1
$\begingroup$

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. Each user keeps a database of public keys of the other users but it needs first to verify that the other users actually own the claimed public key.

Can I use libsodium to verify the ownership of the keys? Let's say the flow of verifying the ownership of the key (or let's call it authentication) works as follows:

  1. The claimant sends the verifier its public key.

  2. The verifier generates a long random binary challenge (let's say 128 or 256 bits) and encrypts it with the sealed box method crypto_box_seal() as illustrated in https://libsodium.gitbook.io/doc/public-key_cryptography/sealed_boxes and keeps the plaintext challenge in some private database.

  3. The claimant receives the encrypted challenge and decrypts it with crypto_box_seal_open() and sends the verifier back the plaintext answer

  4. The verifier checks the received answer and compares it with the expected answer stored in its database. If they do match then the public key really belongs to the claimant and it gets stored in the verifier's database.

Is is this flow correct? Can it be shorter since curve25519 keys are usually implemented only for encryption and not signing purposes? So users can just upload the signature of their own public keys in step no. 2 and thus we can skip the additional request from the verifier to the claimant in step no. 3?

Improve this question
$\endgroup$
  • $\begingroup$ I mean I assume that I know that I am talking to Alice, I just need to verify that Alice really owns the curve25519 public key she just sent me. $\endgroup$ – Kri Noe Dec 13 '19 at 15:51
  • $\begingroup$ I am not sure I am following you, I asked a similar question yesterday about PGP and WoT and thus you are correct for that case, but in this question I am assuming that I know that I am already talking to Alice (i.e. an authenticated user by a common server between us). She just needs to verify her curve25519 publickey so that I can know for sure she really owns it and accept it. $\endgroup$ – Kri Noe Dec 13 '19 at 16:08
  • $\begingroup$ You need to know and trust something about Alice already. If this cannot be the DH public key (maybe because she's using ephemeral keys), it may be a signature public key. Send a nonce to Alice, and challenge her to sign (nonce || your PK || her PK). $\endgroup$ – Frank Denis Dec 13 '19 at 16:59
  • $\begingroup$ @FrankDenis, thanks. the curve25519 are not used for DH. It will be used as something like PGP keys for encryption purposes. Bob and Alice already know each other because they are authenticated by a common server that provides the service. And they already are communicating over a secure channel. Bob just needs to verify that Alice really owns the curve25519 key she claims to own by sending her a challenge via crypto_box_seal_open() and waits for the decrypted answer for verification. $\endgroup$ – Kri Noe Dec 13 '19 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.