As suggested in this answer i can use nacl for public key encryption with:
ephemeral_pk ‖ box( m, recipient_pk, ephemeral_sk, nonce=blake2b(ephemeral_pk ‖ recipient_pk))
But if i want also the sender to verify that it is him. Would the practice to use HMAC with preshared key or using a box as nonce be safe?
ephemeral_pk ‖ box( m, recipient_pk, ephemeral_sk, nonce=HMAC(ephemeral_pk ‖ recipient_pk, hmac_key))
ephemeral_pk ‖ box( m, recipient_pk, ephemeral_sk, nonce=box(ephermal_pk ‖ recipient_pk, nonce=blake2b(ephemeral_pk ‖ recipient_pk),recipient_pk, sender_sk))
I was looking into the tweetnacl implementation. And there it appeared to me that the nonce length is 24 bytes. So i would have to truncate the nonces created with HMAC or box. Would this impact the overall security in an negative way?
The third possibility would be to sign the secret with
sender_sign_sk and provide
sender_sign_pk to the recipient.
From my trials i got the speed of the hmac solution to be on par with the normal hashing solution. The box solution is about 1.5 times slower and the solution with additional signing is about 3 times slower.