Skip to main content
61 votes

Why Curve25519 for encryption but Ed25519 for signatures?

While it is true that Elliptic Curve Diffie Hellman (ECDH), Elliptic Curve Signature Generation (ECDSA), and Elliptic Curve Signature Verification rely on scalar multiplications, these are usually ...
Ruggero's user avatar
  • 7,104
37 votes

Why Curve25519 for encryption but Ed25519 for signatures?

The old terminology was confusing, so they've rebranded a bit. X25519 is Elliptic Curve Diffie-Hellman (ECDH) over Curve25519 Ed25519 is Edwards-curve Digital Signature Algorithm (EdDSA) over ...
Scott Arciszewski's user avatar
28 votes
Accepted

Argon2 output length and parameter storage?

You need to consider the weakest link property: a security system is never stronger than its weakest link. Since Argon2 is a password-based function, the weak link here is going to be the strength of ...
Luis Casillas's user avatar
24 votes

What happened to Poly1305AES? Is it obsolete?

Poly1305 is a universal hash function. The output of that function cannot be used safely without being encrypted. In order to encrypt it, any cipher can be used. AES was used as an example in the ...
Frank Denis's user avatar
  • 2,973
19 votes
Accepted

How safe are Libsodium Crypto Boxes?

You can think of crypto_box_curve25519xsalsa20poly1305 as some composition of X25519, a key agreement scheme; XSalsa20, a symmetric-key stream cipher; and Poly1305, a one-time polynomial evaluation ...
Squeamish Ossifrage's user avatar
14 votes
Accepted

What is the difference between a sealed box and a normal box in libsodium?

The premise of boxes is that Alice and Bob know each other and write to each other. Alice can use a box to send a message to Bob. On receipt of the box, Bob knows (a) it came from Alice, and (b) ...
Squeamish Ossifrage's user avatar
13 votes

What happened to Poly1305AES? Is it obsolete?

What are those existing constructions? Usually people consider three to four scenarios for authenticated encryption for embedded environments: Constrained for ROM + RAM In this case you probably ...
SEJPM's user avatar
  • 46.1k
9 votes
Accepted

libsodium x25519 and Ed25519 small order check

Short answer: You don't need to worry about the blacklist or point validation unless you are designing an exotic protocol. Medium answer: It depends on what you are trying to do. There is a short ...
Squeamish Ossifrage's user avatar
7 votes

Is the following crypto compatible so that I can use the same keys for both products (Wireguard & Libsodium)?

WireGuard uses keys that are on the Montgomery curve, not the Edwards curve. It's the standard X25519 or Curve25519 commonly used for ECDH. In libsodium, ...
ZX2C4's user avatar
  • 81
7 votes
Accepted

Why/how is libsodium/nacl's cryptobox repudiable?

To take SEJPM's answer and be more explicit: Bob can also generate that ciphertext. One of the conditions on nonrepudiation is that no one (other than Alice, assuming her private key wasn't leaked) ...
poncho's user avatar
  • 148k
7 votes
Accepted

Representations of secret keys on Curve25519

I'm pretty sure this is an endianness issue. Specifically, taking the S_a value from the Josefsson draft and reversing the order of the bytes (i.e. pairs of hex ...
Ilmari Karonen's user avatar
7 votes
Accepted

Which version of ChaCha is more secure?

The only difference between these is the nonce size (and, consequently, the internal counter size). The core function is exactly the same. They all offer the exact same security level if they are used ...
Frank Denis's user avatar
  • 2,973
7 votes

What happened to Poly1305AES? Is it obsolete?

Poly1305 today is generally used as part of some AEAD construction alongside Salsa20/ChaCha20, because the key advantage of all of these algorithms is excellent performance in platforms that don't ...
Luis Casillas's user avatar
7 votes
Accepted

How to find out the block size of Xchacha20 in Libsodium?

TL;DR; ChaCha's block size is 64-byte i.e. 512-bit. Xchacha20 extends the nonce of ChaCha20 without changing the function of ChaCha20. The aim of Xchacha20 is to extend the 128-bit nonce size of ...
kelalaka's user avatar
  • 49k
6 votes
Accepted

Why NaCL does not provide anonymous public key cryptography?

As I now understand the question: why doesn't NaCL provide a primitive for unauthenticated encryption, making ciphertext blobs that are only decrypt-able by a receiver identified by their public key? ...
Thomas M. DuBuisson's user avatar
6 votes

Why do two Argon hashes with the same password differ?

