I'm building a project using libsodium's AEAD + Key Exchange system and want to write a proof justifying the security of the project. I am wondering if I can find a source detailing the exact security definition libsodium's Key Exchange system satisfies.

I know the textbook definition of IND-CCA2 and that AEAD satisfies it, but I'm not sure how to formalize the "combined" security of AEAD using a secret key generated from a Key Exchange algorithm.

More specifically, I'm interested in a proof of the non-existence of a "backdoor" public key that, when exchanged with a private key and then used in encryption, would leak information about that private key.

  • 2
    $\begingroup$ The answer to the question of 'is it secure?' is yes assuming you use crypto_kx and not just crypto_scalarmult or crypto_box, which don't include the public keys for shared secret/key derivation. This can be a vulnerability, which doesn't seem to be very well known. $\endgroup$ Jul 22, 2022 at 17:53
  • $\begingroup$ Thank you! Is there a formal security definition on for which adversary is it secure? I'm mostly interested in the case of a very active adversary that can observe existing public keys and do key exchange with honest users. $\endgroup$
    – abacaba
    Jul 22, 2022 at 18:47
  • $\begingroup$ I have added some clarification about the problem. $\endgroup$
    – abacaba
    Jul 22, 2022 at 19:14
  • 2
    $\begingroup$ There are weak public keys for X25519, but libsodium rejects them. That affects shared secrets though, not leaking someone's private key, which shouldn't be possible. However, you can leak an Ed25519 private key when signing a message with the correct public key and then an incorrect public key. $\endgroup$ Jul 23, 2022 at 9:48
  • 1
    $\begingroup$ Thank you so much for your comments! $\endgroup$
    – abacaba
    Jul 24, 2022 at 21:19


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.