0
$\begingroup$

In the Signal Protocol and X3DH Protocol:

https://signal.org/docs/specifications/x3dh/

I have a few questions:

1. In section 3.3. "Sending the initial message", it says:

Alice verifies the prekey signature and aborts the protocol if verification fails.

However, it doesn't say whether or not she also verifies the signature of Bob's one-time prekey OPKB. And as far as I can tell, when Bob uploads his 100 one-time prekeys to the server, he doesn't actually also provide the signatures.

So, couldn't the server just provide a different one-time prekey of Bob to Alice and Alice won't have any way of verifying that Bob actually provided it?

2. Alice sends an initial message to Bob encrypted with a Shared Key(SK) that's calculated by:

DH1 = DH(IKA, SPKB)
DH2 = DH(EKA, IKB)
DH3 = DH(EKA, SPKB)
SK = KDF(DH1 || DH2 || DH3)
DH4 = DH(EKA, OPKB)
SK = KDF(DH1 || DH2 || DH3 || DH4)

It says EKA is Alice's ephemeral key. How is this calculated? Or is it just a brand new key generated for every message using Curve25519.Signing.PrivateKey().publicKey?

3. Is the previous ephemeral key used in the next message's run? Or does each message have a unique and new ephemeral key which doesn't depend upon anything?

$\endgroup$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.