2
$\begingroup$

If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do?

crypto_box_seal(crypto_sign(M, alice), bob)

(Alice signs message, then box seals to bob.)

This answer suggests crypto_box_seal then crypto_sign, am wondering if the opposite ordering is ok.

Thanks!

$\endgroup$
2
$\begingroup$

No, it is not!.

If you signed a message to someone before then they can use this to send an anonymous message to Bob and Bob may consider that it is coming from Alice.

The solution is easy, use crypto_box (Authenticated encryption of the NaCl) to produce a message and send it with crypto_box_seal.

$$\text{crypto_box_seal}(\text{crypto_box}(m)).$$ Here we are using short form of the boxes, no details.

The outer layer provides anonymity for all, the inner layer provides the identity. Since only Bob can reveal the crypto_box_seal, then only Bob can reveal the crypto_box and will understand the message is coming from who; Alice.

Note that Bob may not be aware that there is a crypto_box in the crypto_box_seal, put an additional message in the crypto_box` for indication.

$$\text{crypto_box_seal}(\text{After the columns there is a crypto box:}||\text{crypto_box}(m))$$

$\endgroup$
1
  • 1
    $\begingroup$ Oh I understand. I could take any signed message and then use crypto_box_seal to encrypt to a recipient and they would think it came from the other person. Didn't quite think that through, thank you! $\endgroup$ – Gabriel Jan 7 at 3:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.