0
$\begingroup$

This is basically a duplicate of this question which was not answered very clearly. From the documentation, these are the calculations that happen for Alice to compute the shared secret key:

DH1 = DH(IKA, SPKB)
DH2 = DH(EKA, IKB)
DH3 = DH(EKA, SPKB)
DH4 = DH(EKA, OPKB)
SK = KDF(DH1 || DH2 || DH3 || DH4)

If I understand correctly,

IKA -> Alice's private identity key

SPKb -> Bob's public signed prekey

IKB -> Bob's public identity key

EKA -> Alice's public ephermal key

OPKB -> Bob's public one time prekey

From the documentation: "Bob retrieves Alice's identity key and ephemeral key from the message. Bob also loads his identity private key, and the private key(s) corresponding to whichever signed prekey and one-time prekey (if any) Alice used. Using these keys, Bob repeats the DH and KDF calculations from the previous section to derive SK, and then deletes the DH values."

I interpreted this as bob doing the same computations above with following values:

IKA -> Alice's public identity key

SPKB -> Bob's private signed prekey

IKB -> Bob's private identity key

EKA -> Alice's public ephermal key

OPKB -> Bob's private one time prekey

What I don't understand is how the same secret shared key end up being computed even though for DH1, DH2, DH3, DH4 different values are used for the keys. I am probably missing some property of the DH function along with how public keys are generated from private keys that makes this possible. Or my whole understanding of this is incorrect. Any help would be appreciated thank you!

$\endgroup$
  • $\begingroup$ Is EKA the same as EKa? Is OPKB readable as OPKb for consistency? How are SPKb and EPKn computed in the protocol? The equations in the question show what Alice performs, but what does Bob perform? If that's similar with a and b exchanged, isn't the order for the concatenation in the input of KDF different? $\endgroup$ – fgrieu Feb 19 at 20:18
  • $\begingroup$ To moderators: as stated in the question, it is very much a duplicate of this. I suggest that we fix the present question here, until it is fully answerable; then either [if there is no answer] close the present question as duplicate, moving the [modified] question's text to the other answer; or [otherwise] close the other question as duplicate, copying the accepted answer here. Uh, isn't moderation things supposed to be simple? $\endgroup$ – fgrieu Feb 19 at 20:27
  • $\begingroup$ @fgrieu I fixed the casing inconsistency, thank you for pointing it out. From the documentation here signal.org/docs/specifications/x3dh "Bob repeats the DH and KDF calculations from the previous section to derive SK". My main question is how is Bob able to do that and calculate the same SK. Thank you. $\endgroup$ – MrFuzzy Feb 19 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.