Multiple recipients

A message encrypted using a shared secret doesn’t authenticate the sender: anyone with a key can pretend to be the author of any message encrypted using that key.

This is usually not an issue when only two parties are involved.

However, it can become a concern for group communications, where a single key is shared by multiple recipients:.

Signatures can prove the identity of a sender. In order to prove the identity of a sender for messages encrypted using shared secrets, signatures can thus be combined with encryption.

The recommended approach is to:

  • Sign the message, as well as the context of the message: the identity of the sender, the identity of the recipient, and a message identifier (ex: uid, timestamp).
  • Encrypt and authenticate the message and its signature.

While, under some circumstances, a single key pair could be used both for signing and encryption, this is neither recommended nor usually necessary. In libsodium, signature and encryption public keys are only 32 bytes long, and these two kind of public keys can be encoded as a compound 64 byte key.

  • sender_kx.pk: the sender’s public key used to compute a shared secret
  • sender_kx.sk: the sender’s secret key used to compute a shared secret
  • recipient_kx.pk: the recipient’s public key for signature verification
  • recipient_kx.sk: the recipient’s secret key for signing
  1. static int crypto_sign_with_id(unsigned char *signed_msg, const unsigned char *msg, size_t msg_len,
  2.                                const unsigned char *sender_info, size_t sender_info_len,
  3.                                const unsigned char *recipient_info, size_t recipient_info_len,
  4.                                const unsigned char *info, size_t info_len,
  5.                                const unsigned char client_sign_sk[crypto_sign_SECRETKEYBYTES])
  6. {
  7.     crypto_sign_state st;
  9.     if (msg != signed_msg && msg_len > 0) {
  10.         memmove(signed_msg, msg, msg_len);
  11.     }
  12.     crypto_sign_init(&st);
  13.     crypto_sign_update(&st, sender_info, sender_info_len);
  14.     crypto_sign_update(&st, recipient_info, recipient_info_len);
  15.     crypto_sign_update(&st, info, info_len);
  16.     crypto_sign_update(&st, msg, msg_len);
  18.     return crypto_sign_final_create(&st, &signed_msg[msg_len], NULL, client_sign_sk);
  19. }
  21. static int
  22. crypto_sign_verify_with_id(const unsigned char *signed_msg, size_t signed_msg_len,
  23.                            const unsigned char *sender_info, size_t sender_info_len,
  24.                            const unsigned char *recipient_info, size_t recipient_info_len,
  25.                            const unsigned char *info, size_t info_len,
  26.                            const unsigned char client_sign_pk[crypto_sign_PUBLICKEYBYTES])
  27. {
  28.     crypto_sign_state st;
  30.     if (signed_msg_len < crypto_sign_BYTES) {
  31.         return -1;
  32.     }
  33.     crypto_sign_init(&st);
  34.     crypto_sign_update(&st, sender_info, sender_info_len);
  35.     crypto_sign_update(&st, recipient_info, recipient_info_len);
  36.     crypto_sign_update(&st, info, info_len);
  37.     crypto_sign_update(&st, signed_msg, signed_msg_len - crypto_sign_BYTES);
  39.     return crypto_sign_final_verify(&st, &signed_msg[signed_msg_len - crypto_sign_BYTES],
  40.                                     client_sign_pk);
  41. }
  2. typedef struct KXKeyPair_ {
  3.     unsigned char pk[crypto_kx_PUBLICKEYBYTES], sk[crypto_kx_SECRETKEYBYTES];
  4. } KXKeyPair;
  6. typedef struct SignKeyPair_ {
  7.     unsigned char pk[crypto_sign_PUBLICKEYBYTES], sk[crypto_sign_SECRETKEYBYTES];
  8. } SignKeyPair;
  10. #define MSG (const unsigned char *) "test"
  11. #define MSG_LEN (sizeof "test" - 1)
  13. static void create_key_pairs(KXKeyPair *sender_kx, KXKeyPair *recipient_kx,
  14.                              SignKeyPair *sender_sign, SignKeyPair *recipient_sign)
  15. {
  16.     crypto_kx_keypair(sender_kx->pk, sender_kx->sk);
  17.     crypto_kx_keypair(recipient_kx->pk, recipient_kx->sk);
  18.     crypto_sign_keypair(sender_sign->pk, sender_sign->sk);
  19.     crypto_sign_keypair(recipient_sign->pk, recipient_sign->sk);
  20. }
  22. int main(void)
  23. {
  24.     KXKeyPair     sender_kx, recipient_kx;
  25.     SignKeyPair   sender_sign, recipient_sign;
  26.     unsigned char sender_encrypt_k[crypto_kx_SESSIONKEYBYTES];
  27.     unsigned char signed_encrypted_msg[MSG_LEN + crypto_sign_BYTES + crypto_box_MACBYTES];
  28.     unsigned char signed_decrypted_msg[MSG_LEN + crypto_sign_BYTES];
  29.     unsigned char nonce[crypto_box_NONCEBYTES];
  31.     if (sodium_init() != 0) {
  32.         return 1;
  33.     }
  34.     create_key_pairs(&sender_kx, &recipient_kx, &sender_sign, &recipient_sign);
  36.     /* sender-side */
  38.     if (crypto_kx_client_session_keys(sender_encrypt_k, NULL, sender_kx.pk, sender_kx.sk,
  39.                                       recipient_kx.pk) != 0) {
  40.         return 1;
  41.     }
  42.     /* sign then encrypt */
  43.     if (crypto_sign_with_id(signed_encrypted_msg, MSG, MSG_LEN, sender_kx.pk, sizeof sender_kx.pk,
  44.                             recipient_kx.pk, sizeof recipient_kx.pk, nonce, sizeof nonce,
  45.                             sender_sign.sk) != 0 ||
  46.         crypto_secretbox_easy(signed_encrypted_msg, signed_encrypted_msg,
  47.                               MSG_LEN + crypto_sign_BYTES, nonce, sender_encrypt_k) != 0) {
  48.         return 1;
  49.     }
  51.     /* recipient-side */
  53.     if (crypto_kx_server_session_keys(NULL, sender_encrypt_k, recipient_kx.pk, recipient_kx.sk,
  54.                                       sender_kx.pk) != 0) {
  55.         return 1;
  56.     }
  57.     /* decrypt then verify the signature */
  58.     if (crypto_secretbox_open_easy(signed_decrypted_msg, signed_encrypted_msg,
  59.                                    MSG_LEN + crypto_sign_BYTES + crypto_box_MACBYTES, nonce,
  60.                                    sender_encrypt_k) != 0 ||
  61.         crypto_sign_verify_with_id(signed_decrypted_msg, MSG_LEN + crypto_sign_BYTES, sender_kx.pk,
  62.                                    sizeof sender_kx.pk, recipient_kx.pk, sizeof recipient_kx.pk,
  63.                                    nonce, sizeof nonce, sender_sign.pk) != 0) {
  64.         return 1;
  65.     }
  66.     return 0;
  67. }

But group messaging is a complex topic. RFC9420 is a proper approach.