Signal Double Ratchet - How can Alice send 2+ messages in the beginning of the Signal Protocol?

Question

I'm studying about Signal Protocol and I had a doubt in Double Ratchet Algorithm. This section describes how to derive the receiving and sending key messages.

Alice is initialized by Bob public ratchet key but what if Bob is offline? For example: Alice starts the X3DH with Bob sending the first message but Bob is offline. So Alice decide to send a second message, this second message will be delivered via X3DH?

Answer 1

X3DH derives a shared secret using Alice' static identity and fresh ephemeral with Bob's static identity and semi-ephemeral (and optionally, if available a one-time ephemeral).

Alice sends Bob her static identity and a fresh ephemeral along with her encrypted messages. Bob can complete the handshake and read messages Alice sent him. All messages so far may be compromised if Bob's static and semi-ephemeral keys have been compromised and Bob didn't have any one-time ephemeral keys left. Bob may respond and introduce a fresh ephemeral key. All messages after this point are safe even if Bob's static key and semi-ephemeral were compromised.

Notice how the hash-ratchet is deriving per-message keys independent to the dh-ratchet, so it does not wait for any round trips as it derives multiple message keys.

For more information you may see the X3DH and Double Ratchet specifications.

Answer 2

The ephemeral secret which is derived from Bob's public ratchet key is not used to encryt the message. Instead, that ephemeral secret is passed through HKDF together with Root key to derive Chain Key and to update the Root Key. The Root Key is derived from X3DH.

Chain Key, new Root Key = HKDF(Root Key, ephemeral_secret)

Then the Chain Key is passed through HKDF to derive the Message Key and to update the Chain Key.

Message Key = HMAC-SHA256(Chain Key, 0x01)
Chain Key = HMAC-SHA256(Chain Key, 0x02)

This Message Key is used to encrypt the message. Even if Bob is offline, Alice can still send the second message by deriving a Message Key from an updated Chain Key.

Once Bob sends a reply with a new public ratchet key, Alice will again derive a Chain Key from a new Root Key (see step 1) and repeat the process. X3DH is never reinitialised again.