I would like to proof that I am in possession of private key sk for public key pk using libsodium.

Therefore I am signing a constant message m using libsodium's crypto_sign function. The signed message (signature + m) is then published.

libsodium crypto_sign uses Ed25519 as digital signature scheme.


  • Does the reuse of a constant message might introduce any attack vectors?
  • The libsodium documentation on crypto_sing states:

    Verifiers need to already know and ultimately trust a public key before messages signed using it can be verified.


    Is that information relevant for my case as I actually do not want to verify the message, but want to proof the possession of sk?

  • 1
    $\begingroup$ Well, if you don't have protection against replay attacks, how do you know that another party isn't just resending your signature? And if the signature is not explicitly tied to the session, how are you protecting against man-in-the-middle? $\endgroup$ – Maarten Bodewes Jan 20 at 16:39

If you are going to public the same message with a signature multiple times, it is vulnerable to a replay attack. This is where another party basically copies your message and signature and can re-publish it at any time, implying that they own the key. To counter this, add a small piece of information to the message before signing, say a counter or random number that is unique per signature published.

As for trusting signing keys, a trusted party ie a Certificate Authority or a PKI must be used so that any data received from them is trusted. So when Alice publishes a message and a signature, the CA tells people Alice's static public key, this is trusted, and then everyone can safely verify the fact that Alice does indeed own the private key she claims to own.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.