I want to start using NaCL to sign messages that will go into a message queue, and I noticed that it generates different keys for each operation. Is there a reason for this? Can I not use the same PK for signing and encryption?

  • 1
    $\begingroup$ It's advised to use different keys for signing and encryption. security.stackexchange.com/questions/1806/… $\endgroup$
    – Nova
    Feb 9, 2015 at 21:02
  • $\begingroup$ I see, thanks. I guess they figured they'd go with it for safety, since, as far as I can see, there are no actual attacks for it. $\endgroup$ Feb 10, 2015 at 1:25
  • $\begingroup$ This is Bernstein's library. You can rest assured that he'll always go for safety/security first. $\endgroup$
    – Maarten Bodewes
    Feb 10, 2015 at 9:22
  • 1
    $\begingroup$ The problem arises in complex protocols, e.g. for blind signatures, where the signer does not know the content he is signing. If the same keys are used, he could actually decrypt instead of sign something, and with the blinding he has no idea what he has done. $\endgroup$
    – tylo
    Feb 11, 2015 at 15:42

2 Answers 2

  • The encryption part of NaCl is older. I think NaCl itself still doesn't have official signature support.

    NaCl's box uses montgomery form public keys together with the montgomery ladder. This ladder only returns the x-coordinate of the result and thus is not compatible with most signature algorithms.

    Ed25519 on the other hand uses (twisted) edwards form, with keys in the same format.

    But it is possible to convert the keys between these formats (the missing sign of the second coordinate can cause some complications when converting from montgomery). There are several encryption products which use these conversions to share a key.

  • Using the same key for multiple purposes requires the algorithms to be jointly secure. Some people are not comfortable with that. Tanja Lange voiced some vague doubts at 30c3.

    See Using same keypair for Diffie-Hellman and signing


The answer to the question actually goes back to the basics of cryptography. Many people confuse the two fundamental uses of cryptology:

  1. Privacy
  2. Authentication

The first item, privacy, is accomplished by encryption. Encryption, however, does not guarantee that the secret message actually came from its supposed source. It does not even guarantee that the message wasn't tampered with. This is where authentication comes in. It guarantees that the message came from the intended source and that it hasn't been altered.

You could use the same key for both things, but depending on the implementation and the cipher mode you are using, you could seriously compromise either the security of the key or the reliability of the authentication. Therefore, it is always better to use separate keys for encryption and authentication. Many implementations make things user-friendly by requesting a single key or password, but behind the scenes they use that password to generate separate keys for encryption and authentication (or signing).

  • 1
    $\begingroup$ NaCl uses authenticated encryption (crypto_box). You can use crypto_box for authentication (typically with long term keys) and confidentiality (typically with ephemeral keys). Sharing long term keys between signatures and crypto_box based authentication is useful. $\endgroup$ Feb 10, 2015 at 17:49
  • $\begingroup$ My answer speaks to the general uses of cryptology. There may well be many applications where it is safe to use the same key, but as a user, someone who is not in control of which ciphers and modes may be used, it is best practice to use separate and unrelated keys. There is nothing preventing NaCl from changing their internal implementation in the future, but what is worse, a vulnerability could be exposed that compromises either half of the AE algorithm. By using separate keys a user can reduce the damage done. $\endgroup$ Feb 10, 2015 at 18:18
  • $\begingroup$ That's reasonable, thanks. PGP/GPG use the same keypair for both, though, no? That's why I'm wondering what's different about NaCl, but I'm guessing DJB went for maximum safety there. $\endgroup$ Feb 10, 2015 at 22:51
  • $\begingroup$ @StavrosKorokithakis Yes, PGP does use the same key for both, which I think adds to the misperception that it is OK in all cases. It really depends on the implementation and that's why users, when given a choice, should always use two separate keys. $\endgroup$ Feb 13, 2015 at 14:07
  • $\begingroup$ @StavrosKorokithakis: not really. PGP/GPG can use an RSA keypair for both sign (which PGP further divides into Certify, Sign-data, and Authenticate) and encrypt, although this is no longer considered good practice, but not other key types; in particular ECDSA and EdDSA keys (alg#s 19 and 22) can only sign and 'ECDH' keys (really ECIES, alg# 18, in practice always subkey) can only encrypt. $\endgroup$ Oct 15, 2021 at 1:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.