# Using authenticated encryption along with signing

I know of a project that implemented e2e encryption using both authenticated encryption and public key signing. So the ciphertext produced for a message would be:

ciphertext = signature_Ed25519 + nonce + mac_Poly1305 + XSalsa20(plaintext)


I struggle to understand what the benefits of doing both could be, as MAC is already there to authenticate the sender. Any ideas?

The full flow is as follows:

Alice and Bob each have an X25519 encryption key pair for talking to each other.
Alice has an Ed25519 signing key pair that is used for everybody.


Alice sends a message to Bob:

1. encrypted = crypto_box(plaintext, nonce, bob_publickey, alice_secretkey)


This is provided by crypto_box().

encrypted is now = nonce + mac_Poly1305 + XSalsa20(plaintext)

2. ciphertext = crypto_sign(encryted, alice_signing_secretkey)


This is provided by crypto_sign().

ciphertext is now = signature_Ed25519 + encrypted

• Can you be more clear? What was included in the signature? Using which key ? On what part of protocol etc? It could be that signature is only used to authenticate the identity of sender and to authenticate some key used (e.g. Server's Diffie Hellman public key) and the content was only encrypted using AEAD, allowing deniability. Jan 25 at 13:40
• I've elaborated! Jan 25 at 13:57
• I have not used any of the C's crypto libraries so I am not very familiar with it. I assume this crypto_box performs ECDH in X2559, Key derivation (maybe involving nonce) and encryption. Anyway, It looks like it is encrypted with AEAD and then the ciphertext signed. First to authenticate the message that it is indeed created by someone Bob did X25519 ECDH Key exchange with (assuming Ephemeral) and second to prove that that someone is Alice. Jan 25 at 15:46