Why are 48 bytes appended to Libsodium encrypted messages if nonce is 24 bits?

Question

When encrypting a string through the Libsodium secret box feature, the ciphertext is 48 bytes longer than the plain text message ...

I am wondering why this is ... since the nonce is only 24 bytes.

@CodesInChaos Thanks, I guess that answers it. Many thanks and my apologies for this n00b question ;) ... However 24 + 16 <> 48 .... Am I missing something else? — abc, Mar 17 '18 at 13:02

cypherfox · Accepted Answer · 2018-03-17T14:59:25.493

5

Notice that $\operatorname{secretbox}$ has a $16$-byte MAC too. For reference, I've included $\operatorname{box}$ too.

$$ \operatorname{secretbox} : \text{24 nonce} + \text{0 xsalsa} + \text{16 poly1305}\\ \operatorname{box} : \text{32 curve25519} + \text{24 nonce} + \text{0 xsalsa} + \text{16 poly1305} $$

However, the nonce is user-controlled and normally not included in the ciphertext overhead as it is usually never sent, often a protocol-level counter.

You say "secret box" but you mean the normal "box" which uses a public key. Your ciphertext is expanded with your $32$-byte ephemeral public key and the $16$-byte MAC.

edited Mar 17 '18 at 14:59

answered Mar 17 '18 at 13:08

cypherfox

1,422
7
16

Thx. So nonce = 24 bytes, mac = 16 bytes, chacha20_encrypt = 8 bytes ? – abc Mar 17 '18 at 13:10
Chacha is a stream cipher with no padding. So no overhead. BTW: updated answer regarding the validity of counting nonces here. – cypherfox Mar 17 '18 at 13:12
apparently xsalsa is the default; not chacha. – cypherfox Mar 17 '18 at 13:14
Thanks. But 24 + 16 is still not equal to 48 ... So I am still missing something that's probably obvious ... – abc Mar 17 '18 at 13:18
Hmm... Can you send some code? – cypherfox Mar 17 '18 at 13:21
I checked and you are right that in crypto_boxes ONLY 16 bytes are added after encryption ... The 48 bytes I talked about are relevant when using sodium_crypto_box_seal .... – abc Mar 17 '18 at 13:56
Let us continue this discussion in chat. – abc Mar 17 '18 at 13:58

score 1 · Answer 2 · answered Mar 17 '18 at 22:28

1

Sealed boxes: public key (32 bytes) + MAC (16 bytes).

The nonce is deterministic, as a new key pair is created for every message.

answered Mar 17 '18 at 22:28

Frank Denis

2,964
15
17

Why are 48 bytes appended to Libsodium encrypted messages if nonce is 24 bits?

2 Answers2