What is a ratchet?

Question

while reading Whatsapp's Security Whitepaper I found the term "ratchet". What does it mean in cryptography?

The Message Key is derived from a sender’s Chain Key that “ratchets” forward with every message sent. Additionally, a new ECDH agreement is performed with each message roundtrip to create a new Chain Key. This provides forward secrecy through the combination of both an immediate “hash ratchet” and a round trip “DH ratchet.”​

Answer 1

A ratchet is simply a device that only moves forward, one step at a time, much like fastening a tie rib (which is a ratchet device). So if you've got a state value in the past you can calculate all the future values.

A ratchet as viewed on Wikipedia:

This picture shows a round gear, which is a bit misleading; the state should never repeat. Imagine an almost infinitely large wheel or tie-rib instead.

---

It should however be impossible to calculate a previous state value with one of the newer values. Usually this is accomplished with a one-way-function such as a hash or a PRF. In this case a hash-based PRF has been used: HMAC-SHA256.

The Chain Key is then updated as Chain Key = HMAC-SHA256(Chain Key, 0x02)

In addition to advancing the wheel step-wise in one direction, the ratchet also drives the axle: producing output. In this case the state is used to produce output is calculated using another run of the PRF. This will make sure that the output key material cannot be used to calculate the state value it is based on.

Message Key = HMAC-SHA256(Chain Key, 0x01)

This part of the ratchet is - in this case - performed before advancing the ratchet to the next state.

---

In addition to the above ratchet there is also a DH key agreement performed for this WhatsApp scheme. Here the Root Key is the state and the ratchet is:

 Chain Key, Root Key = HKDF(Root Key, ephemeral_secret)

as you can see the root key is again used to calculate the next root key. But in this case additional input is provided by the ephemeral secret calculated during the key agreement.

---

Notes:

• PRNG's may also use ratchets, although counter based constructions are commonplace as well;
• Hardware ratchets often feature a release that raises the pawl (item 2 in the picture); tie-ribs and cryptographic ratchets do not feature such a function.
• The large cycle size of a cryptographically secure PRF (hash or MAC) makes sure that the state doesn't repeat.