In the Signal Protocol and X3DH Protocol:
https://signal.org/docs/specifications/x3dh/
I have a few questions:
1. In section 3.3. "Sending the initial message", it says:
Alice verifies the prekey signature and aborts the protocol if verification fails.
However, it doesn't say whether or not she also verifies the signature of Bob's one-time prekey OPKB
. And as far as I can tell, when Bob uploads his 100 one-time prekeys to the server, he doesn't actually also provide the signatures.
So, couldn't the server just provide a different one-time prekey of Bob to Alice and Alice won't have any way of verifying that Bob actually provided it?
2. Alice sends an initial message to Bob encrypted with a Shared Key(SK) that's calculated by:
DH1 = DH(IKA, SPKB)
DH2 = DH(EKA, IKB)
DH3 = DH(EKA, SPKB)
SK = KDF(DH1 || DH2 || DH3)
DH4 = DH(EKA, OPKB)
SK = KDF(DH1 || DH2 || DH3 || DH4)
It says EKA
is Alice's ephemeral key
. How is this calculated? Or is it just a brand new key generated for every message using Curve25519.Signing.PrivateKey().publicKey
?
3. Is the previous ephemeral key used in the next message's run? Or does each message have a unique and new ephemeral key which doesn't depend upon anything?