2
$\begingroup$

When encrypting a string through the Libsodium secret box feature, the ciphertext is 48 bytes longer than the plain text message ...

I am wondering why this is ... since the nonce is only 24 bytes.

Improve this question
$\endgroup$
2
  • $\begingroup$ There should be a 16 byte MAC as well. $\endgroup$
    – CodesInChaos
    Mar 17 '18 at 13:01
  • $\begingroup$ @CodesInChaos Thanks, I guess that answers it. Many thanks and my apologies for this n00b question ;) ... However 24 + 16 <> 48 .... Am I missing something else? $\endgroup$
    – Vincent Mertens
    Mar 17 '18 at 13:02
5
$\begingroup$

Notice that $\operatorname{secretbox}$ has a $16$-byte MAC too. For reference, I've included $\operatorname{box}$ too.

$$ \operatorname{secretbox} : \text{24 nonce} + \text{0 xsalsa} + \text{16 poly1305}\\ \operatorname{box} : \text{32 curve25519} + \text{24 nonce} + \text{0 xsalsa} + \text{16 poly1305} $$

However, the nonce is user-controlled and normally not included in the ciphertext overhead as it is usually never sent, often a protocol-level counter.

You say "secret box" but you mean the normal "box" which uses a public key. Your ciphertext is expanded with your $32$-byte ephemeral public key and the $16$-byte MAC.

Improve this answer
$\endgroup$
7
  • $\begingroup$ Thx. So nonce = 24 bytes, mac = 16 bytes, chacha20_encrypt = 8 bytes ? $\endgroup$
    – Vincent Mertens
    Mar 17 '18 at 13:10
  • $\begingroup$ Chacha is a stream cipher with no padding. So no overhead. BTW: updated answer regarding the validity of counting nonces here. $\endgroup$
    – cypherfox
    Mar 17 '18 at 13:12
  • $\begingroup$ apparently xsalsa is the default; not chacha. $\endgroup$
    – cypherfox
    Mar 17 '18 at 13:14
  • $\begingroup$ Thanks. But 24 + 16 is still not equal to 48 ... So I am still missing something that's probably obvious ... $\endgroup$
    – Vincent Mertens
    Mar 17 '18 at 13:18
  • $\begingroup$ Hmm... Can you send some code? $\endgroup$
    – cypherfox
    Mar 17 '18 at 13:21
1
$\begingroup$

Sealed boxes: public key (32 bytes) + MAC (16 bytes).

The nonce is deterministic, as a new key pair is created for every message.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.