# Signal protocol: X3DH

I've been trying to get a grasp of how the Signal protocol works. According to the spec, DH is done on four keys: IK_A, SPK_B, EK_A and IK_B:

If the bundle does not contain a one-time prekey, she calculates:

DH1 = DH(IK_A, SPK_B)
DH2 = DH(EK_A, IK_B)
DH3 = DH(EK_A, SPK_B)
SK = KDF(DH1 || DH2 || DH3)


Given that all these four keys are public keys and are announced through untrusted channels, couldn't a nefarious player compute the shared secret SK?

• Why do you say DH1, DH2, and DH3 are "announced through untrusted channels". As far as I understood Alice deletes the data after she computed. Jun 15, 2021 at 17:44
• @Ievgeni I mean the public keys are. The DH's appear to be calculated using public keys which wouldn't make much sense. Jun 15, 2021 at 17:46
• I think that this documentation is fuzzy. To compute DH, Alice uses the discrete logarithm of IK_A and EK_A known only by herself. Jun 15, 2021 at 17:52

In fact $$DH1, DH2$$ and $$DH3$$ are not "announced through untrusted channels".

I think that this documentation is fuzzy. To compute DH, Alice uses the discrete logarithm of IK_A and EK_A known only by herself.

To be more concrete, if IK_A = g^{sk_A}, and SPK_B=g^{sk_B}, with $$sk_A$$ a secrete value already known by Alice.

Then she could compute DH(IK_A, SPK_P) by computing $$(SPK_B)^{sk_A}$$.

And Bob could compute DH(IK_A, SPK_P) by computing $$(EK_A)^{sk_B}$$.

This protocol is secure under the computational Diffie-Hellman assumption :

https://en.wikipedia.org/wiki/Computational_Diffie%E2%80%93Hellman_assumption