3
$\begingroup$

I'm reading about Signal Protocol and X3DH Protocol. In the X3DH Protocol, Alice sends a initial message to Bob encrypted with a Shared Key(SK). This SK is calculated using (this section): 

DH1 = DH(IKa, SPKb)
DH2 = DH(EKa, IKb)
DH3 = DH(EKa, SPKb)
DH4 = DH(EKA, OPKB)
SK = KDF(DH1 || DH2 || DH3 || DH4)

Where IKa is the Alice's identity key, IKb is Bob's Identity key, SPKb is Bob's signed prekey, EKa is Alice's ephemeral key and OPKb is Bob's one-time prekey. All these keys are public.

In the next section they describe how Bob receives this message. Bob loads his private identity key and private one-time pre key and does the same steps as Alice does before to derive the SK. I couldn't understand how this SK calculated by Bob can decrypt the message sent by Alice. Alice uses only public keys and Bob uses his private keys. So my question is: How can the SK generated by Bob decrypt the message sent by Alice?

Improve this question
$\endgroup$
1
  • $\begingroup$ Is EKA the same as EKa? Is OPKB readable as OPKb for consistency? How are SPKb and EPKn computed in the protocol? The equations in the question show what Alice performs, but what does Bob perform? If that's similar with a and b exchanged, isn't the order for the concatenation in the input of KDF different? $\endgroup$
    – fgrieu ♦
    Commented Feb 19, 2020 at 20:18

1 Answer 1

Reset to default
3
$\begingroup$

Alice uses Alice's private keys and Bob's public keys.

Bob uses Bob's private keys and Alice's public keys.

The notation DH(A, B) means that you combine whichever private key you know between A and B with the public key of the other. So, when Alice computes DH(IKa, SPKb), she uses the private part of her long-term identity key IKa and the public part of Bob's signed prekey SPKb; when Bob computes it, he does it the other way around.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Ok, I understand but how can the keys generated by Alice and Bob be identical? Alice and Bob use different keys to generate the SK (Alice uses her private key and Bob's public key and Bob his key and Alice's public key ). $\endgroup$
    – Vivi
    Commented Nov 9, 2017 at 15:00
  • $\begingroup$ Ah and in the documentation they say that Alice uses her public keys (EKa and IKa) $\endgroup$
    – Vivi
    Commented Nov 9, 2017 at 15:06
  • $\begingroup$ I understand now. The documentation is a little confusing but I read about ECDH and could figure out how it works. Thank you! $\endgroup$
    – Vivi
    Commented Nov 9, 2017 at 16:34
  • $\begingroup$ You have not been understood by MrFuzzy, there, and I admit that I do not get all the details either. $\endgroup$
    – fgrieu ♦
    Commented Feb 19, 2020 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.