Public key authenticated encryption with XChaCha20-Poly1305 API

[sh-dv]

I am trying to achieve public key cryptography (authenticated) with XChaCha20-Poly1305.

is there a way to use XChaCha20-Poly1305 in the crypto_box_easy function?

Or should i just use the Key Exchange API to compute a shared key between two parties (Alice and Bob), and then pass the key to the crypto_secretstream_xchacha20poly1305 function?

thanks.

[jedisct1]

Yes, after using the key exchange API, you can use any AEAD with the shared keys.

crypto_box_curve25519xchacha20poly1305_easy() exists even though it doesn't have any advantages over crypto_box_easy().

But using the key exchange API is more versatile and easier to use correctly (since you get two keys, for each direction).

[sh-dv]

Yes, it is more flexible to use the key exchange API, However, I have some questions if you don't mind :

Since both keys computed in the key exchange API are the same (opposite way Rx/Tx), means that the sender can always decrypt the message, which means that a compromise on one end (Alice) can decrypt the message that was sent (to Bob).
What is the best approach to solve such a scenario? Where we want to keep Sender authentication but also a kind of One-Way approach, Basically just prevent the sender from decrypting the sent message, but keeping sender authentication..

Something interesting i got recommended from someone, the Noise One-Way K pattern , looks a great fit for such idea.

[jedisct1]

https://doc.libsodium.org/public-key_cryptography/sealed_boxes

[sh-dv]

While the recipient can verify the integrity of the message, it cannot verify the identity of the sender.

I know how sealed boxes work, but i was asking what is the best approach to implement an encryption scheme where you can verify the identity of the sender, while maintaining One-Way encryption.
Maybe attach a ephemeral key to the content of the message that the recipient only can decrypt ?

Thanks.

[jedisct1]

Verifying the identify of the sender means having a long-term key. Messages that the sender cannot recover imply single-use keys.

You can sign the message using a long-term key, and encrypt that signed messages using ephemeral keys.