This is basically a duplicate of this question which was not answered very clearly. From the documentation, these are the calculations that happen for Alice to compute the shared secret key:
DH1 = DH(IKA, SPKB)
DH2 = DH(EKA, IKB)
DH3 = DH(EKA, SPKB)
DH4 = DH(EKA, OPKB)
SK = KDF(DH1 || DH2 || DH3 || DH4)
If I understand correctly,
IKA -> Alice's private identity key
SPKb -> Bob's public signed prekey
IKB -> Bob's public identity key
EKA -> Alice's public ephermal key
OPKB -> Bob's public one time prekey
From the documentation: "Bob retrieves Alice's identity key and ephemeral key from the message. Bob also loads his identity private key, and the private key(s) corresponding to whichever signed prekey and one-time prekey (if any) Alice used. Using these keys, Bob repeats the DH and KDF calculations from the previous section to derive SK, and then deletes the DH values."
I interpreted this as bob doing the same computations above with following values:
IKA -> Alice's public identity key
SPKB -> Bob's private signed prekey
IKB -> Bob's private identity key
EKA -> Alice's public ephermal key
OPKB -> Bob's private one time prekey
What I don't understand is how the same secret shared key end up being computed even though for DH1, DH2, DH3, DH4 different values are used for the keys. I am probably missing some property of the DH function along with how public keys are generated from private keys that makes this possible. Or my whole understanding of this is incorrect. Any help would be appreciated thank you!
EKA
the same asEKa
? IsOPKB
readable asOPKb
for consistency? How areSPKb
andEPKn
computed in the protocol? The equations in the question show what Alice performs, but what does Bob perform? If that's similar witha
andb
exchanged, isn't the order for the concatenation in the input ofKDF
different? $\endgroup$