Questions tagged [libsodium]

"The sodium crypto library". A cryptographic multi-language-library with support for many modern cryptographic primitives, that is a fork of the NaCl library. The library focuses on providing easy-to-use cryptographic primitives.

Filter by
Sorted by
Tagged with
64 votes
3 answers
29k views

Why Curve25519 for encryption but Ed25519 for signatures?

NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different ...
Simon's user avatar
  • 741
19 votes
2 answers
19k views

Argon2 output length and parameter storage?

I just started using the libsodium port for .net today and the output length parameter kind of confused me (I'm using the argon2i implementation). With my limited exposure to hashing, whatever hash ...
coding4fun's user avatar
14 votes
2 answers
10k views

How safe are Libsodium Crypto Boxes?

I am currently working on a huge PHP project and we are seriously considering to use the Libsodium PHP library in it. My question is related to the "sodium crypto box" functionality. We would use ...
abc's user avatar
  • 331
12 votes
3 answers
3k views

What happened to Poly1305AES? Is it obsolete?

I've been told that Poly1305AES is a great choice of MAC for constrained (embedded) environments. I'd checked out DJB's writing on it briefly, and have to say that I found its simplicity likeable, ...
ulidtko's user avatar
  • 349
7 votes
2 answers
2k views

libsodium x25519 and Ed25519 small order check

Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a ...
user3368561's user avatar
6 votes
2 answers
3k views

What is the difference between a sealed box and a normal box in libsodium?

I'm trying to learn libsodium to better my crypto knowledge. One nagging question I have is what is the difference between libsodium's sealed box and their normal box? Not in terms of technicalities ...
Sukima's user avatar
  • 191
5 votes
1 answer
2k views

Additional Data in AEAD (Chacha20-poly1305 libsodium)

I have recently been playing with Chacha20-Poly1305 in libsodium, and all of the examples state the additional data portion of the tag is stored in plaintext when encrypted. But from what I can tell ...
TerrorByte's user avatar
5 votes
1 answer
4k views

How to use Libsodium encryption (in PHP) in the most secure possible way?

In a PHP project in which fool-proof encryption is fundamental, I'm using the Libsodium library. Hope you guys can shine some light on the following questions. For all of the following functions, it ...
abc's user avatar
  • 331
5 votes
1 answer
2k views

What is the best practices for storing ed25519 private keys which is used by nodes of my application to communicate with each other?

I am developing some kind of a P2P network where the nodes communicate with each other via TCP and each message is signed by Ed25519 private key. I use libsodium for signing and signature verification....
defuz's user avatar
  • 153
5 votes
1 answer
3k views

Should I use NaCl or libsodium for my application?

While looking for end-to-end encryption for my app users, I stumbled upon NaCl and libsodium. I am unsure from a security perspective which of these implementations I should use for my cross-platform ...
user avatar
5 votes
1 answer
1k views

Security implications of public nonce

I'm planning to use the crypto_box() functions of Nacl (or, alternatively, the crypto_box_easy() functions of libsodium) to ...
dsd's user avatar
  • 151
5 votes
1 answer
751 views

Nonce reuse resistance

I read this article and I think the approach outlined there is very interesting for one of our use case. We use ChaCha20 Poly1305 (via Sodium ...
Ayende Rahien's user avatar
4 votes
2 answers
760 views

Why/how is libsodium/nacl's cryptobox repudiable?

https://nacl.cr.yp.to/box.html see "security model". As far as I can see, Alice encrypts a message using her private key, Bob's public key and a nonce. Bob decrypts the message using Alice's public ...
fadedbee's user avatar
  • 916
4 votes
1 answer
2k views

How does constant-time comparison work?

libsodium has a method for comparing two byte sequences in constant time. Is the idea here to simply avoid early-out if a difference in the data is detected? When I first heard of such a thing I ...
user avatar
4 votes
1 answer
3k views

Which version of ChaCha is more secure?

Which version of ChaCha is more secure? XChaCha20-Poly1305-IETF ChaCha20-IETF-Poly1305 ChaCha20-Poly1305 I am looking for 256bit strength for large datasets. ...
Woodstock's user avatar
  • 1,384
4 votes
1 answer
1k views

Why NaCL does not provide anonymous public key cryptography?

At the same time Sodium provides API for anonymous encryption without using ephemeral keys. Is it a bad practice to just use other user public key to encrypt a message?
Andrey Kuznetsov's user avatar
4 votes
2 answers
1k views

Curve25519 - Alice can decrypt her own message to Bob?

