Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do?
crypto_box_seal(crypto_sign(M, alice), bob)
(Alice signs message, then box seals to bob.)
This answer suggests crypto_box_seal then crypto_sign, am wondering if the opposite ordering is ok.
Thanks!
No, it is not!.
If you signed a message to someone before then they can use this to send an anonymous message to Bob and Bob may consider that it is coming from Alice.
The solution is easy, use crypto_box (Authenticated encryption of the NaCl) to produce a message and send it with crypto_box_seal.
$$\text{crypto_box_seal}(\text{crypto_box}(m)).$$ Here we are using short form of the boxes, no details.
The outer layer provides anonymity for all, the inner layer provides the identity. Since only Bob can reveal the crypto_box_seal, then only Bob can reveal the crypto_box and will understand the message is coming from who; Alice.
Note that Bob may not be aware that there is a crypto_box in the crypto_box_seal, put an additional message in the crypto_box` for indication.
$$\text{crypto_box_seal}(\text{After the columns there is a crypto box:}||\text{crypto_box}(m))$$
