_package: <optional>                      │  │
│  │ transports: [                                    │  │
│  │   { type: "bluetooth", priority: 1, enabled: ✓ } │  │
│  │   { type: "iroh", priority: 2, node_id: "..." }  │  │
│  │   { type: "nostr", priority: 3, relays: [...] }  │  │
│  │ ]                                                │  │
│  └──────────────────────────────────────────────────┘  │
│                                                        │
│  Negotiated Result:                                    │
│  → Both support Bluetooth (priority 1) - use first    │
│  → Iroh available as fallback (priority 2)            │
│  → Nostr as async fallback (lowest common priority)   │
│                                                        │
└────────────────────────────────────────────────────────┘

The receiver's extension list determines priority. If Alice prefers Bluetooth but Bob has it disabled, they fall through to the next common transport. The key packages can be exchanged over NFC directly (fastest) or fetched later via any available transport.

Transport Priority Waterfall

Once negotiation completes, message delivery follows a priority waterfall:

┌───────────────────────────────────────────────────────┐
│              TRANSPORT PRIORITY WATERFALL              │
├────────────────────────────────────────────────────────┤
│                                                        │
│  1. NFC (if still in contact)                          │
│     └─ Direct transfer, highest bandwidth/trust        │
│                                                        │
│  2. Bluetooth Mesh                                     │
│     └─ Local, low-latency, works offline               │
│     └─ Multi-hop relay (max 7 hops)                    │
│     └─ Noise Protocol encryption                       │
│                                                        │
│  3. Iroh (QUIC)                                        │
│     └─ Hole-punching for direct internet connection    │
│     └─ Relay fallback if NAT traversal fails           │
│     └─ 7.8k stars, battle-tested                       │
│                                                        │
│  4. Reticulum Mesh                                     │
│     └─ Long-range: LoRa, packet radio, serial          │
│     └─ Store-and-forward for intermittent links        │
│     └─ Kilometers of range vs Bluetooth's meters       │
│                                                        │
│  5. Nostr Relays                                       │
│     └─ Always-available async fallback                 │
│     └─ 290+ global relays for redundancy               │
│     └─ NIP-17 gift-wrap for DM privacy                 │
│                                                        │
│  Messages queue at highest available layer and         │
│  deliver when transport becomes available.             │
│                                                        │
└────────────────────────────────────────────────────────┘

The User Experience

The user sees none of this. They tap phones, a DM appears, they type. The message routes through whatever transport is available. If their friend walks away, messages seamlessly shift from Bluetooth to Iroh to Nostr. If they're in a basement with no internet, Bluetooth mesh still works. If they're kilometers apart in the wilderness with LoRa radios, Reticulum carries the payload.

The complexity is baked in. The user just sees DMs.

Bitchat: Proof That the Future Ships

While MDK (currently alpha) provides the MLS cryptographic foundation for group messaging, [Bitchat](https://github.com/permissionlesstech/bitchat) demonstrates what a shipping implementation looks like. With 24.8k stars and available on the App Store today, Bitchat has already solved many integration challenges:

Dual Transport in Production

Bluetooth Mesh Network (Offline)

  • Direct peer-to-peer within Bluetooth range

  • Multi-hop relay through nearby devices (max 7 hops)

  • Noise Protocol encryption with forward secrecy

  • Automatic peer discovery and connection management

  • Battery-optimized duty cycling

Nostr Protocol (Internet)

  • Global reach via 290+ distributed relays

  • Location-based channels using geohash coordinates

  • NIP-17 gift-wrapped private messages

  • Ephemeral keys per geographic area

Location Channels: Geographic Freedom

Bitchat's geohash-based chat rooms are elegant: instead of joining a server someone else controls, you join a geographic coordinate:

  • block #dr5rsj7 - City block level

  • neighborhood #dr5rs - District

  • city #dr5 - City-wide

  • region #dr - Country/region

Community chat emerges from geography, not platform permission. A protest forms? Everyone in that geohash shares a channel. A disaster strikes? Local coordination happens automatically. No sign-ups, no approvals, no gatekeepers.

Emergency Wipe

Triple-tap to instantly clear all data. In adversarial environments, the ability to quickly eliminate evidence of communication is a matter of personal safety.

Reticulum-rs: Extending Range

For scenarios where Bluetooth's ~100m range isn't sufficient, [Reticulum-rs](https://github.com/BeechatNetworkSystemsLtd/Reticulum-rs) provides long-range mesh networking. The Rust implementation of the Reticulum Network Stack offers:

  • Transport agnostic: TCP, serial, LoRa, packet radio

  • Identity-based routing: Cryptographic addresses, not IPs

  • Store-and-forward: Messages traverse intermittent links

  • Tactical integration: Sub-GHz transceivers, tactical radios

Where Bitchat's Bluetooth covers meters, Reticulum over LoRa spans kilometers.

