~/work $ marmot --whistle // colony_alerted

MARMOT

end-to-end encrypted group messaging on nostr, built on MLS

READ THE SPEC ⇗ ⇠ BACK TO BASE
RFC 9420 MLS underneath 6 MIPs · 4 required 0 phone numbers 0 central servers
● whistling on all relays

[01] WHAT IT IS

Encrypted DMs already exist on nostr. Encrypted groups are the hard part, and Marmot is the spec for doing them right.

It takes MLS (RFC 9420, the IETF standard for end-to-end encrypted group messaging) and runs it over nostr: identity you hold the keys to, relays anyone can host. MLS brings the cryptography, nostr brings the transport, and no company sits in the middle. Like its namesake, Marmot lives in colonies: one marmot whistles and every relay carries the alarm, so the burrow stays sealed.

[02] THE MIPS

six specs cover the whole protocol, key packages through push notifications:

MIP-00 required credentials & key packages How a nostr identity publishes MLS key packages so strangers can add you to a group without a round-trip. MIP-01 required group construction Creating groups and the Marmot Group Data extension: name, relays and admins, stored inside the encrypted MLS state. MIP-02 required welcome events Inviting new members: sealed welcome messages that bootstrap them into the group's ratchet tree. MIP-03 required group messages The wire format: MLS ciphertexts wrapped in nostr events, published to the group's relays under ephemeral keys. MIP-04 optional encrypted media Images and files: encrypted blobs on media servers, keys delivered inside the group. MIP-05 optional · draft push notifications Waking sleeping clients without telling the push service who's talking to whom.

[03] SECURITY MODEL

forward secrecy

Keys ratchet forward with every message. Steal today's keys and yesterday's burrow is still sealed: past messages stay unreadable.

post-compromise security

Regular key rotation heals the group after a breach. An attacker who falls behind the ratchet is locked out again.

metadata protection

Group messages are published under ephemeral keys to relays the group picks, so an observer can't even tell who is in a group, or that it exists.

identity separation

MLS signing keys are distinct from your nostr identity key. Your npub never has to touch the message layer.

no central servers

Any nostr relay can carry the ciphertext; groups can hop relays at will. There is no service to subpoena, seize or shut down.

built for big colonies

MLS's ratchet tree makes group operations scale logarithmically: the same crypto works for 2 marmots or 2 million.

[04] THE COLONY

the spec is open; anyone can build a client.

White Noise ⇗ The flagship Marmot client: a secure, private messenger that's lightning-fast, scalable and identity-free. whitenoise.chat MDK ⇗ The Marmot Development Kit: the Rust reference implementation, ready to embed in your own client. github.com/marmot-protocol/mdk marmot-ts ⇗ The TypeScript implementation, for the web and everything else that runs JavaScript. github.com/marmot-protocol/marmot-ts

Honest scope: Marmot is experimental. The specs still move, and nothing has been audited for production use yet. Read the threat model, kick the tires, file issues. The colony grows by whistling back.

JOIN THE COLONY ⇗