Verion of crypto_box() which doesn't allow the sender to decrypt previously sent messages

Question

Libsodium's crypto_box() family of functions allow the sender to send messages using its public/private keypair knowing the receiver's public key, and allow the receiver to verify the identity of the sender knowing its public key.

However, since those functions work by calculating a shared symmetric key, the compromise of the sender's private key would allow the attacker to decrypt all messages previously sent using the same combination of sender's private key and receiver's public key.

There's another function, crypto_box_seal(), which does not have this weakness, since it uses an ephemeral keypair, but it doesn't allow verifying the identity of the sender.

Is there a function which allows both things - verify the identity of the sender and make sure previously sent messages can't be recovered without knowing the private key of the receiver?

I was thinking of doing what crypto_box_seal() does, but instead of using Poly1305 as an authentication tag, use the output of crypto_sign_detached() on the hash of the rest of the output (i.e. on ephemeral public key and ciphertext). That is, for each message, we generate an ephemeral keypair, encrypt plaintext using it, then sign the whole thing using our long-term private key and use that as an authentication tag. Would that make sense? Is there perhaps a better way?

Answer 1

In order to verify the identity of the sender, the messages needs a signature, that the receiver can verify using the sender's public key.

After encrypting the message with crypto_box_seal(), sign it with crypto_sign().

The receiver can verify the signature and remove it with crypto_sign_open() and then decrypt the rest.

What you suggested also works, but you'll have to implement all the bits yourself.