Scenario 1: SenderA sends message1 to ReceiverB
message1 is encrypted using NACL crypto_box using SenderA secret key and ReceiverB public key.
we understand that the NACL crypto_box authenticator proves to ReceiverB that message1 originated from SenderA.
we understand that ReceiverB cannot prove to a third party that message1 originated from SenderA because ReceiverB could have calculated the same authenticator. For our purposes this is a good thing.
Scenario 2:
AttackerA steals ReceiverB secret key and is also able to stage a man in the middle attack
We understand that AttackerA can now read all messages addressed to ReceiverB. We also understand that AttackerA can now impersonate ReceiverB and send out messages as ReceiverB. We accept that this may happen and we can manage the consequences.
What we cannot manage and must remain valid is that ReceiverB can always prove that any message received from SenderA (intercepted by AttackerA or not) has indeed originated from SenderA. Is there anyway that AttackerA can change an existing message from SenderA and still make it appear to ReceiverB as a valid message from SenderA?
Thank you