Libsodium seems to be a famous library so I'm not sure I need to introduce it but just incase: https://nacl.cr.yp.to/ (Edit: NaCl not Libsodium, oops!)
So, I need users to be able to pass me information that no one else can read, so I've generated a secret key. Using NaCl I create a keypair from that secret key and I share the publicKey of the keypair with my users.
Now, they encrypt their information with
nacl.box() which requires their message, a nonce, my public key, but also their private key? In the past I've traditionally used asymmetric encryption like
AES (edit: I meant RSA) and only needed my public key... so I just generate, on the user's end, a random keyPair for the user to use. I'll call this
encryptedMessage = nacl.box(message = "foo", nonce = 0, publicKey = MY_SHARED_KEY, secretKey = throwawayKey.secretKey());
Then they can send me back this encrypted message AND send me back the public key for the throwaway key I generated them... throwawayKey.publicKey()
Then, I can later decrypt on my end, using this:
decryptedMessage = nacl.box.open(message = encryptedMessage, nonce = 0, publicKey = throwawayKey.publicKey(), secretKey = MY_SECRET_KEY);
Is this a safe way to have users send their info to my securely... I'm not used to having to generate a throwaway keypair for generic one way asymmetric encryption, am I using NACL wrong? It feels wrong to just generate a random throwaway key haha...