3
$\begingroup$

In the double ratchet algorithm, let's say if bob's device is compromised including his long term key.

Does the ephemeral keys generated by Alice during the half Diffie–Hellman key exchange produces a new sending chain for Alice which is not yet known to Bob.

Also does the messages from Alice still have the non-repudiation property even if bob's state is completely compromised.

Improve this question
$\endgroup$
1
  • $\begingroup$ There are also comments under my answer that might be helpful to understand the OP's question better. If you need to edit the question, go on. $\endgroup$
    – kelalaka
    Commented Feb 10, 2020 at 19:35

1 Answer 1

Reset to default
1
$\begingroup$

if bob's device is compromised including his long term key.

Does the ephemeral keys generated by Alice during the half Diffie–Hellman key exchange produces a new sending chain for Alice which is not yet known to bob

Double Rachet is secure against an attacker who records everything than compromise the sender or the receiver. As always said, if the receiver or sender stored previously generated keys then there is no forward secrecy, the attacker gets the keys and reads the recorded messages. Securely delete the keys.

A compromised secret key or device has more attack vectors that can be catastrophic.

  1. The attacker can impersonate the attacked party and create new sessions.
  2. The attackers can execute man-in-the-middle attacks constantly and maintain eavesdropping on the compromised session.

So the attacker will produce new chains that Alice and Bob are not aware of. The key and device must be replaced immediately if they are suspecting.

if bob's device is compromised including his long term key.

does the messages from Alice still has the non-repudiation property even if bob's state is completely compromised.

Alice will talk normally, so she cannot repudiate. The attacker has no power to forge a message that does not come from Alice. If they do, Bob can do, too and this is against the non-repudiation of the protocol.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Thank you for your answer. I understand that if an adversary would have access to the keys which would be replaced or else the adversary would have the ability to impersonate a party. This has been well documented and also asked several times. But my question is if bob device is completely compromised and the attacker controls the key generation for bob. Since the double ratchet KDF generation depends on the half way DH key exchange. If attacker controls Bob keys during his DH exchange. Does alice can deny the future messages which came from her? Let me know if the question is unclear. $\endgroup$
    – Shrenik Chhajer
    Commented Feb 8, 2020 at 17:32
  • $\begingroup$ @ShrenikChhajer That is tricky, Who will Alice do non-repudiation? Bob or the attackers? $\endgroup$
    – kelalaka
    Commented Feb 8, 2020 at 18:35
  • $\begingroup$ Hypothetical scenario for example the attacker is the government and Alice said something which they could use it in court against her. I read the paper from signal and they have not mentioned this attack scenario but it would have applications in other fields. And as per their algorithm the sending and receiving chain are in sync. Whenever the party receives a new DH key it calculates a new Sending and receiving chain. In practice the DH ratchet is always used to generate new keys but instead of generating new DH keys what if Alice just uses the symmetric ratchet to send message? $\endgroup$
    – Shrenik Chhajer
    Commented Feb 8, 2020 at 18:44
  • $\begingroup$ @ShrenikChhajer That is a good scenario, I think you should have written it in the question including the link. However, that is a bit Law included. I think I've already answered that. Whoever controls the Bob ( including Bob) cannot forge a message belongs to Alice. The attackers don't need to control the Bob's key generation, they just need to be pretended to be Bob. The government controls the Bob system, stores all the information then uses the system's non-repudiation property against Alice. Changing key etc is not a good way. Just pretend to be Bob. Could you post the link? $\endgroup$
    – kelalaka
    Commented Feb 8, 2020 at 19:13
  • $\begingroup$ The above example was just a simplified example. There has to be no law included. To make the question simple if the sending and receiving chain of Alice and Bob are in sync and if Alice does not generate a new DH key pair what stops Bob from using the receiving key to generate messages which would be sent as Alice. The following image shows how keys are generated signal.org/docs/specifications/doubleratchet/Set2_2.png in the following article signal.org/docs/specifications/doubleratchet/#double-ratchet-1. $\endgroup$
    – Shrenik Chhajer
    Commented Feb 9, 2020 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.