Search code examples
libsodiumnacl-cryptography

Access MAC keys in NaCl/libsodium

According to https://cr.yp.to/highspeed/naclcrypto-20090310.pdf, NaCl derives a MAC key from the shared secret and the nonce in crypto_box APIs.

Alice uses the first 32 bytes of the long stream (generated from the shared secret and nonce using salsa20) to compute an authenticator of the encrypted packet.

However, this procedure is internal. I wonder if there is an API to derive the MAC key manually?

Solution

  • The box construction uses the xsalsa20 cipher (originally -- there is also a variant using xchacha20).

    The first block of that cipher are used as a Poly1305 key. The remaining blocks are XORed with the message to compute the ciphertext.

    So, you can simply use crypto_stream() to compute the Poly1305 key.