Encryting data with password for local storage using libsodium

Question

I want to encrypt data that is stored on the hard disk using a user-entered password. For this I look into the sodium docs and all I can find for symmetric encryption is authenticated encryption.

This method requires a "nonce" which is needed again in decryption. If I understand correctly, nonces are important for communication, but for my case they are not needed. Correct?

Also to generate a key from the user entered password requires salt, which must be the same every time.

• Is authenticated encryption really the correct choice for my task? If yes, how should I handle the nonce?
• How should I handle the salt for generating the key? Should I always use the same? Or where should I store it?

Answer 1

A nonce ensures that the same plaintext will always be mapped to different ciphertexts using the same key. Schemes requiring a nonce should always get a nonce, even for file-encryption you can't guarantee that your users won't encrypt the very same file twice, for reasons only known to them.

Now to answer your questions:

• Authenticated encryption (AE) is always the mode of choice, except for full-disk encryption (FDE), where you'd have a severe penalty. But as you don't do FDE, AE is the right choice for you.
• Regarding the nonce, you have several possibilities.
  1. You can store it in plain before your file.
  2. You can use your password based key derivation function (PBKDF) to derive the nonce in the same call as you derive the key.
  3. (not recommended) You could hold it constant, assuming the key is different each time.
  4. (not recommended) You could increment it always, but generating at random is easier concerning management I'd say.
• Using a different salt each time won't hurt you, but reusing the salt may hurt you, so don't reuse salts. Using always the same salt may end up in same keys (as soon as a user supplies the same password twice) and salting is used to prevent "known-hash" attacks, which in fact fails it purpose if you reuse the salt and an attacker can simply try pre-calculated values. So use a different (unpredictable) salt in each case.
• Where should you store the salt? The salt don't need to be secret, so you can store it in plain at the beginning of the file.