Why does NaCL have different keys for signing and encryption?

I want to start using NaCL to sign messages that will go into a message queue, and I noticed that it generates different keys for each operation. Is there a reason for this? Can I not use the same PK for signing and encryption?

• It's advised to use different keys for signing and encryption. security.stackexchange.com/questions/1806/… – Nova Feb 9 '15 at 21:02
• I see, thanks. I guess they figured they'd go with it for safety, since, as far as I can see, there are no actual attacks for it. – Stavros Korokithakis Feb 10 '15 at 1:25
• This is Bernstein's library. You can rest assured that he'll always go for safety/security first. – Maarten Bodewes Feb 10 '15 at 9:22
• The problem arises in complex protocols, e.g. for blind signatures, where the signer does not know the content he is signing. If the same keys are used, he could actually decrypt instead of sign something, and with the blinding he has no idea what he has done. – tylo Feb 11 '15 at 15:42

• The encryption part of NaCl is older. I think NaCl itself still doesn't have official signature support.

NaCl's box uses montgomery form public keys together with the montgomery ladder. This ladder only returns the x-coordinate of the result and thus is not compatible with most signature algorithms.

Ed25519 on the other hand uses (twisted) edwards form, with keys in the same format.

But it is possible to convert the keys between these formats (the missing sign of the second coordinate can cause some complications when converting from montgomery). There are several encryption products which use these conversions to share a key.

• Using the same key for multiple purposes requires the algorithms to be jointly secure. Some people are not comfortable with that. Tanja Lange voiced some vague doubts at 30c3.

The answer to the question actually goes back to the basics of cryptography. Many people confuse the two fundamental uses of cryptology:

1. Privacy
2. Authentication

The first item, privacy, is accomplished by encryption. Encryption, however, does not guarantee that the secret message actually came from its supposed source. It does not even guarantee that the message wasn't tampered with. This is where authentication comes in. It guarantees that the message came from the intended source and that it hasn't been altered.

You could use the same key for both things, but depending on the implementation and the cipher mode you are using, you could seriously compromise either the security of the key or the reliability of the authentication. Therefore, it is always better to use separate keys for encryption and authentication. Many implementations make things user-friendly by requesting a single key or password, but behind the scenes they use that password to generate separate keys for encryption and authentication (or signing).

• NaCl uses authenticated encryption (crypto_box). You can use crypto_box for authentication (typically with long term keys) and confidentiality (typically with ephemeral keys). Sharing long term keys between signatures and crypto_box based authentication is useful. – CodesInChaos Feb 10 '15 at 17:49
• My answer speaks to the general uses of cryptology. There may well be many applications where it is safe to use the same key, but as a user, someone who is not in control of which ciphers and modes may be used, it is best practice to use separate and unrelated keys. There is nothing preventing NaCl from changing their internal implementation in the future, but what is worse, a vulnerability could be exposed that compromises either half of the AE algorithm. By using separate keys a user can reduce the damage done. – Security Aficionado Feb 10 '15 at 18:18
• That's reasonable, thanks. PGP/GPG use the same keypair for both, though, no? That's why I'm wondering what's different about NaCl, but I'm guessing DJB went for maximum safety there. – Stavros Korokithakis Feb 10 '15 at 22:51
• @StavrosKorokithakis Yes, PGP does use the same key for both, which I think adds to the misperception that it is OK in all cases. It really depends on the implementation and that's why users, when given a choice, should always use two separate keys. – Security Aficionado Feb 13 '15 at 14:07