Frequently asked questions

Can the person checking a signature tell who actually signed it?

No, that is the whole point. A valid signature proves the message was signed by one of the keys in the ring. The only way to narrow it down further is to make guesses based on the content of the message; as far as the mathematics is concerned, every member is equally likely to have been the signer. The more keys in the ring, the larger the crowd you are hidden in.

Do I need permission from the other people in the ring?

No. This is the part that people misunderstand most often. You build a ring out of public keys, which are public by definition. Only your own contribution to the signature is real, no one else has to agree to it, and in some cases may never even know they were named.

So anyone can be placed in a ring without consenting?

Yes. The only way to be certain you are never named in someone's ring is never to share a public key, which on a network like Nostr would mean not taking part at all.

Can someone tell that two different signatures came from the same signer?

The only way to enable this with OstrichSign is to post from a dedicated pseudonym (which you should do in any case), and for the body of the messages to endorse that pseudonym or include a normal signature from it.

What if I want a message to have multiple true signers?

That is known as a k-of-n threshold ring signature. Those would be very useful if there was a safe and convenient way to create them. Unfortunately, it seems that they intrinsically carry additional risks to the signers' anonymity. They are not used in any real-world application.

How is this different from a "group signature"?

A group signature has a manager who sets the group up in advance and who is able to unmask the signer. A ring signature has no such manager. You assemble the ring yourself, from whatever public keys you choose.

Does anything leave my browser? Are my keys sent anywhere?

No. Generating keys, signing, and verifying all happen locally in your browser. No key, message, or signature is transmitted anywhere by this page. If you want to confirm it, turn off your network connection and watch everything keep working.

Is it safe to rely on for something that actually matters?

No. This is experimental software that has not yet had a formal security audit, and it is meant for learning, testing, and exploration.

If I post a signature on Nostr, am I really anonymous?

The signature itself hides which member signed, but the act of posting can expose you in other ways. Make sure to create a separate dedicated pseudonym from which to post the message. Relays can see the address and timing of whoever uploads or reads a note, so anyone who needs genuine cover should connect through Tor or a VPN and think carefully about which relays they trust. Also anyone who can view your network traffic can see you loading this site, so ideally you would download the console page via Tor and/or on a trusted network.

What are npub, nsec, and the hex keys?

They are different ways of writing the same keys. An npub is a public key in Nostr's bech32 format, an nsec is a private key in that format, and "hex" is the raw hexadecimal. The console shows every public key as x-only hex (the Nostr convention) together with its npub.

My public key is longer than an npub. Will it work?

Yes. The same underlying key can be written three ways: x-only (32 bytes, the Nostr convention), compressed (33 bytes, starting with 02 or 03, as used by other secp256k1 software), or uncompressed (65 bytes, starting with 04). The console displays x-only keys only, but any of the three encodings is accepted when you paste it into the import box or into the ring on the verify step. The format never affects the signature: every key is reduced to the same canonical point before anything is hashed.

Will signatures from this tool work with other implementations?

Not byte-for-byte. The cryptography follows the same SAG scheme and the npub/nsec handling matches the Nostr spec, but the way this tool packages a finished signature — its ringX format — is its own and is not interchangeable with the upstream Rust crate. Verify signatures made here with this tool.