It is my understanding that libsodium's sealed_box is based on X25519, a Diffie-Hellman function: By combining the X25519 key agreement with a symmetric cipher and having a recipient derive the symmetric key, a message can be constructed that can only be decrypted by making use of the X25519 private key.

Can this construction be generalized to other Diffie-Hellman functions (ECDH with other curves, or the ordinary non-EC Diffie-Hellman)?

  • $\begingroup$ Note that both the crypto_box and sealed_box use authenticated encryption. $\endgroup$ – kelalaka Jun 18 '20 at 16:05

Yes. The general construction is called IES (Integrated Encryption Scheme), most often practiced as ECIES (elliptic curve IES). The principle is the same: use the “key agreement” primitive (DH, ECDH, X25519, …) to construct a secret that is shared by two parties, each of which knows both sides' public keys but only their own private key. The shared secret is then used to derive a secret key for symmetric authenticated encryption.

I don't know if libsodium's crypto_box conforms exactly to an official ECIES standard (there are many) in terms of how it formats the data. ECIES standards have a lot of options in terms of the group (DH group or EC curve), on what data is included in the derivations, and on the freshness of parameters (e.g. ephemeral vs multiple-use keys). Depending on these options, the resulting constructions may have different properties in terms of nonce-misuse-resistance, resistance to a compromise of the private key, resistance to side channels, etc. But the basic principle of hybrid encryption constructed on top of a key agreement is the same.

Some reading on how the details of how IES is done influences secondary security properties:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.