I'm developing an application with multiple clients and one server. All clients will have the same hard-coded Curve25519 key pair as well as the server's public key. The server will have its own key ...
TimH - Codidact's user avatar
4 votes
1 answer
585 views

I have this list of LibSodium primitives, which should I pick so that the implementations tend to be interoperable?

When I integrate lib sodium, into a c# project, and try to consume, encryption and decryption in a particular way, it works, but the confusion is about, which method to use while encryption or ...
Kaushal B's user avatar
4 votes
1 answer
545 views

How do I tack on "additional data" to libsodium's public-key authenticated encryption?

I note that libsodium provides AEAD when using symmetric cryptography. And yet, under section 8 (Public-key cryptography) there are no public-key methods described which allow for additional data (AD)...
user3325588's user avatar
4 votes
1 answer
783 views

Can libsodium's X25519 encryption construction be generalized?

It is my understanding that libsodium's sealed_box is based on X25519, a Diffie-Hellman function: By combining the X25519 key agreement with a symmetric cipher and having a recipient derive the ...
soa's user avatar
  • 43
3 votes
1 answer
888 views

How to find out the block size of Xchacha20 in Libsodium?

I heard that Xchacha20 works like a block cipher so that even if it wants to encrypt one byte, it will do the work of at least one block. So technically it works similar to a block cipher in counter ...
caveman's user avatar
  • 573
3 votes
1 answer
477 views

Representations of secret keys on Curve25519

https://datatracker.ietf.org/doc/html/draft-josefsson-tls-curve25519-06#appendix-A.2 gives the following as a secret key / public key combo: ...
neubert's user avatar
  • 2,927
3 votes
2 answers
842 views

Using related pair of cryptographic keys to open/seal plaintext

I am using curve25519xsalsa20poly1305/fn.seal from sodiumoxide crate written in Rust language which is a wrapper over libsodium ...
ustulation's user avatar
3 votes
1 answer
2k views

What does "crypto_box" actually mean in libsodium and NaCl?

I cannot find what "crypto_box" actually means. In general, and in specific cases, what does "box" do? I know that libsodium is authenticated encryption, but GPG is not. "Box" makes me think the ...
Napasakorn Sriwonkeed's user avatar
3 votes
2 answers
2k views

Using public-key signature instead of having API key

I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then ...
Ejonas GGgg's user avatar
3 votes
2 answers
668 views

What is special about an entropy count (RNDGETENTCNT) of 160 for libsodium initialization?

(Moved from StackOverflow) In the Usage documentation for libsodium, before calling the initialization function sodium_init, they suggest you check the entropy ...
Zane Beckwith's user avatar
3 votes
1 answer
338 views

Does using crypto_stream_xor allow listeners to forge crypto_secretbox messages?

I understand that NaCl's crypto_stream and crypto_stream_xor don't do any authentication like ...
Jack O'Connor's user avatar
3 votes
2 answers
2k views

Point addition in NaCl/libsodium (Curve25519)

In NaCl and libsodium, the crypto_scalarmult function implements the operation $Q = kP$ (scalar/point multiplication). There doesn't seem to be a function for point ...
user avatar
3 votes
1 answer
406 views

Schnorr NIZK over Ed25519

I am trying to implement the following Schnorr non-interactive zero-knowledge protocol: https://www.rfc-editor.org/rfc/rfc8235#page-7 I'm using the libsodium 1.0.16 and GNU MP libraries. I just can't ...
stojanman's user avatar
  • 133
3 votes
1 answer
300 views

Does it matter whether the KDF salt is integrity protected?

I am writing a simple application, mainly as a fun challenge, but also to hopefully someday use as my password manager. I'm using pynacl's SecretBox, which ...
user371366's user avatar
3 votes
1 answer
2k views

Can I always derive a key pair from password+salt with libsodium?

I'm using libsodium to create public/secret key pairs from a password and salt combination by using crypto_pwhash_scryptsalsa208sha256 to generate a seed and ...
Mauricio de Souza's user avatar
3 votes
0 answers
96 views

Can I use Libsodium crypto_box_easy for signing with 32 byte keypair?

I have a chat system where multiple clients communicate securely using Libsodium authenticated encryption. Every client have their own 32 byte key pair. If two clients want to communicate they first ...
tobalr's user avatar
  • 131
3 votes
0 answers
122 views

Verifying the ownership of curve25519 public keys

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
Kri Noe's user avatar
  • 53
3 votes
1 answer
565 views

Standard serialization format for libsodium-based messages

Does anyone know of a standardized serialization format which can be (or already is) widely used for encrypted messages? For a variety of reasons (mostly complexity, age and poor support across a lot ...
rmalayter's user avatar
  • 2,297
2 votes
2 answers
4k views

Why do two Argon hashes with the same password differ?

