Secret-Key Authenticated Encryption

/**
 * Encrypts and authenticates a message using a secret key
 * @param {Uint8Array} message - The plaintext message to encrypt
 * @param {Uint8Array} nonce - Unique nonce for this encryption (24 bytes)
 * @param {Uint8Array} key - Secret key shared between parties (32 bytes)
 * @returns {Uint8Array} Encrypted and authenticated message (16 bytes longer than original)
 */
nacl.secretbox(message, nonce, key): Uint8Array

/**
 * Authenticates and decrypts a secret box using the secret key
 * @param {Uint8Array} box - The encrypted message to decrypt
 * @param {Uint8Array} nonce - The nonce used for encryption (24 bytes)
 * @param {Uint8Array} key - Secret key shared between parties (32 bytes)
 * @returns {Uint8Array | null} Decrypted message or null if authentication fails
 */
nacl.secretbox.open(box, nonce, key): Uint8Array | null

const nacl = require('tweetnacl');

// Generate a random secret key (in practice, derive from password or exchange securely)
const key = nacl.randomBytes(nacl.secretbox.keyLength);

// Encrypt a message
const message = new TextEncoder().encode("Secret message");
const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);
const encrypted = nacl.secretbox(message, nonce, key);

// Decrypt the message
const decrypted = nacl.secretbox.open(encrypted, nonce, key);
if (decrypted) {
  console.log(new TextDecoder().decode(decrypted)); // "Secret message"
} else {
  console.log("Decryption failed - message was tampered with");
}

const nacl = require('tweetnacl');

const key = nacl.randomBytes(nacl.secretbox.keyLength);

// Encrypt multiple messages with the same key (but different nonces)
const messages = ["Message 1", "Message 2", "Message 3"];
const encrypted = messages.map(msg => {
  const messageBytes = new TextEncoder().encode(msg);
  const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);
  const box = nacl.secretbox(messageBytes, nonce, key);
  return { box, nonce };
});

// Decrypt all messages
const decrypted = encrypted.map(({ box, nonce }) => {
  const plaintext = nacl.secretbox.open(box, nonce, key);
  return plaintext ? new TextDecoder().decode(plaintext) : null;
});

console.log(decrypted); // ["Message 1", "Message 2", "Message 3"]

nacl.secretbox.keyLength: number        // 32 - Length of secret key in bytes
nacl.secretbox.nonceLength: number      // 24 - Length of nonce in bytes
nacl.secretbox.overheadLength: number   // 16 - Length of overhead added to encrypted messages