PSBT/MuSig2 coordination over Nostr relays: transport invariants for nonce safety under at-least-once delivery

In the realm of ensuring digital security, particularly in the context of session and identity management across devices, several robust measures are recommended beyond mere user warnings. The effectiveness of warnings as a preventative measure is limited, especially when it involves scenarios where no active user interface exists to display such warnings—for instance, during the restoration of data on a new or wiped device. In such cases, the previously used security nonces may be unknowingly restored, posing a significant risk.

To address these vulnerabilities, a layered security approach is necessary. The first layer involves excluding session stores from backups and sync operations entirely. This can be achieved by configuring settings such as excluding the session store from iCloud backups on iOS devices, and disabling 'allowBackup' on Android. By ensuring that session data is never backed up, there is no risk of it being inappropriately restored.

The second layer ties the session identity strictly to a device-local key. This means that any session data that accidentally gets transferred to another device won't be recognized, thereby rendering the data useless for session hijacking attempts. This effectively ensures that any session copied to another device will not be acknowledged under the original session ID and will prompt a fresh start.

Finally, the third layer proposes warnings for situations where the user has direct control, such as while closing, exporting, or syncing data during an active session. These warnings are more effective because they prompt immediate user action. However, without the foundational security provided by the first two measures, reliance on warnings alone could lead to severe security breaches involving critical keys.

To solidify these strategies, it is proposed to frame these recommendations as normative requirements rather than mere guidance. This approach underscores the importance of strict adherence due to the potential severe consequences of implementation discretion in these scenarios. Such structured requirements ensure a higher standard of security practice that does not depend on variable human factors or settings configurations that might be overlooked.