# Using crypto_sign then crypto_box_seal for anonymous messages

If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do?

crypto_box_seal(crypto_sign(M, alice), bob)


(Alice signs message, then box seals to bob.)

This answer suggests crypto_box_seal then crypto_sign, am wondering if the opposite ordering is ok.

Thanks!

No, it is not!.

If you signed a message to someone before then they can use this to send an anonymous message to Bob and Bob may consider that it is coming from Alice.

The solution is easy, use crypto_box (Authenticated encryption of the NaCl) to produce a message and send it with crypto_box_seal.

$$\text{crypto_box_seal}(\text{crypto_box}(m)).$$ Here we are using short form of the boxes, no details.

The outer layer provides anonymity for all, the inner layer provides the identity. Since only Bob can reveal the crypto_box_seal, then only Bob can reveal the crypto_box and will understand the message is coming from who; Alice.

Note that Bob may not be aware that there is a crypto_box in the crypto_box_seal, put an additional message in the crypto_box` for indication.

$$\text{crypto_box_seal}(\text{After the columns there is a crypto box:}||\text{crypto_box}(m))$$

• Oh I understand. I could take any signed message and then use crypto_box_seal to encrypt to a recipient and they would think it came from the other person. Didn't quite think that through, thank you! – Gabriel Jan 7 at 3:07