Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application.

From what I understand, all Bob needs to to decrypt a message from Alice with NaCl's crypto_box_open is the public key of Alice and his private key. Thus, if an eavesdropping adversary stored all messages and later gains access to Bob's private key, he can decrypt all previously stored communication.

  • Am I correct in this matter?
  • How would one best work around this problem? (preferably only using algorithms implemented in NaCl)

PS.: I was thinking of doing a Diffie-Hellman exchange wrapped inside crypto_box/crypto_box_open messages to ensure authentication. (although the encryption is unneeded in this case, so it seems unnecessarily complex)

share|improve this question

1 Answer 1

up vote 7 down vote accepted

Yes, you are correct.

The simplest way without stepping outside NaCl would be to have both create an ephemeral, random crypto_box_keypair, then exchange public keys using their long term keys. Further communication would use that new keypair for crypto_box during that session. After they are done with the session, delete those ephemeral keys from memory.

The private keys would only exist for the session, so an attacker who later compromised one of their computers would be unable to decrypt any of the messages encrypted with those keys and could only find out their public keys from stored communications.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.