Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application.

From what I understand, all Bob needs to to decrypt a message from Alice with NaCl's crypto_box_open is the public key of Alice and his private key. Thus, if an eavesdropping adversary stored all messages and later gains access to Bob's private key, he can decrypt all previously stored communication.

  • Am I correct in this matter?
  • How would one best work around this problem? (preferably only using algorithms implemented in NaCl)
share|improve this question
up vote 11 down vote accepted

Yes, you are correct.

The simplest way without stepping outside NaCl would be to have both create an ephemeral, random crypto_box_keypair, then exchange public keys using their long term keys. Further communication would use that new keypair for crypto_box during that session. After they are done with the session, delete those ephemeral keys from memory.

The private keys would only exist for the session, so an attacker who later compromised one of their computers would be unable to decrypt any of the messages encrypted with those keys and could only find out their public keys from stored communications.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.