Why/how is libsodium/nacl's cryptobox repudiable?

Question

https://nacl.cr.yp.to/box.html see "security model".

As far as I can see, Alice encrypts a message using her private key, Bob's public key and a nonce. Bob decrypts the message using Alice's public key, his private key and the nonce.

The documentation says "The crypto_box function is not meant to provide non-repudiation."

How can Alice says she didn't encrypt a ciphertext, if Bob can verify its origin and authenticity using her public key?

(Assuming that the message must be in a known language or format to be 'real'.)

Answer 1

To take SEJPM's answer and be more explicit: Bob can also generate that ciphertext.

One of the conditions on nonrepudiation is that no one (other than Alice, assuming her private key wasn't leaked) could possible generate that message. This doesn't hold here. If Bob can decrypt the ciphertext, he knows Alice must have generated it (as Bob knows he didn't), however he can't prove it to anyone else.

Answer 2

How can Alice says she didn't encrypt a ciphertext, if Bob can decrypt it using her public key?

This is due to the way how the underlying implementation works.*

For this purpose, every private key is an integer $d_A$ and $d_B$ and every public key is the multiple of the well-defined "generator" $G$, as follows: $P_A:=d_A\times G$ and $P_B:=d_B\times G$. _{This actually operates on Curve25519, but that's just a technical detail.}

Now what the implementation does, is also called "static diffie-hellman key exchange". What this means is that Alice - in an honest execution - computes $K:=d_A\times P_B$, of which some deterministic derivative serves as the key. Pair this key with the provided nonce for XSalsa20**-Poly1305 encryption of the data and you're at it.

Now that we know the details, it's quite easy to realize how you can't prove who created the message, after all both would have derived the same static key and Bob could have easily faked all the associated meta-data to claim a message originally came from Alice - even though she never saw it.

---

_{* Or rather, how Bernstein imagined it to work. Implementations may do things differently but probably don't.
** XSalsa20 is basically just the linked Salsa20 with a larger nonce.}