I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application.
From what I understand, all Bob needs to to decrypt a message from Alice with NaCl's crypto_box_open is the public key of Alice and his private key. Thus, if an eavesdropping adversary stored all messages and later gains access to Bob's private key, he can decrypt all previously stored communication.
- Am I correct in this matter?
- How would one best work around this problem? (preferably only using algorithms implemented in NaCl)
PS.: I was thinking of doing a Diffie-Hellman exchange wrapped inside crypto_box/crypto_box_open messages to ensure authentication. (although the encryption is unneeded in this case, so it seems unnecessarily complex)