I am trying to understand the Networking And Cryptography Library (NaCL).

Consider i have a file that i want to send to multiple recipients. PGP or S/MIME supports multiple recipients by encrypting the file with a single symmetric key and encrypting this symmetric key with the public keys of the recipients. is this task easily achieved with NaCL as well? How? Thanks for hints.

Update One idea i had is to do it similar to pgp. Calculate the exchange keys of my own private key and the public keys of the recipients. Create one symmetric key. Encrypt file file symmetric key. Encrypt symmetric key with each exchange key. send encrypted file and encrypted symmetric key to recipient.

The main reason for this: i want to upload the encrypted file only once to a server where the recipients can download them.

  • 2
    Are you looking for code using NaCL?
    – RoraΖ
    Commented Sep 30, 2014 at 12:01
  • @raz anything that helps me to nail the multiple recipient problem
    – esskar
    Commented Sep 30, 2014 at 12:39
  • The saltpack format fits that description: saltpack.org/encryption-format Commented Mar 28, 2017 at 0:18

2 Answers 2


The actual format of NaCL's output is not completely specified -- or, rather, it is specified as being the raw output from some cryptographic primitives (as described there). The format is thus non-extensible and does not include any feature supporting multiple recipients. Ability to send a message to multiple recipient appears to be a functionality that has been sacrificed on the altar of simplicity.

If you want to use NaCL and still send a single message to multiple recipients without duplicating the bulk of the data, then you must design your own format, basically doing this:

  • You generate a random secret key K.
  • You use K to encrypt the message (with crypto_secretbox).
  • You encrypt K as if it was the "message" with crypto_box.

But then you are defining your own protocol, built over existing primitives. This is the exact kind of things that NaCL was meant to prevent. Or, said otherwise, if you are back to doing your own protocol design then why would you use NaCL ? And, in any case, you would be on your own, both for the security analysis and the implementation (since you would not interoperate with anybody else).

If what you need is what OpenPGP provides, then use OpenPGP.

  • Hi Tom. Thanks for explanation. I am actually already using OpenPGP, but the message overhead is massive. NaCL produces smaller messages, and that was what i was looking for.
    – esskar
    Commented Nov 21, 2014 at 9:30
  • Does OpenPGP provide a way to add recipients retroactively?
    – Fee
    Commented Feb 23, 2023 at 14:08

It seems you need your own protocol, as Tom explained. If you decide to do this, you should sign the message (with cryto_sign()).

When Alice sends a message to Bob, she wants to make sure than an active eavesdropper Eve does not alter the message. Therefore you have authentication (which crypto_box() takes care of automatically). When Alice sends the message to Bob and Charlie, she furthermore wants to make sure Bob does not alter the message and pass it on to Charlie. Then authentication is no longer sufficient, you want signatures.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .