# RSA-based Double Ratchet Algorithm

I'm reading the Signal specification and they suggest to use EC keys, in particular with X25519 or X448 curves, both for the initial X3DH agreement and the DH ratchet.

I've noticed that languages and libraries seems to have a better support for RSA (for example the two curves recommended by Signal are not available using plain OpenJDK), so I was wondering if it could be possible to achieve the same level of security using RSA keys instead of EC keys (of course, supposing to use keys with proper sizes).

In the specification document they don't explain why EC should be used. I assume it improves performances, but I would like to know if it is a requirement in the context of the Double Ratchet Algorithm or if any good asymmetric cryptography system could be used.

• It would generally be possible to use RSA encapsulation to perform key establishment but in this case it seems more sensible to use a different curve to perform ECDH key agreement. OpenJDK probably supports P-521 using the name "secp521r1". Aug 20 at 0:15
• OpenJDK 11 up supports both XDH curves. (15 up also supports the corresponding curves for standard EdDSA, but not XEdDSA.) OpenSSL 1.1.0 supports X25519 (only) and 1.1.1 up supports both XDHs and EdDSAs. @MaartenBodewes: do you mean P-256 = secp256r1 or P-521 = secp521r1? In any case OpenJDK 7 up supports both NIST and SECG names, plus X9.62 name prime256v1 for the former. Aug 20 at 2:38

The key ingredient in X3DH is essentially the DH key exchange. Which is a non interactive key exchange protocol where Alice and Bob independently send $$g^a$$ and $$g^b$$ and they can establish a shared key $$g^{ab}$$. But you can't build a non-interactive key exchange protocol using RSA (not that I'm aware of). To exchange a key using RSA, Alice needs to send Bob her public key then Bob encrypts a random key under Alice's public key. Note that we're still sending two messages but the second message can only be sent after the first is received (in the DH case the two messages can be sent simultaneously).