When encrypting a string through the Libsodium secret box feature, the ciphertext is 48 bytes longer than the plain text message ...
I am wondering why this is ... since the nonce is only 24 bytes.
$\begingroup$
$\endgroup$
-
$\begingroup$ There should be a 16 byte MAC as well. $\endgroup$ – CodesInChaos Mar 17 '18 at 13:01
-
$\begingroup$ @CodesInChaos Thanks, I guess that answers it. Many thanks and my apologies for this n00b question ;) ... However 24 + 16 <> 48 .... Am I missing something else? $\endgroup$ – Vincent Mertens Mar 17 '18 at 13:02
$\begingroup$
$\endgroup$
Notice that $\operatorname{secretbox}$ has a $16$-byte MAC too. For reference, I've included $\operatorname{box}$ too.
$$ \operatorname{secretbox} : \text{24 nonce} + \text{0 xsalsa} + \text{16 poly1305}\\ \operatorname{box} : \text{32 curve25519} + \text{24 nonce} + \text{0 xsalsa} + \text{16 poly1305} $$
However, the nonce is user-controlled and normally not included in the ciphertext overhead as it is usually never sent, often a protocol-level counter.
You say "secret box" but you mean the normal "box" which uses a public key. Your ciphertext is expanded with your $32$-byte ephemeral public key and the $16$-byte MAC.
-
$\begingroup$ Thx. So nonce = 24 bytes, mac = 16 bytes, chacha20_encrypt = 8 bytes ? $\endgroup$ – Vincent Mertens Mar 17 '18 at 13:10
-
$\begingroup$ Chacha is a stream cipher with no padding. So no overhead. BTW: updated answer regarding the validity of counting nonces here. $\endgroup$ – cypherfox Mar 17 '18 at 13:12
-
$\begingroup$ apparently xsalsa is the default; not chacha. $\endgroup$ – cypherfox Mar 17 '18 at 13:14
-
$\begingroup$ Thanks. But 24 + 16 is still not equal to 48 ... So I am still missing something that's probably obvious ... $\endgroup$ – Vincent Mertens Mar 17 '18 at 13:18
-
$\begingroup$
$\endgroup$
Sealed boxes: public key (32 bytes) + MAC (16 bytes).
The nonce is deterministic, as a new key pair is created for every message.
