5
$\begingroup$

I'm reading about Signal Protocol and this protocol uses the X3DH Protocol to establish a shared secret key between the two parties but I couldn't understand why we use one-time prekeys in the flow. This keys are optional and if there is any in the server, in the first message between Bob and Alice, an extra Diffie-Hellman is calculate between this prekey and ephemeral key. What is the advantage of using One-time Prekeys?

Improve this question
$\endgroup$
1
  • $\begingroup$ It gives us some measure of forward security, without online communication. $\endgroup$
    – K.G.
    Commented Nov 1, 2017 at 21:20

2 Answers 2

Reset to default
6
$\begingroup$

If no one-time keys are used, the passive side of the key agreement just uses two keys: The identity key $IK_B$ and the signed prekey $SPK_B$. The identity key is a long time key, the signed prekey can be used longish, too since they only have to be updated at some interval.

This setting doesn't guarantee you a real forward secrecy, since an attacker learning both long-term keys of $B$ can calculate the shared secret. Adding the one-time key $OPK_B$ to the calculation, makes the shared secret be based on truly ephemeral key on both sides of the communication.

Improve this answer
$\endgroup$
4
  • $\begingroup$ How can an attacker calculate the shared secret between alice and bob? I read that, to calculate a shared key, we have to use our ephemeral key and this ephemeral key is deleted after the flow. $\endgroup$
    – Vivi
    Commented Nov 6, 2017 at 16:22
  • $\begingroup$ To calculate the shared secret of a DH key agreement you the public half of one party and the private half of the other one. If you do not use a onetime key, there is only one ephemeral key in play, all the other ones used are long(ish) term. So if you get hold of the long ten private keys of B, you just need the public ephemeral key from A (which can be observed on the wire) to calculate the shared key. $\endgroup$
    – mat
    Commented Nov 6, 2017 at 20:08
  • $\begingroup$ Do you mean a Man In The Middle attack? So what is SPK for? Both OPK and SPK seems similar to me but SPK has a bigger interval. Why can't we have a protocol that only uses one-time prekeys? $\endgroup$
    – Vivi
    Commented Nov 7, 2017 at 17:37
  • $\begingroup$ X3DH is designed to be usable if one of the communication partners (B in your example) is offline at the time of the handshake. So B uploads a couple of (public) OPKs to a server, and A can then do the handshake with the public information stored on the server. The SPK is there in the case, that no unused OPK is available at the server anymore. Otherwise, it would be easy to create a DoS attack against a user by simple initiating lots of handshakes until all OPKs hav been used. $\endgroup$
    – mat
    Commented Nov 7, 2017 at 21:17
8
$\begingroup$

The short answer is ‘for forward secrecy’, but that glib term obscures the meaning of the property we hope for.

Suppose Alice sends a message to Bob. If Alice and Bob both erase the message, what is the time at which all key material that can ever decrypt a transcript of network packets on the wire is erased?

Without prekeys, the following are all the sets of keys that can decrypt the wire transcript:

  1. Alice's long-term identity key $\mathit{IK}_\mathrm A$ and Alice's ephemeral key $\mathit{EK}_\mathrm A$.
  2. Bob's long-term identity key $\mathit{IK}_\mathrm B$ and Bob's long-term signed prekey $\mathit{SPK}_\mathrm B$.

While Alice will erase her ephemeral key immediately, Bob is intended to never erase his long-term identity key—at least, as long he wants to maintain his identity—and to rotate his long-term signed prekey only occasionally so that delayed messages can get through. Thus, a set of keys that can decrypt the wire transcript can be found on Bob's device long after the message has arrived.

With prekeys, the following are all the sets of keys that can decrypt the wire transcript:

  1. Alice's long-term identity key $\mathit{IK}_\mathrm A$ and Alice's ephemeral key $\mathit{EK}_\mathrm A$.
  2. Bob's long-term identity key $\mathit{IK}_\mathrm B$, Bob's long-term signed prekey $\mathit{SPK}_\mathrm B$, and Bob's one-time prekey $\mathit{OPK}_\mathrm B$.

Alice will again erase her ephemeral key immediately. Bob won't immediately erase anything, because he might be offline—this is an asynchronous protocol. But as soon as he receives the message, he will erase his one-time prekey. Thus, as soon as Bob has processed the message, all sets of keys that can decrypt the wire transcript will be erased.

Of course, Alice or Bob might keep a copy of the message on their respective devices for all eternity. But one-time prekeys guarantee that they have the option to erase messages without leaving targets on their devices for retroactive decryption of wire transcripts.

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ So I think OPKb and SPKb are redundant. Why doesn't it use only the OPKb? Is SPKb like a OPKb but with a bigger interval? $\endgroup$
    – Vivi
    Commented Nov 6, 2017 at 16:32
  • $\begingroup$ Wild guess is that it's done that way so that most of the logic is identical with or without OPKb. It's not immediately obvious what security consequences there might be to omitting SPKb, but I haven't sat down to think about it. You could send an email to moxie and trevp to ask them! $\endgroup$
    – Squeamish Ossifrage
    Commented Nov 6, 2017 at 17:20
  • 1
    $\begingroup$ anybody mail moxie and trevp? curious to know if omitting SPKb has any consequence. $\endgroup$
    – Raghu
    Commented Dec 29, 2023 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.