How to sign messages using the NOISE Protocol Framework?

Question

I wanted to learn more about secure messaging and started a personal project using the libhydrogen library. From my understanding, instead of using public-key encryption, the library relies on the noise protocol framework to create ephemeral session keys shared by both parties to encrypt and decrypt messages. I was wondering if the same session keys can be used to sign and verify the messages, or should this better be done with another (not shared) key pair? Also, I couldn't find any information on how long these session keys should last. Are they intended to be used for several days, weeks, or longer, or should I think of a session key as a login to an online service that expires after 10-15min, unless you stay active?

As I said, I am new to the topic and there might be very straightforward answers. Unfortunately, I couldn't find this information myself. Thanks in advance.

Answer 1

If you need signatures, use the signatures API. Signing key pairs may or may not be ephemeral, this depends on your use case. You'll need some way to determine that a signing keypair belongs to whoever you think it belongs to, this can't be handled by the library alone.

Signing key pairs and key exchange key pairs are different data types (hydro_sign_keypair vs hydro_kx_keypair or hydro_kx_session_keypair) and thus can't be used interchangeably.

A session should last at most for as long as a given connection using the service lasts. That might be weeks, but is more likely only as long as a user stays active.