# X3DH Protocol - How can the receiver calculate the Shared Key?

I'm reading about Signal Protocol and X3DH Protocol. In the X3DH Protocol, Alice sends a initial message to Bob encrypted with a Shared Key(SK). This SK is calculated using (this section):

DH1 = DH(IKa, SPKb)
DH2 = DH(EKa, IKb)
DH3 = DH(EKa, SPKb)
DH4 = DH(EKA, OPKB)
SK = KDF(DH1 || DH2 || DH3 || DH4)


Where IKa is the Alice's identity key, IKb is Bob's Identity key, SPKb is Bob's signed prekey, EKa is Alice's ephemeral key and OPKb is Bob's one-time prekey. All these keys are public.

In the next section they describe how Bob receives this message. Bob loads his private identity key and private one-time pre key and does the same steps as Alice does before to derive the SK. I couldn't understand how this SK calculated by Bob can decrypt the message sent by Alice. Alice uses only public keys and Bob uses his private keys. So my question is: How can the SK generated by Bob decrypt the message sent by Alice?

• Is EKA the same as EKa? Is OPKB readable as OPKb for consistency? How are SPKb and EPKn computed in the protocol? The equations in the question show what Alice performs, but what does Bob perform? If that's similar with a and b exchanged, isn't the order for the concatenation in the input of KDF different? – fgrieu Feb 19 at 20:18

The notation DH(A, B) means that you combine whichever private key you know between A and B with the public key of the other. So, when Alice computes DH(IKa, SPKb), she uses the private part of her long-term identity key IKa and the public part of Bob's signed prekey SPKb; when Bob computes it, he does it the other way around.