Nostr Authentication

Nostr authentication lets users sign in to Moodle with their Nostr identity instead of a username and password.

When a user clicks "Log in with Nostr" on the standard login page, the plugin:

1. Requests the user's public key from their NIP-07 browser extension.
2. Issues a single-use, time-limited challenge (nonce) from the server.
3. Asks the extension to sign a NIP-98 HTTP-auth event (kind 27235) embedding that challenge.
4. Verifies the event server-side — event-ID integrity (NIP-01) and BIP340 Schnorr signature over secp256k1 — with no external PHP dependencies beyond the GMP extension.

On first login, a Moodle account can be auto-created (configurable). Because Moodle is built around email, the username, email and display name are derived from the user's npub (NIP-19), and the hex public key is stored for future account linking. The plugin can optionally read the user's public Nostr profile (kind-0) from a configurable relay to populate their display name.

Security

• The server never sees a private key — signing happens entirely in the browser extension.
• The challenge nonce is single-use and expires after 120 seconds.
• The signed event must be timestamped within 60 seconds of the server clock (replay protection).
  Ships with a Python security test suite (20 cases) covering replay, signature-tampering, and protocol-validation paths.

Requirements

• Moodle 5.1+
• PHP 8.1+ with the GMP extension (declared in `db/environment.xml`; required for Schnorr signature verification).

Privacy

• The plugin stores no personal data beyond what Moodle core keeps in the standard user account (implements the Privacy API as a null-provider).

🧡 Made with support from Librería de Satoshi