Perfect Forward Secrecy with NaCl

Question

I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application.

From what I understand, all Bob needs to to decrypt a message from Alice with NaCl's crypto_box_open is the public key of Alice and his private key. Thus, if an eavesdropping adversary stored all messages and later gains access to Bob's private key, he can decrypt all previously stored communication.

• Am I correct in this matter?
• How would one best work around this problem? (preferably only using algorithms implemented in NaCl)

Answer 1

Yes, you are correct.

The simplest way without stepping outside NaCl would be to have both create an ephemeral, random crypto_box_keypair, then exchange public keys using their long term keys. Further communication would use that new keypair for crypto_box during that session. After they are done with the session, delete those ephemeral keys from memory.

The private keys would only exist for the session, so an attacker who later compromised one of their computers would be unable to decrypt any of the messages encrypted with those keys and could only find out their public keys from stored communications.