Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I'm working on creating a secure digital vault. I'm using mnemonic to generate a seed. The seed is used to generate a signing key pair for identity verification. However I want to also encrypt the contents of the vault for recovery purposes.
Can the same seed be used for signing, and for encrypting the data? (I can add a salt or some deterministic function if that helps).
This is related: Using a single Ed25519 key for encryption and signature
However am unsure whether it answers the question.
If you absolutely needed to advertise one public key that could be used both for public-key authenticated encryption ("crypto_box") and also for signing ("crypto_sign"), that would be a reason to map key pairs between the Twisted Edwards Ed25519 curve (which is preferred for signing operations) and the Montgomery curve Curve25519 (which is preferred for ECDH operations). E.g. you'd advertise a Curve25519 public key that people can use to encrypt and send data to you, but your software would map it to the Ed25519 equivalent prior to using it for verifying signatures.
However, it sounds like you are using symmetric encryption for the vault (and not asymmetric encryption). Therefore this mapping between curves is not relevant to you.
Therefore, use strings such as "encryption" and "signing" as info parameters to HKDF-Expand (along with your seed as the uniformly distributed pseudorandom key) to generate the symmetric encryption key and the signing secret key. If your seed is 256 bits and you need to derive a 256 bit key, that's essentially equivalent to just doing HMAC-SHA256(seed || info) (see https://datatracker.ietf.org/doc/html/rfc5869).
Infofields and you have now two "seeds". But beware of the details as the security will depend on that. $\endgroup$