3
$\begingroup$

I've been trying to get a grasp of how the Signal protocol works. According to the spec, DH is done on four keys: IK_A, SPK_B, EK_A and IK_B:

If the bundle does not contain a one-time prekey, she calculates:

    DH1 = DH(IK_A, SPK_B)
    DH2 = DH(EK_A, IK_B)
    DH3 = DH(EK_A, SPK_B)
    SK = KDF(DH1 || DH2 || DH3)

Given that all these four keys are public keys and are announced through untrusted channels, couldn't a nefarious player compute the shared secret SK?

Improve this question
$\endgroup$
1
  • $\begingroup$ I think that this documentation is fuzzy. To compute DH, Alice uses the discrete logarithm of IK_A and EK_A known only by herself. $\endgroup$
    – Ievgeni
    Commented Jun 15, 2021 at 17:52

1 Answer 1

Reset to default
1
$\begingroup$

In fact $DH1, DH2$ and $DH3$ are not "announced through untrusted channels".

I think that this documentation is fuzzy. To compute DH, Alice uses the discrete logarithm of IK_A and EK_A known only by herself.

To be more concrete, if $IK_A = g^{sk_A}$, and $SPK_B=g^{sk_B}$, with $sk_A$ a secrete value already known by Alice.

Then she could compute DH(IK_A, SPK_P) by computing $(SPK_B)^{sk_A}$.

And Bob could compute DH(IK_A, SPK_P) by computing $(IK_A)^{sk_B}$.

This part of the protocol is secure under the computational Diffie-Hellman assumption.

But it is not necessarily enough to show the security of the whole protocol.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Do you have a claim for the security under CDH? Indeed, without CDH the protocol is broken but, in this analysis of x3dh eprint.iacr.org/2016/1013. They had to rely on the GapDH. Now one could argue this is an artifact of the model, but at the same time these Bellare-Rogaway model for AKE seem highly reasonable. Hence, the attacker has more power than a CDH adversary and we need stronger assumptions. $\endgroup$
    – Marc Ilunga
    Commented Dec 17, 2022 at 10:17
  • $\begingroup$ I was answering to the specific part asked by John not about the whole protocol (I will edit in my answer to precise). Maybe you should ask a new question more precise. $\endgroup$
    – Ievgeni
    Commented Dec 20, 2022 at 11:47
  • $\begingroup$ I was mainly curious whether there was a new result on x3dh that directly proves security under CDH only, and did require additional assumption. Maybe it's good to indicate that CDH is okay taken isolated, but the overall protocol is likely to need more assumptions in common security models. $\endgroup$
    – Marc Ilunga
    Commented Dec 20, 2022 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.