Can someone explain to me what the ArgonHashString function in libsodium returns (i'm using the .net port). For example i called it twice with the same string: ...
coding4fun's user avatar
2 votes
2 answers
323 views

Why is there a slight mismatch most of the time in X25519 private keys depending on functions used, but public keys always match (same seed for both)?

I'm trying to wrap my head around going from a seed to a SigningKey, and also obtaining a ...
mkl's user avatar
  • 107
2 votes
1 answer
639 views

Is the following crypto compatible so that I can use the same keys for both products (Wireguard & Libsodium)?

I am wondering if it is possible to use the public/private keys of two WireGuard peers also in another communication channel using libsodium? According to the WireGuard Protocol documentation and the ...
user3637203's user avatar
2 votes
2 answers
623 views

Why are 48 bytes appended to Libsodium encrypted messages if nonce is 24 bits?

When encrypting a string through the Libsodium secret box feature, the ciphertext is 48 bytes longer than the plain text message ... I am wondering why this is ... since the nonce is only 24 bytes.
abc's user avatar
  • 331
2 votes
1 answer
234 views

Verification of HMAC in libsodium

libsodium verifies that the HMAC is correct with the following code: return crypto_verify_32(h, correct) | (-(h == correct)) | sodium_memcmp(correct, h, 32); ...
Alexandre Hamez's user avatar
2 votes
1 answer
5k views

Why is the public/private key length used in libsodium so much shorter than needed for RSA [duplicate]

Reading the libsodium source I see that is uses a key length of 32 bytes (256 bit) for private/public key encryption. For RSA private/public key encryption a key length of 2048 (or 4095) bit is ...
Nathan's user avatar
  • 181
2 votes
2 answers
308 views

ECDH between identical public keys

We are using libsodium and regarding exchanging secrets we would like to use the so-called crypto_box (https://libsodium.gitbook.io/doc/public-key_cryptography/authenticated_encryption). Under the ...
Trafo's user avatar
  • 21
2 votes
3 answers
978 views

One way shared key encryption with NaCl - is it safe to generate a throwaway keypair for the encrypting party

So, I need users to be able to pass me information that no one else can read, so I've generated a secret key. Using NaCl I create a key pair from that secret key and I share the public key of the key ...
Albert Renshaw's user avatar
2 votes
1 answer
188 views

Using crypto_sign then crypto_box_seal for anonymous messages

If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do? ...
Gabriel's user avatar
  • 123
2 votes
2 answers
473 views

Does libsodium sealed box leak key ids?

I am using python and libnacl, which is a libsodium wrapper, to develop an application where users can deposit encrypted data. Alice uses ...
Brolf's user avatar
  • 23
2 votes
1 answer
2k views

Encryting data with password for local storage using libsodium

I want to encrypt data that is stored on the hard disk using a user-entered password. For this I look into the sodium docs and all I can find for symmetric encryption is authenticated encryption. ...
Nathan's user avatar
  • 181
2 votes
1 answer
144 views

Is it possible to derive the recipient's public key from libsodium's crypto_box?

Libsodium has "crypto_box_seal" which according to the documentation is used to "anonymously send messages to a recipient given its public key.", which hides the sender. But Is it possible for Eve to ...
Bear's user avatar
  • 23
2 votes
0 answers
135 views

What good elliptic curve uses a scalar field the size of the Ristretto255 group?

I am implementing Bulletproofs over Ristretto255. (I am using libsodium, so can't switch to another Elliptic Curve implementation.) I need to implement zero knowledge verification of elliptic curve ...
Michael's user avatar
  • 21
2 votes
0 answers
73 views

Is CMS for data still relevant

I have an application where I need to store small to moderate amounts of data in a symmetrically encrypted form. For various reasons, CMS with an AuthEnvelopedData seems to tick all the requirements. ...
mikb's user avatar
  • 121
2 votes
0 answers
152 views

Negotiating a session key, when only one public-key is exchanged via QR Code

Question I want to create a secure channel between a server and a client. It is only important that the client can verify the identity of the server, not the other way around. In my special case, an ...
deiShie0's user avatar
2 votes
0 answers
151 views

P2P Website/Database Encryption Process

Sorry if this doesn't fit the guidelines, but I believe it is a conceptual issue that is not opinion-based and can be reasonably answered in a single authoritative answer (I'm also struggling to find ...
thebronsonite's user avatar