2
$\begingroup$

I'm trying to understand the X3DH protocol used in Signal and many other end to end encrypted messaging apps. There are other questions on this site asking about why the signed prekey exists. I'm asking why the prekey need to be signed.

In section 3.3 of the specification, 4 (3 if the one-time prekey is missing) Diffie-Hellman exchanges are done. DH1 involves the identity key of one user, and DH2 involves the identity key of the other user. The SK is derived from these exchanges in addition to the other exchanges that do not involve identity keys. Notably, DH4 is computed without involving any identity key or signed key.

How does any security property of X3DH change if the signature on the signed prekey is not validated?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

section 4.5 of the spec:

It might be tempting to observe that mutual authentication and forward secrecy are achieved by the DH calculations, and omit the prekey signature. However, this would allow a "weak forward secrecy" attack: A malicious server could provide Alice a prekey bundle with forged prekeys, and later compromise Bob's IKB to calculate SK.

in other words:

  • you want to talk to Bob for the first time
  • you ask me (the server) what are Bob's keys
  • I give you:
    • his real identity key
    • an unsigned prekey of my own
    • no one-time prekey
  • you do the X3DH with this information, and send Bob messages (making use of the output of X3DH)
  • unfortunately, Bob won't be able to decrypt any of these because the X3DH is not using an unsigned prekey he knows.
  • later on, I manage to compromise Bob's identity key, I get to decrypt the messages you had sent him at the time. Thus, there is no forward secrecy for these messages that Bob couldn't decrypt (thus, "weak forward secrecy").
Improve this answer
$\endgroup$
2
  • $\begingroup$ From what I understand of X3DH, only one party's prekeys are signed. The initiator does not sign their prekeys. If I'm not mistaken about this, then doesn't this attack exist against the initiator? However, it requires some man-in-the-middle whereas your scenario involves the server who is already built into the scenario as a man-in-the-middle. $\endgroup$
    – Mikero
    May 12 at 17:35
  • $\begingroup$ Figure 10.12 of Real-World Cryptography shows that the initiator does not use prekeys in the X3DH (i.imgur.com/BgCgGli.png) $\endgroup$
    – David 天宇 Wong
    May 18 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.