API support for AAD?

[kdenhartog]

Is it possible to add an API that supports the use of authenticated additional data? We're looking to implement JWEs based on this library, but the use of the protected header is making it not possible. What would be the best approach to handle this?

[dchest]

Unfortunately, NaCl doesn't have a defined AEAD construction, only AE (XSalsa20Poly1305). You can try ChaCha20Poly1305 AEAD (e.g. @stablelib/chacha20poly1305), but note that its nonce is short (12 bytes), so you may want XChaChaPoly https://download.libsodium.org/doc/secret-key_cryptography/aead/chacha20-poly1305 if using a random nonce.

Sometimes, for short headers people just include a copy of them in the encrypted data, and then compare them after decryption with the attached plain-text headers, but this is riskier and I don't think would work very well for JWE.