This function returns a string that the verification function will consider valid when given the same password. You shouldn't have to care about what the string actually contains. If only because the ...
Frank Denis's user avatar
  • 2,973
6 votes

How to use Libsodium encryption (in PHP) in the most secure possible way?

No need to implement padding, as it's already available. See the second example of the libsodium-PHP module. Partially-known plaintext has no implication on security, especially in counter mode where ...
Frank Denis's user avatar
  • 2,973
6 votes
Accepted

libsodium vs gnupg curve25519 compatibility

Found the solution. All that was needed was to reverse the bytes in the curve25519 secret point. Apparantly PGP uses little-endian for this, while ed25519 uses big-endian.
Martijn Otto's user avatar
6 votes
Accepted

Generate secp256k1 ECC key pair with libsodium

Your question has been asked on the GitHub, too: Is there some way with sodium/libsodium to make all crypto_sign_* methods use SECp256k1? And the answer was given as No, there isn't, and there ...
kelalaka's user avatar
  • 49k
5 votes
Accepted

Why are 48 bytes appended to Libsodium encrypted messages if nonce is 24 bits?

Notice that $\operatorname{secretbox}$ has a $16$-byte MAC too. For reference, I've included $\operatorname{box}$ too. $$ \operatorname{secretbox} : \text{24 nonce} + \text{0 xsalsa} + \text{16 ...
cypherfox's user avatar
  • 1,422
5 votes

Why do two Argon hashes with the same password differ?

ArgonHashString calls the libsodium function crypto_pwhash_str which automatically generates a salt value that is part of the ...
aventurin's user avatar
  • 543
5 votes
Accepted

What is the best practices for storing ed25519 private keys which is used by nodes of my application to communicate with each other?

If you are storing the file on disk then PKCS#12 Personal Information Exchange Syntax format is best practice. It is commonly referred to as a key store. But note that PKCS#12 relies on secret key ...
Maarten Bodewes's user avatar
  • 93.2k
5 votes

Why/how is libsodium/nacl's cryptobox repudiable?

How can Alice says she didn't encrypt a ciphertext, if Bob can decrypt it using her public key? This is due to the way how the underlying implementation works.* For this purpose, every private key ...
SEJPM's user avatar
  • 46.1k
5 votes
Accepted

Verification of HMAC in libsodium

memcmp() is not constant-time. The property called "constant-time" does not mean (confusingly) that every runs in a constant amount of time; an algorithm ...
Thomas Pornin's user avatar
4 votes
Accepted

How do I properly calculate an inverse element for curve25519 when implementing Sphinx password store protocol?

While point coordinates lie in the finite field over which the curve is defined, in this case $GF(p)$ with $p=2^{255}-19$, the scalars that you use lie in a field defined by the order of the generator,...
Ruggero's user avatar
  • 7,104
4 votes
Accepted

Does using crypto_stream_xor allow listeners to forge crypto_secretbox messages?

crypto_secretbox uses the first 32 bytes of XSalsa20 output as the key for Poly1305. Thus you are correct that using ...
CodesInChaos's user avatar
  • 24.9k
4 votes

What is special about an entropy count (RNDGETENTCNT) of 160 for libsodium initialization?

The internal RNG uses a 256 bit seed, and on Linux, a byte is read from /dev/random to check that the pool is seeded. The reason for requiring 160 bits to be ...
Frank Denis's user avatar
  • 2,973
4 votes
Accepted

Using public-key signature instead of having API key

Using public key cryptography instead of a long-term shared secret is slightly more complicated but has major advantages. One of them being that the server doesn't learn the secret key. This protects ...
Frank Denis's user avatar
  • 2,973
4 votes
Accepted

What does "crypto_box" actually mean in libsodium and NaCl?

What does "cryptobox" mean in Libsodium and NaCl? In general, and in specific case, what does "box" do? cryptobox or correctly ...
cypherfox's user avatar
  • 1,422
4 votes

Why is there a slight mismatch most of the time in X25519 private keys depending on functions used, but public keys always match (same seed for both)?

'curve25519' (as Bernstein originally called it, now renamed X25519 or XDH25519 for clarity because the same curve in different form is used for Ed25519[ph]) requires the privatekey (multiplier) to be ...
dave_thompson_085's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible