NIP-4 👀

NIP-4 introduces encrypted direct messaging in NOSTR but comes with a security warning due to its limitations and metadata leaks.

NIP-4 introduces encrypted direct messaging with kind 4 events in the NOSTR protocol. The content field contains the base64-encoded, AES-256-CBC encrypted string of the message, followed by the base64-encoded initialization vector (IV) as a querystring parameter. The tags field must have an entry identifying the recipient in the format ["p", "<pubkey, as a hex string>"]. It may include an entry identifying the previous message in a conversation or a message being replied to in the format ["e", "<event_id>"]. Note that the secret used for encryption is the X coordinate of the shared point and not the default libsecp256k1 implementation. A JavaScript code sample is provided for generating an encrypted event.

However, NIP-4 has a security warning stating that it does not meet state-of-the-art encrypted communication standards and leaks metadata in events, so it should not be used for sensitive information. Moreover, clients should avoid processing encrypted messages like regular text notes, as doing so would leak tags and deliver the message to unintended recipients.

Source: https://github.com/nostr-protocol/nips/blob/master/04.md