Relying on a private public key for authentication I'm Alice, and I generate a public/private key pair. I securely &amp; confidentially share my public key with Bob and Carol, who securely &amp; confidentially share it with various other benevolent users – all of whom can now send me encrypted messages that only I can decrypt.

I'd like to authenticate that the encrypted messages I'm receiving are from users that have been legitimately sent my public key. Malicious Mallory has not been sent my public key, but has access to the network and can see the encrypted messages that I'm being sent. I need to ensure she cannot deduce my public key to send me malicious encrypted messages.

What do I need to look for in a crypto library to achieve this?
What do I need to look for in a crypto library to achieve this?


There are multiple options for this (from most to least desirable):


You want any public-key encryption scheme and any MAC algorithm and distribute as your public key, the encryption scheme's public key and the MAC key. Then you enforce that every message either has the MAC applied on the ciphertext correctly (proving possession of the key) or on the entire message and the MAC is then also encrypted.
You could also use static-authentication and a CCA2-secure public key encryption sheme (like DHIES, ECIES, RSA-KEM, or RSA-OAEP) and prepend a static secret to each message encrypting it as well. This heavily relies on the fact that an attacker cannot change encrypted messages meaningfully with CCA2-security and is "less clean" than using a MAC.
You can use a scheme that naturally hides the public key, e.g. DHIES or ECIES where one may only learn the group but no the public element from ciphertexts without breaking the encryption. Of course this is a much less common security notion, so one has to be careful whether a given scheme naturally satisfies it.