So I am attempting to generate a JWE using an X25519 to encrypt the for the Content Encryption Key (CEK) and AES-256-GCM for the content.

My issue however is that NaCl needs an IV (nonce in NaCl) for both the asymmetric encryption of the key and the symmetric encryption of the content.

Looking at other examples such as the ietf-jose cookbook, (X25519, A128GCM), they only have the one "top level" IV.

Is it ok to use the same IV for both the x25519 and the A256GCM?

If not, where does the IV for the x25519 get placed in the JWE?

Or is there something else I am missing entirely?

  header: {
    enc: "A256GCM",
    alg: "ECDH-ES",
    epk: {
      crv: "X25519",
      kty: "OKP",
      x: ephemPublicKey
      iv: "Perhaps we stuff the X25519 iv here?",
    iv: "Perhaps we stuff the X25519 iv here?",
  iv: "iv for the A256GCM only or both?",
  • $\begingroup$ Where did you see that X25519 needs for an IV/Nonce? By the way, the A128GCM should be AES128-GCM. $\endgroup$ – kelalaka Jun 16 at 19:22
  • $\begingroup$ @kelalaka TweetNaCl.js requires it (x25519-xsalsa20-poly1305): github.com/dchest/… $\endgroup$ – Wil W Jun 17 at 13:30
  • $\begingroup$ @kelalaka of course now I see I wasn't actually doing just x25519, but x25519-xsalsa20-poly1305. Perhaps there just isn't a standard for doing x25519-xsalsa20-poly1305 with AES-256-GCM because why add the additional layer? $\endgroup$ – Wil W Jun 17 at 13:43
  • $\begingroup$ If you look at NaCl page, you will see that x25519 for ECDH key exchange, xsalsa20 is a stream cipher and poly1305 is for mutual authentication. $\endgroup$ – kelalaka Jun 17 at 14:16

So the answer thanks to @kelalaka's comments is that X25519 doesn't need an iv. I was not using just X25519, but instead x25519-xsalsa20-poly1305 via TweetNaCl.js.

There isn't really a need to use x25519-xsalsa20-poly1305 to wrap the AES-256-GCM key, as the "xsalsa20 is a stream cipher and poly1305 is for mutual authentication".

Regarding JWE, there isn't a way to use x25519-xsalsa20-poly1305 with a JWE because JWE requires Authenticated Encryption Additional Data (AEAD) and salsa only has Authenticated Encryption (AE).

So my options with a JWE are to switch to just using x25519 + AES-256-GCM OR use just x25519-xsalsa20-poly1305 without using a JWE (or at least not a standards compliant one).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.