More of a theoretical question...
Taking a system where Lib Sodium has been used for asymmetric encryption, where a "crypto_box_keypair" has been generated, and the public key has been distributed to a number of different systems.
Would it be possible to sign a message using that keypair?
As in, the message remains in plain text, and a signature is generated with the secret key (possibly indirectly), and anyone in possession of (and trusts) the public key, can verify that the message hasn't been tampered with.
Considering that the "crypto_sign" function requires the use of "crypto_sign_keypair", not "crypto_box_keypair".
From a PHP implementation point of view, I was wondering if you could...
Take the keypair that has been previously generated by:
<?php $key_pair = sodium_crypto_box_keypair(); $key_secret = sodium_crypto_box_secretkey($key_pair); $key_public = sodium_crypto_box_publickey($key_pair); ?>
Then, for every message you want to sign, create a "crypto_sign_keypair", and use
sodium_crypto_sign() as intended:
<?php // $sign_seed = random_bytes(SODIUM_CRYPTO_SIGN_SEEDBYTES); // $sign_pair = sodium_crypto_sign_seed_keypair($sign_seed); $sign_pair = sodium_crypto_sign_keypair(); $sign_secret = sodium_crypto_sign_secretkey($sign_pair); $sign_public = sodium_crypto_sign_publickey($sign_pair); $message = 'Hello'; $message_signed = sodium_crypto_sign($message, $sign_secret); ?>
$sign_pair can be destroyed, because the recipient just needs to use
<?php $message = sodium_crypto_sign_open($message_signed, $sign_public); ?>
The problem is that
$sign_public needs to be sent to the recipient.
Where they need to verify it hasn't been tampered with, and that it came from the owner of the original
$key_secret, by using their trusted copy of
sodium_crypto_sign_detachedis basically the same thing, but does not contain the message in its output.
sodium_crypto_boxrequires the recipient to have a keypair as well.
sodium_crypto_box_sealuses the public key to encrypt.
sodium_crypto_aead_*use a shared key (symmetric).
sodium_crypto_authuses a shared key.