crypto_box() family of functions allow the sender to send messages using its public/private keypair knowing the receiver's public key, and allow the receiver to verify the identity of the sender knowing its public key.
However, since those functions work by calculating a shared symmetric key, the compromise of the sender's private key would allow the attacker to decrypt all messages previously sent using the same combination of sender's private key and receiver's public key.
There's another function,
crypto_box_seal(), which does not have this weakness, since it uses an ephemeral keypair, but it doesn't allow verifying the identity of the sender.
Is there a function which allows both things - verify the identity of the sender and make sure previously sent messages can't be recovered without knowing the private key of the receiver?
I was thinking of doing what
crypto_box_seal() does, but instead of using
Poly1305 as an authentication tag, use the output of
crypto_sign_detached() on the hash of the rest of the output (i.e. on ephemeral public key and ciphertext). That is, for each message, we generate an ephemeral keypair, encrypt plaintext using it, then sign the whole thing using our long-term private key and use that as an authentication tag. Would that make sense? Is there perhaps a better way?