In the X3DH protocol a signed prekey ($SPK_B$) is used as part of the handshake. What is the purpose of this key? There seem to be no obvious cryptographic drawbacks by omitting this key.

One rationale could be that these "semi static" keys can be renewed without the need of changing the identity key ($IK_B$) and hence provide better forward secrecy. But is this a benefit in real world scenarios like Signal or WhatsApp?

What's the drawback of following variant:

  • Bob publishes $IK_B$ and signed $OPK_B^1$
  • Alice gets Bob's $IK_B$ and $OPK_B^1$ and verifies the signature
  • Alice then generates $EK_A$ and calculates: $$DH1 = DH(IK_A, OPK_B^1)\\ DH2 = DH(EK_A, IK_B)\\ DH3 = DH(EK_A, OPK_B^1)\\ SK = KDF(DH1 || DH2 || DH3)$$

One could argue that in this variant one cannot omit $OPK_B$. Is this really so bad in real life?

Alternative: what about another modification where you drop $SPK$ and instead renew your identity key $IK$ as often as you would renew your $SPK$ in X3DH? Same forward secrecy properties. When used as part of chat app you do X3DH only the first time you send a message. So what's the harm in changing your $IK$?

  • $\begingroup$ It's a shame this question was closed because the linked question doesn't answer it at all, IMO. Only Squeamish Ossifrage's comment comes close to an answer, but it still quite speculative. $\endgroup$ Feb 4, 2021 at 14:28


Browse other questions tagged or ask your own question.