# Authenticated encryption using libsodium's crypto_box_curve25519xsalsa20poly1305

It seems that crypto_box_easy, generates a random nonce and appends it to the cipher text in libsodium.

I understand using the same nonce with the same key can be catastrophic with salsa20poly1305, as such is it bad practice to re-use the same public/private (static) curve25519 keys when using crypto_box_easy?

Is it enough to assume that libsodium will ensure a random nonce is always used, or should curve25519 keypairs be regenerated on each use?

crypto_box_easy() doesn't generate a random nonce. But as documented, using a random nonce is safe, and can be done using randombytes_buf(nonce, sizeof nonce);. It's still the application's responsibility to include that nonce in the payload.
• Yes, a key can be reused as long as a (key, nonce) tuple is not reused. Swift-sodium does that automatically, and intentionally hides internal implementation details, including in the documentation. Users are not even expected to know what a nonce is. Ultimately, the Swift-sodium API should work with libhydrogen/libsodium2 with no changes. – Frank Denis Nov 26 '19 at 13:16
• Backward compatibility. The C libsodium API cannot be changed at this point. The Swift wrappers are more recent and didn't have the same constraints. In libhydrogen, nonces are automatically generated and included, and the box API is gone. – Frank Denis Nov 26 '19 at 13:22