I know of a project that implemented e2e encryption using both authenticated encryption and public key signing. So the ciphertext produced for a message would be:
ciphertext = signature_Ed25519 + nonce + mac_Poly1305 + XSalsa20(plaintext)
I struggle to understand what the benefits of doing both could be, as MAC is already there to authenticate the sender. Any ideas?
The full flow is as follows:
Alice and Bob each have an X25519 encryption key pair for talking to each other.
Alice has an Ed25519 signing key pair that is used for everybody.
Alice sends a message to Bob:
1. encrypted = crypto_box(plaintext, nonce, bob_publickey, alice_secretkey)
This is provided by crypto_box().
encrypted is now = nonce + mac_Poly1305 + XSalsa20(plaintext)
2. ciphertext = crypto_sign(encryted, alice_signing_secretkey)
This is provided by crypto_sign().
ciphertext is now = signature_Ed25519 + encrypted