Grey Area

@silverpill

Think 5.1.3 (AuthEncap) is better since it still uses an ephemeral key, but does an extra DH to authenticate the sender. 5.1.1 (Encap) is simpler, but unless the aad contains at least the sender's identity, there is nothing preventing someone from extracting a ciphertext, and re-signing it (forging the origin).

Having a trivial amount of AAD is computationally cheaper than doing the extra DH, but the extra DH would be sub 100 usec, so this is "pick something to taste".

ps: Spent the day chasing LLVM bugs, errors in this would be all mine.

@silverpill @raucao @lain @sozialwelten @koteisaev

As a note, FEP-0806 is overly simplistic in that it has no forward secrecy.

As an easy improvement, if the sender also generates a per-message ephemeral X25519 keypair, you can do static-static + static-ephemeral KEX and get imperfect forward secrecy (no additional round trips required).