# One way shared key encryption with NaCl - is it safe to generate a throwaway keypair for the encrypting party

Libsodium seems to be a famous library so I'm not sure I need to introduce it but just incase: https://nacl.cr.yp.to/ (Edit: NaCl not Libsodium, oops!)

So, I need users to be able to pass me information that no one else can read, so I've generated a secret key. Using NaCl I create a keypair from that secret key and I share the publicKey of the keypair with my users.

Now, they encrypt their information with nacl.box() which requires their message, a nonce, my public key, but also their private key? In the past I've traditionally used asymmetric encryption like AES (edit: I meant RSA) and only needed my public key... so I just generate, on the user's end, a random keyPair for the user to use. I'll call this throwawayKey.

encryptedMessage = nacl.box(message = "foo",
nonce = 0,
publicKey = MY_SHARED_KEY,
secretKey = throwawayKey.secretKey());


Then they can send me back this encrypted message AND send me back the public key for the throwaway key I generated them... throwawayKey.publicKey()

Then, I can later decrypt on my end, using this:

decryptedMessage = nacl.box.open(message = encryptedMessage,
nonce = 0,
publicKey = throwawayKey.publicKey(),
secretKey = MY_SECRET_KEY);


Is this a safe way to have users send their info to my securely... I'm not used to having to generate a throwaway keypair for generic one way asymmetric encryption, am I using NACL wrong? It feels wrong to just generate a random throwaway key haha...

• FYI NaCl isn't libsodium. Libsodium is an extension to NaCl's API designed to be easier to use. doc.libsodium.org – SAI Peregrinus Feb 2 at 4:27
• Also, AES is symmetric, not asymmetric, and doesn't have a public key. – SAI Peregrinus Feb 2 at 4:32
• @SAIPeregrinus Ah sorry I meant to say RSA! – Albert Renshaw Feb 2 at 5:16