1

It seems that crypto_box_easy, generates a random nonce and appends it to the cipher text in libsodium.

I understand using the same nonce with the same key can be catastrophic with salsa20poly1305, as such is it bad practice to re-use the same public/private (static) curve25519 keys when using crypto_box_easy?

Is it safe enough to assume that libsodium will ensure a random nonce is always used, or should curve25519 keypairs be regenerated on each use?

Woodstock
  • 1,454
  • 1
  • 15
  • 26

1 Answers1

2

crypto_box_easy() doesn't generate a random nonce. But as documented, using a random nonce is safe, and can be done using randombytes_buf(nonce, sizeof nonce);. It's still the application's responsibility to include that nonce in the payload.

Alternatively, the more recent secretstream API automatically creates and attaches a nonce, and can encrypt a sequence of messages without having to care about the nonce at all.

(that being said, this is a programming question, so cryptography.stackexchange may not be the best place for it)

Frank Denis
  • 3,073
  • 19
  • 19