1
$\begingroup$

I've been trying to get a grasp of how the Signal protocol works. According to the spec, DH is done on four keys: IK_A, SPK_B, EK_A and IK_B:

If the bundle does not contain a one-time prekey, she calculates:

    DH1 = DH(IK_A, SPK_B)
    DH2 = DH(EK_A, IK_B)
    DH3 = DH(EK_A, SPK_B)
    SK = KDF(DH1 || DH2 || DH3)

Given that all these four keys are public keys and are announced through untrusted channels, couldn't a nefarious player compute the shared secret SK?

$\endgroup$
3
  • $\begingroup$ Why do you say DH1, DH2, and DH3 are "announced through untrusted channels". As far as I understood Alice deletes the data after she computed. $\endgroup$
    – Ievgeni
    Jun 15, 2021 at 17:44
  • $\begingroup$ @Ievgeni I mean the public keys are. The DH's appear to be calculated using public keys which wouldn't make much sense. $\endgroup$
    – John M.
    Jun 15, 2021 at 17:46
  • $\begingroup$ I think that this documentation is fuzzy. To compute DH, Alice uses the discrete logarithm of IK_A and EK_A known only by herself. $\endgroup$
    – Ievgeni
    Jun 15, 2021 at 17:52

1 Answer 1

0
$\begingroup$

In fact $DH1, DH2$ and $DH3$ are not "announced through untrusted channels".

I think that this documentation is fuzzy. To compute DH, Alice uses the discrete logarithm of IK_A and EK_A known only by herself.

To be more concrete, if IK_A = g^{sk_A}, and SPK_B=g^{sk_B}, with $sk_A$ a secrete value already known by Alice.

Then she could compute DH(IK_A, SPK_P) by computing $(SPK_B)^{sk_A}$.

And Bob could compute DH(IK_A, SPK_P) by computing $(EK_A)^{sk_B}$.

This protocol is secure under the computational Diffie-Hellman assumption :

https://en.wikipedia.org/wiki/Computational_Diffie%E2%80%93Hellman_assumption

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.