Skip to main content
added 17 characters in body
Source Link
cypherfox
  • 1.4k
  • 7
  • 16

X3DH derives a shared secret using Alice' static identity and fresh ephemeral with Bob's static identity and semi-ephemeral (and optionally, if available a one-time ephemeral).

Alice sends Bob her static identity and a fresh ephemeral along with her encrypted messages. Bob can complete the handshake and read messages Alice sent him. All messages so far may be recoveredcompromised if Bob's static and semi-ephemeral keys have been compromised and the Bob didn't have any one-time ephemeral keys left. Bob may respond and introduce his owna fresh ephemeral key. All messages after this point are safe even if Bob's static key and semi-ephemeral were compromised.

Notice how the hash-ratchet is deriving per-message keys independent to the dh-ratchet, so it does not wait for any round trips as it derives multiple message keys.

For more information you may see the X3DH and Double Ratchet specifications.

X3DH derives a shared secret using Alice' static identity and fresh ephemeral with Bob's static identity and semi-ephemeral (and optionally, if available a one-time ephemeral).

Alice sends Bob her static identity and a fresh ephemeral along with her encrypted messages. Bob can complete the handshake and read messages Alice sent him. All messages so far may be recovered if Bob's static and semi-ephemeral keys have been compromised and the Bob didn't have any one-time ephemeral keys left. Bob may respond and introduce his own fresh ephemeral key. All messages after this point are safe even if Bob's static key and semi-ephemeral were compromised.

Notice how the hash-ratchet is deriving per-message keys independent to the dh-ratchet, so it does not wait for any round trips as it derives multiple message keys.

For more information you may see the X3DH and Double Ratchet specifications.

X3DH derives a shared secret using Alice' static identity and fresh ephemeral with Bob's static identity and semi-ephemeral (and optionally, if available a one-time ephemeral).

Alice sends Bob her static identity and a fresh ephemeral along with her encrypted messages. Bob can complete the handshake and read messages Alice sent him. All messages so far may be compromised if Bob's static and semi-ephemeral keys have been compromised and Bob didn't have any one-time ephemeral keys left. Bob may respond and introduce a fresh ephemeral key. All messages after this point are safe even if Bob's static key and semi-ephemeral were compromised.

Notice how the hash-ratchet is deriving per-message keys independent to the dh-ratchet, so it does not wait for any round trips as it derives multiple message keys.

For more information you may see the X3DH and Double Ratchet specifications.

added 17 characters in body
Source Link
cypherfox
  • 1.4k
  • 7
  • 16

X3DH derives a shared secret using Alice' static identity and fresh ephemeral with Bob's static identity and semi-ephemeral (and optionally, if available a one-time ephemeral).

Alice sends Bob her static identity and a fresh ephemeral along with her encrypted messages. Bob can complete the handshake and read all of Alice' messages Alice sent him. All messages so far may be recovered if Bob's static and semi-ephemeral keys have been compromised and the Bob can nowdidn't have any one-time ephemeral keys left. Bob may respond and introduce his own fresh ephemeral key. All of Alice' messages until Bob's first message may be recovered by Bobafter this point are safe even if hisBob's static key and semi-ephemeral iswere compromised. Although his one-time ephemeral (if present) should be destroyed immediately after use, making its compromise unlikely.

Most authenticated encryption functions are designed to reuse keys with distinct nonces and/or counters. Although doubleNotice how the hash-ratchet takes it a step further byis deriving per-message keys such that if you somehow recover the key of one message, this key is not used for other messages. This minimisesindependent to the number of messages that can be decrypted with a recovered key on a per-message not per-round trip basis. The dh-ratchet advances per roundtrip, so it does not wait for any round trips as it derives multiple message keys.

Please comment below or clarifyFor more information you may see the question if I'm missing somethingX3DH and Double Ratchet specifications.

X3DH derives a shared secret using Alice' static identity and fresh ephemeral with Bob's static identity and semi-ephemeral (and optionally, if available a one-time ephemeral).

Alice sends Bob her static identity and ephemeral along with her encrypted messages. Bob can complete the handshake and read all of Alice' messages. Bob can now respond and introduce his own fresh ephemeral key. All of Alice' messages until Bob's first message may be recovered by Bob if his static key and semi-ephemeral is compromised. Although his one-time ephemeral (if present) should be destroyed immediately after use, making its compromise unlikely.

Most authenticated encryption functions are designed to reuse keys with distinct nonces and/or counters. Although double-ratchet takes it a step further by deriving per-message keys such that if you somehow recover the key of one message, this key is not used for other messages. This minimises the number of messages that can be decrypted with a recovered key on a per-message not per-round trip basis. The dh-ratchet advances per roundtrip.

Please comment below or clarify the question if I'm missing something.

X3DH derives a shared secret using Alice' static identity and fresh ephemeral with Bob's static identity and semi-ephemeral (and optionally, if available a one-time ephemeral).

Alice sends Bob her static identity and a fresh ephemeral along with her encrypted messages. Bob can complete the handshake and read messages Alice sent him. All messages so far may be recovered if Bob's static and semi-ephemeral keys have been compromised and the Bob didn't have any one-time ephemeral keys left. Bob may respond and introduce his own fresh ephemeral key. All messages after this point are safe even if Bob's static key and semi-ephemeral were compromised.

Notice how the hash-ratchet is deriving per-message keys independent to the dh-ratchet, so it does not wait for any round trips as it derives multiple message keys.

For more information you may see the X3DH and Double Ratchet specifications.

Source Link
cypherfox
  • 1.4k
  • 7
  • 16

X3DH derives a shared secret using Alice' static identity and fresh ephemeral with Bob's static identity and semi-ephemeral (and optionally, if available a one-time ephemeral).

Alice sends Bob her static identity and ephemeral along with her encrypted messages. Bob can complete the handshake and read all of Alice' messages. Bob can now respond and introduce his own fresh ephemeral key. All of Alice' messages until Bob's first message may be recovered by Bob if his static key and semi-ephemeral is compromised. Although his one-time ephemeral (if present) should be destroyed immediately after use, making its compromise unlikely.

Most authenticated encryption functions are designed to reuse keys with distinct nonces and/or counters. Although double-ratchet takes it a step further by deriving per-message keys such that if you somehow recover the key of one message, this key is not used for other messages. This minimises the number of messages that can be decrypted with a recovered key on a per-message not per-round trip basis. The dh-ratchet advances per roundtrip.

Please comment below or clarify the question if I'm missing something.