diff --git a/exit/exit.go b/exit/exit.go
index 34068f7..2d72703 100644
--- a/exit/exit.go
+++ b/exit/exit.go
@@ -4,6 +4,7 @@ import (
 	"encoding/base32"
 	"encoding/hex"
 	"fmt"
+	"github.com/ekzyis/nip44"
 	"log/slog"
 	"net"
 	"strings"
@@ -14,7 +15,6 @@ import (
 	"github.com/asmogo/nws/socks5"
 	"github.com/btcsuite/btcd/btcec/v2"
 	"github.com/btcsuite/btcd/btcec/v2/schnorr"
-	"github.com/ekzyis/nip44"
 	"github.com/nbd-wtf/go-nostr"
 	"github.com/nbd-wtf/go-nostr/nip19"
 	"github.com/puzpuzpuz/xsync/v3"
@@ -228,13 +228,9 @@ func (e *Exit) ListenAndServe(ctx context.Context) {
 // routes the message to the appropriate handler based on its protocol type.
 func (e *Exit) processMessage(ctx context.Context, msg nostr.IncomingEvent) {
 	// hex decode the target public key
-	targetPublicKeyBytes, err := hex.DecodeString("02" + msg.PubKey)
-	if err != nil {
-		return
-	}
-	// hex decode the private key
-	privateKeyBytes, err := hex.DecodeString(e.config.NostrPrivateKey)
+	privateKeyBytes, targetPublicKeyBytes, err := protocol.GetEncryptionKeys(e.config.NostrPrivateKey, msg.PubKey)
 	if err != nil {
+		slog.Error("could not get encryption keys", "error", err)
 		return
 	}
 	sharedKey, err := nip44.GenerateConversationKey(privateKeyBytes, targetPublicKeyBytes)
diff --git a/exit/https.go b/exit/https.go
index 04a1fb8..d316607 100644
--- a/exit/https.go
+++ b/exit/https.go
@@ -7,7 +7,6 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
-	"encoding/hex"
 	"encoding/pem"
 	"errors"
 	"fmt"
@@ -79,14 +78,9 @@ func (e *Exit) handleCertificateEvent(
 	if privateKeyEvent == nil {
 		return tls.Certificate{}, errNoCertificateEvent
 	}
-	targetPublicKeyBytes, err := hex.DecodeString("02" + privateKeyEvent.PubKey)
+	privateKeyBytes, targetPublicKeyBytes, err := protocol.GetEncryptionKeys(e.config.NostrPrivateKey, msg.PubKey)
 	if err != nil {
-		return tls.Certificate{}, fmt.Errorf("could not decode target public key: %w", err)
-	}
-	// hex decode the private key
-	privateKeyBytes, err := hex.DecodeString(e.config.NostrPrivateKey)
-	if err != nil {
-		return tls.Certificate{}, fmt.Errorf("could not decode private key: %w", err)
+		return tls.Certificate{}, err
 	}
 	sharedKey, err := nip44.GenerateConversationKey(privateKeyBytes, targetPublicKeyBytes)
 	if err != nil {
diff --git a/netstr/conn.go b/netstr/conn.go
index 6f73dfb..d248f71 100644
--- a/netstr/conn.go
+++ b/netstr/conn.go
@@ -129,14 +129,9 @@ func (nc *NostrConnection) handleNostrRead(buffer []byte) (int, error) {
 			}
 			nc.readIDs = append(nc.readIDs, event.ID)
 			// hex decode the target public key
-			targetPublicKeyBytes, err := hex.DecodeString("02" + event.PubKey)
+			privateKeyBytes, targetPublicKeyBytes, err := protocol.GetEncryptionKeys(nc.privateKey, event.PubKey)
 			if err != nil {
-				return 0, fmt.Errorf("could not decode target public key: %w", err)
-			}
-			// hex decode the private key
-			privateKeyBytes, err := hex.DecodeString(nc.privateKey)
-			if err != nil {
-				return 0, fmt.Errorf("could not decode private key: %w", err)
+				return 0, fmt.Errorf("could not get encryption keys: %w", err)
 			}
 			sharedKey, err := nip44.GenerateConversationKey(privateKeyBytes, targetPublicKeyBytes)
 			if err != nil {
diff --git a/protocol/nip44.go b/protocol/nip44.go
new file mode 100644
index 0000000..207883d
--- /dev/null
+++ b/protocol/nip44.go
@@ -0,0 +1,17 @@
+package protocol
+
+import (
+	"encoding/hex"
+)
+
+func GetEncryptionKeys(privateKey, publicKey string) ([]byte, []byte, error) {
+	targetPublicKeyBytes, err := hex.DecodeString("02" + publicKey)
+	if err != nil {
+		return nil, nil, err
+	}
+	privateKeyBytes, err := hex.DecodeString(privateKey)
+	if err != nil {
+		return nil, nil, err
+	}
+	return privateKeyBytes, targetPublicKeyBytes, nil
+}
diff --git a/protocol/signer.go b/protocol/signer.go
index 81731bb..db2e45b 100644
--- a/protocol/signer.go
+++ b/protocol/signer.go
@@ -3,7 +3,6 @@ package protocol
 import (
 	"fmt"
 
-	"encoding/hex"
 	"github.com/ekzyis/nip44"
 	"github.com/nbd-wtf/go-nostr"
 )
@@ -66,15 +65,9 @@ func (s *EventSigner) CreateSignedEvent(
 	tags nostr.Tags,
 	opts ...MessageOption,
 ) (nostr.Event, error) {
-	// hex decode the target public key
-	targetPublicKeyBytes, err := hex.DecodeString("02" + targetPublicKey)
+	privateKeyBytes, targetPublicKeyBytes, err := GetEncryptionKeys(s.privateKey, targetPublicKey)
 	if err != nil {
-		return nostr.Event{}, fmt.Errorf("could not decode target public key: %w", err)
-	}
-	// hex decode the private key
-	privateKeyBytes, err := hex.DecodeString(s.privateKey)
-	if err != nil {
-		return nostr.Event{}, fmt.Errorf("could not decode private key: %w", err)
+		return nostr.Event{}, fmt.Errorf("could not get encryption keys: %w", err)
 	}
 	sharedKey, err := nip44.GenerateConversationKey(privateKeyBytes, targetPublicKeyBytes)
 	if err != nil {