1
$\begingroup$

I'm trying to understand the specification behind doubleratchet algorithm, item 2.4. Double Ratchet.

According to wiki:

A client renews session key material in interaction with the remote peer using Diffie–Hellman ratchet whenever possible, otherwise independently by using a hash ratchet.

  • What does impede Signal protocol from updating DH ratchet for every message?
  • Does it mean that Signal protocol not guarantee future secrecy (aka backward secrecy) for a chain when a symmetric key is compromised (and adversary can derive new keys for future messages) until DH ratchet updates a key?
$\endgroup$

1 Answer 1

2
$\begingroup$
  • What does impede Signal protocol from updating DH ratchet for every message?

The main obstacles are rooted in the striking of a balance between efficiency & efficacy. That balance is heavily influenced by the asynchronous setting of the protocol. Where peer $A$ could create a new public key with each message they send to peer $B$, the self-healing (post-compromise security) property of the channel won't be activated if it's peer $B$'s secrets which have been compromised. As such, channel-wise self-healing requires both parties to contribute new independent secrets to the current state of the channel, which can be arbitrarily delayed in the asynchronous setting. Therefore, $A$ contributing new independent secrets multiple times before $B$ has responded with their own, incurs the same updating costs but with limited (potentially zero) security benefit.

See Messaging Layer Security for other approaches to resolving efficiency issues.


  • Does it mean that Signal protocol not guarantee future secrecy (aka backward secrecy) for a chain when a symmetric key is compromised (and adversary can derive new keys for future messages) until DH ratchet updates a key?

The term "post-compromise security" is preferred when discussing this self-healing property of a security context. As for what is actually compromised when a "symmetric key" is compromised: that depends on which symmetric key is being considered. The short answer is that the Diffie-Hellman ratchet is the only thing in the protocol which provides post-compromise security. As for the longer answer:

Double Ratchet Key Schedule Diagram

Figure 1 | Diagram of Double Ratchet key derivations.

Consider the above diagram. Each red-ish, pill-shaped node which isn't directly under the "Ratchet" column represents a symmetric key. Let's separate them into two relative types: a $K_\text{seed}$ type, & a $K_\text{derived}$ type.

Any symmetric key is a $K_\text{derived}$ type if it is directly under or to the right of & under, another symmetric key, which would be a $K_\text{seed}$ type. A $K_\text{derived}$ key is compromised if a $K_\text{seed}$ key is compromised & the two keys are not separated by a Diffie-Hellman ratchet of the channel state.

Said another way. If no Diffie-Hellman ratchet is performed: compromising a root key (denoted RK in the diagram), compromises all subsequent chain & message keys; compromising a chain key (denoted CK in the diagram), compromises all subsequent chain & message keys; and, compromising a message key (denoted An & Bn in the diagram, where the letter n is an incrementing numeral), only compromises that message key.

$\endgroup$
1
  • $\begingroup$ I think you might need to include the Trust On the First Use (TOFU) problem. $\endgroup$
    – kelalaka
    Commented Oct 19, 2023 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.