┌────────────────────────────────────────────────────────┐
│                RANGE BY TRANSPORT                      │
├────────────────────────────────────────────────────────┤
│                                                        │
│  NFC          ←─────┤ ~4 cm                            │
│  Bluetooth    ←─────────────┤ ~100 m (7 hops)          │
│  Reticulum    ←─────────────────────────────┤ ~10+ km  │
│  Iroh/Nostr   ←─────────────────────────────────────→∞ │
│                                                        │
└────────────────────────────────────────────────────────┘

Trade-off Analysis

Designing for decentralization requires navigating complex trade-offs:

From the Privacy Advocate's Perspective

Considerations Trade-Off
Metadata Protection MLS hides content but group membership events traverse the network. Nostr relays see encrypted blobs but can analyze traffic patterns. Full protection requires onion routing or mix networks.
Key Management User-controlled keys mean user responsibility. Lost keys = lost access. Social recovery adds complexity and attack surface.
Plausible Deniability MLS provides sender authentication - good for accountability, potentially dangerous in adversarial contexts.

From the Network Engineer's Perspective

Consideration Trade-off
Iroh Hole-Punching Works in ~95% of configurations but fails in strict corporate firewalls. Relay fallback adds latency and trust assumptions.
Bluetooth Mesh Excellent for urban density but 7-hop limit constrains range. BLE 5.0 helps but still limited for media. Battery optimization requires careful duty cycling.
Reticulum Mesh Beautiful for long-range but bandwidth-limited.LoRa = kilobits, not megabits.Text works; media doesn't.
Nostr Relay Selection More relays = more resilience but more metadataexposure. Self-hosting requires expertise.

From the Protocol Designer's Perspective

Consideration Trade-Off
MLS vs Noise MLS (RFC 9420) provides formal guarantees but complex. Bitchat chose Noise for mesh - simpler, still has forward secrecy. Different tools for different contexts.
Multi-Transport Supporting NFC + Bluetooth + Iroh + Reticulum + Nostr creates session establishment complexity. Clear priority rules essential.
Group Size MLS scales to thousands with overhead. Bitchat's geohash channels sidestep this - you're only "in" while physically present.
Interoperability MDK and Bitchat both use Nostr but different message formats. Common NIPs could enable cross-app DMs.

From the User Freedom Perspective

Consideration Trade-Off
Self-Hosting Maximum sovereignty but requires sysadmin skills. Most users rely on public infrastructure, reintroducing trust.
Key Portability Export identity freely, but compromised keys mean stolen identity.
No Account Recovery No central authority = no "forgot password". Feature (no backdoors) and bug (permanent loss).

From the Embedded/IoT Perspective

Consideration Trade-Off
Rust no-std Theoretically runs on MCUs, but MLS crypto is expensive. Hardware acceleration helps.
Reticulum Weight Designed for constrained devices but full mesh needs memory for routing tables.
Power Always-on mesh drains batteries. Intelligent duty cycling and wake-on-radio essential.

The Rust Advantage

This stack converges on Rust for good reason:

  • Memory Safety: Cryptographic code without buffer overflows or use-after-free

  • Performance: Near-C speeds for encryption critical in real-time messaging

  • Cross-Platform: Same code on servers, phones (FFI), embedded, WebAssembly

  • Ecosystem: ring, rustls, OpenMLS - mature, audited foundations

Conclusion: Infrastructure of Liberation

The combination of MDK, Bitchat, Iroh, Reticulum-rs, and Nostr represents more than architecture. It's a statement: communication infrastructure should serve people, not platforms.

Bitchat proves this ships. 24.8k stars and real users communicating via Bluetooth mesh and Nostr relays. MDK (alpha) provides MLS rigor for scenarios requiring formal security guarantees. Iroh handles NAT traversal. Reticulum extends reach into disconnected environments.

When your identity is an Ed25519 keypair, your relationships are cryptographic, and your messages traverse any medium - NFC, Bluetooth, LoRa, internet - you've achieved digital sovereignty. No platform can de-person you. No server seizure silences your community. No corporate pivot orphans your social graph.

This is decentralization in practice: not absence of infrastructure, but infrastructure that cannot be monopolized. Not elimination of trust, but trust distributed across self-sovereign participants.

The Marmot Channel vision - NFC handshakes initiating DMs, Bluetooth for local speed, Iroh for internet, Reticulum for extreme range, Nostr for persistence, MLS for group security - has components shipping today. Bitchat is on the App Store. The integration surface awaits.

The future is decentralized. Encrypted. Portable. Offline-capable. And already here.

---

Resources:

Author Public Key
npub160t5zfxalddaccdc7xx30sentwa5lrr3rq4rtm38x99ynf8t0vwsvzyjc9
Seen on
wss://nos.lol