1
$\begingroup$

Signal Protocol uses a counter (discussed in DoubleRatchet documentation) to define how many times KDF has derived a new key (aka a KDF step) which is then sent along with every message for the end client to know how many derivations (steps) he has to do to obtain a decryption key matching the message key which encrypted the message.

Note: it is also used for creating a message mac which is later compared for verification, but since both clients are keeping track of the current counter it should match as long as the order is intact.

This makes sense for protocols that don't have order, but if I am using TCP which keeps order does sending the counter and skipping over messages has any use?

|improve this question
$\endgroup$
2
$\begingroup$

You are confusing TCP packets and Signal messages.

First, TCP ensures the order of packets inside a session. TCP does not ensure the order among sessions. This means that TCP cannot be used to ensure that the Signal messages are received in the order they were sent.

Also, TCP was not build to resit active tempering by a MITM agent, unlike Signal. It would be extremely unwise for Signal to assume that the properties of TCP are reliable.

Moreover, the end client might not keep track of the previous messages: they could be deleted or the client could have been reinstalled on another device (while keeping the secret keys).

|improve this answer
$\endgroup$
  • $\begingroup$ I didn't mean the TCP counter, I meant the current counter of the KDF, I do increment per message but the question is what do I gain from transmitting it on an ordered protocol? Since an ordered protocol will send messages always incremented by 1 counter (counter + 1 per message) $\endgroup$ – OughtToPrevail Apr 25 '19 at 11:54
  • $\begingroup$ @OughtToPrevail Sorry, I did not correctly understand your question at first. I changed my answer. $\endgroup$ – A. Hersean Apr 25 '19 at 13:16
  • $\begingroup$ I still don't understand your answer, what sessions are involved? it's only 1 TCP session, a client and a server, the server is the one who spreads the messages to the devices, also if the client have been reinstalled on another device with the exact same keys, he should have installed the exact same counter which is stored aswell $\endgroup$ – OughtToPrevail Apr 25 '19 at 13:35
  • $\begingroup$ 2 Signal messages can be sent over the same TCP session (very unlikely) or two different TCP sessions (very likely). TCP sessions are short-lived, they last only a few minutes after the last sent packet. They can also be arbitrary cut at any moment in case of an overload of the network. $\endgroup$ – A. Hersean Apr 25 '19 at 13:41
  • $\begingroup$ Also, the Signal app is free to open a new TCP session per message, even if a TCP session is still in use. $\endgroup$ – A. Hersean Apr 25 '19 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.