NaCL: Encrypt file to multiple recipients

Question

I am trying to understand the Networking And Cryptography Library (NaCL).

Consider i have a file that i want to send to multiple recipients. PGP or S/MIME supports multiple recipients by encrypting the file with a single symmetric key and encrypting this symmetric key with the public keys of the recipients. is this task easily achieved with NaCL as well? How? Thanks for hints.

Update One idea i had is to do it similar to pgp. Calculate the exchange keys of my own private key and the public keys of the recipients. Create one symmetric key. Encrypt file file symmetric key. Encrypt symmetric key with each exchange key. send encrypted file and encrypted symmetric key to recipient.

The main reason for this: i want to upload the encrypted file only once to a server where the recipients can download them.

Answer 1

The actual format of NaCL's output is not completely specified -- or, rather, it is specified as being the raw output from some cryptographic primitives (as described there). The format is thus non-extensible and does not include any feature supporting multiple recipients. Ability to send a message to multiple recipient appears to be a functionality that has been sacrificed on the altar of simplicity.

If you want to use NaCL and still send a single message to multiple recipients without duplicating the bulk of the data, then you must design your own format, basically doing this:

• You generate a random secret key K.
• You use K to encrypt the message (with crypto_secretbox).
• You encrypt K as if it was the "message" with crypto_box.

But then you are defining your own protocol, built over existing primitives. This is the exact kind of things that NaCL was meant to prevent. Or, said otherwise, if you are back to doing your own protocol design then why would you use NaCL ? And, in any case, you would be on your own, both for the security analysis and the implementation (since you would not interoperate with anybody else).

If what you need is what OpenPGP provides, then use OpenPGP.

Answer 2

It seems you need your own protocol, as Tom explained. If you decide to do this, you should sign the message (with cryto_sign()).

When Alice sends a message to Bob, she wants to make sure than an active eavesdropper Eve does not alter the message. Therefore you have authentication (which crypto_box() takes care of automatically). When Alice sends the message to Bob and Charlie, she furthermore wants to make sure Bob does not alter the message and pass it on to Charlie. Then authentication is no longer sufficient, you want signatures.