In the official documentation of the X3DH Algorithm (link) is made an analysis about the forward secrecy. Forward secrecy would be an uselful property if we would repeat the protocol multiple times. But in the Signal-Protocol it is always used only once, to initialize the Double Ratchet Algorithm (which then on its own leads to forward / backward secrecy and so on). So why do we care about the security for multiple rounds of X3DH when we use double ratchet afterwards? Thanks in advance!


1 Answer 1


I think I have found the answer to my question. At the Sesame-Protocol (the session-management-protocol of Signal), they describe an attack by a malicious server at which the security of the Protocol relies on the forward secrecy of X3DH.

At Section 6.2 of the Sesame-Documentation they say:

"For example, the server could make each message received by the target device use a new X3DH initial message without a one-time prekey (by forging retry requests, or by repeatedly deleting and re-adding devices). In this case, messages sent to the target during the lifetime of a signed prekey’s private key would be decryptable if the attacker compromises that private key."


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.