Traditional note-taking apps store user data on centralized servers, providing no full control over it. Çetele offers a decentralized architecture using the Nostr (Notes and Other Stuff Transmitted by Relays) protocol and cryptographically protects your data with the NIP-44 encryption standard.

In this system, your notes are distributed across multiple relays, and no single point can access your data. All encryption and decryption processes occur on the client side, ensuring your data remains under your control at all times.

Nostr is a simple and flexible protocol. Its fundamental building blocks are:

Each user generates a key pair. The private key is a 256-bit random number used to sign all actions. The public key is derived from this private key and represents the user's identity.

The system uses the secp256k1 elliptic curve. This curve satisfies the following equation:

Where p = 2²⁵⁶ - 2³² - 2⁹ - 2⁸ - 2⁷ - 2⁶ - 2⁴ - 1, a prime number of approximately 2²⁵⁶ in size.

The private key sk is a randomly selected integer between 1 and n-1, where n is the order of the curve:

The public key pk is the scalar multiplication of the private key with the generator point G:

This operation is performed by repetitive point addition on the elliptic curve and is a one-way function (easy to compute, computationally impossible to reverse - Discrete Logarithm Problem).

NIP-44 is an encryption standard utilizing the XChaCha20-Poly1305 algorithm. This hybrid encryption system combines both symmetric and asymmetric cryptography.

ECDH is used to establish a shared secret between two parties:

Thanks to its commutative property, this operation yields the exact same point on both sides. The x-coordinate of the shared point is used as the conversation key:

XChaCha20 is an extended-nonce version of ChaCha20. It uses a 192-bit nonce, practically eliminating collision risk.

The fundamental structure of ChaCha20 is a 4x4 state matrix:

20 double rounds (20 rounds total) are run on this matrix. Each round:

These operations are applied as column rounds and diagonal rounds, then added back to the original state. The output keystream is XORed with the plaintext to produce ciphertext.

Poly1305 computes a MAC for a 130-bit key and 16-byte message. It operates over the prime p = 2¹³⁰ - 5:

Here r is the key, c₁...cᵢ are message blocks, and s is a nonce. This guarantees the integrity and authenticity of the message.

The full encryption process:

Gift wrapping is an additional encryption layer to ensure metadata privacy. The real event is encrypted with a random ephemeral key pair and wrapped in a kind 1059 event.

The real event is signed with a random keypair (ephemeral key):

The sealed event is NIP-44 encrypted using the recipient's public key:

The obfuscated timestamp hides the real time with a ± 2 days random delta. This prevents timing analysis.

Because the gift wrapping mechanism generates a new ephemeral key pair for each message, compromising long-term keys does not decrypt past messages. This guarantees perfect forward secrecy.

Relays only see encrypted blobs. Sender, recipient, and content information are hidden. Timestamp obfuscation also prevents timing analysis.

All operations take place over a finite field:

For two points P(x₁, y₁) and Q(x₂, y₂):

n × P operation is optimized via the double-and-add algorithm:

Using binary representation, complexity is reduced to O(log n).

HMAC-based Key Derivation Function derives sub-keys from a master key:

Mobile: Uses Secure Enclave/Keystore on iOS and Android. Private keys are protected with hardware-backed encryption.

Web: Uses NIP-07 browser extension. Private keys are stored in the extension and never exposed to the web page.

Notes are sent to a minimum of 3 relays. This provides:

Çetele offers a secure, private, and censorship-resistant note-taking system by combining modern cryptographic principles with Nostr's decentralized architecture.

The system provides mathematically proven security features:

The protocol described in this document is based on academic standard, peer-reviewed cryptographic primitives and is resistant against practical security threats.