Given that the library does not seem to protect against timing attacks it would probably be a good idea to mention that prevention of such attacks is left up to the consumer of the lib. Seems worth adding to the readme/ documentation.

Sorry if this generic crypto question is out of scope.

What nonce operation mode would you suggest for a stateful message exchange protocol built on top of secretbox? I can imagine at least two options:

• generate random nonce in every message, send length and nonce in authenticated clear text
• hello message as above with another secret nonce in payload, derive all next nonces from that secret payload, send only authenticated length in clear text

My use case is RPC with messages around 50-200 bytes on expensive 3g network, and shaving 24 bytes from each message is definitely worth pursuing.

Thanks for your time.

This should be very useful, such as https://download.libsodium.org/doc/advanced/ed25519-curve25519.html

golang has such plan, but seems like no progress. https://github.com/golang/go/issues/20504

Hello! Thanks for the library.

TweetNaCl has a method which verifies that the given message was signed with given PublicKey:

nacl.sign.detached.verify = function(msg, sig, publicKey) {

Is there something similar in this library?

I saw this method but it doesn't take the message into account. I'd like to verify there's a specific nonce present in a message.

benefit: one less external dependency / entry in go.mod! downside: doesnt support go <1.13, but technically <1.14 is no longer supported according to go's release policy and this project only tests 1.15+ in ci

Hi,

I have some doubts about how the piece of code 1 works and the 2 does not. I do not think that this was a real issue.

• Code 1:

package main

import (
	crypto_rand "crypto/rand"
	"encoding/base64"
	"fmt"
	"github.com/kevinburke/nacl/box"
)

func main() {
	pk, sk, err := box.GenerateKey(crypto_rand.Reader)
	if err != nil {
		panic(err)
	}
	message := "the sky is blue"
	fmt.Printf("Plaintext message: %s\n", message)
	
	enc := box.EasySeal([]byte(message), pk, sk)
	fmt.Printf("Encrypted message: %s\n", base64.StdEncoding.EncodeToString(enc))
	
	dec, _ := box.EasyOpen(enc, pk, sk)
	fmt.Printf("Decrypted message: %s\n", string(dec))
}

The result of code 1 is the following:

Plaintext message: the sky is blue
Encrypted message: E/QEV7B64zDkcu4+1BwJmd7juRG8cfl9NDVd/OYuC7xUWr0rkoQFOvHUsBapJqypYZAC2x71iw==
Decrypted message: the sky is blue

• Code 2:

package main

import (
	crypto_rand "crypto/rand"
	"encoding/base64"
	"fmt"

	"github.com/kevinburke/nacl"
	"github.com/kevinburke/nacl/box"
)

func main() {
	pk, sk, err := box.GenerateKey(crypto_rand.Reader)
	if err != nil {
		panic(err)
	}
	message := "the sky is blue"
	fmt.Printf("Plaintext message: %s\n", message)

	// Encrypt
	nonce := nacl.NewNonce()
	var out []byte

	enc := box.Seal(out, []byte(message), nonce, pk, sk)
	fmt.Printf("Encrypted message: %s\n", base64.StdEncoding.EncodeToString(enc))

	// Decrypt
	//decNonce := new([nacl.NonceSize]byte)
	//copy(decNonce[:], message[:24])

	dec, _ := box.EasyOpen(enc, pk, sk)
	fmt.Printf("Decrypted message: %s\n", string(dec))
}

The result of code 1 is the following:

Plaintext message: the sky is blue
Encrypted message: KTdHagkeX6Il61uiTbCzvAqpAx4XUfr3BYhVGElPLA==
Decrypted message: 

Am I missing something when Seal() is called?

See https://buttondown.email/cryptography-dispatches/archive/59c99d2e-9fd7-4859-934b-f52cf254e6b2 and https://github.com/golang/go/issues/43148#issuecomment-743738586.

For example, the base64 api's have a user pass in a dst array to decode into. The nacl API's in golang.org/x/crypto follow a similar pattern.

The advantage of doing it this way is that it reduces allocations, which helps performance.

The disadvantage is that it requires the caller to know more about how the API works, and ensure they bring along a byte array that's large enough.

The C/C++ API's have it both ways. The C++ API's return a byte array, the C API's require you to pass one in, but I think the latter is because you can only return integers from C functions..