Skip to main content

Questions tagged [signal-protocol]

The Signal (formerly known as TextSecure) Protocol is an end-to-end encryption protocol developed for the instant messaging software Signal and also used by other software such as WhatsApp.

Filter by
Sorted by
Tagged with
1 vote
0 answers
35 views

Understanding Signal Protocols for Group chat, Voice, and Video call

I am new to the field of protocols and currently researching the Signal protocol and its security features. So far, I have studied X3DH, Double Ratchet, the Sesame algorithm, and PQXDH, which is ...
ali khosravi's user avatar
2 votes
2 answers
98 views

How can I imply the order of a series of messages?

The sender will send text messages that seem meaningful, like "How are you today?" and "How is the weather today?" However, for the receiver, "How are you today?" is only ...
DingoStiglitz's user avatar
2 votes
1 answer
64 views

The explicit authentication in PQ3

I've found the main part of the PQ3 protocol used in iMessage introduced in Apple's blog https://security.apple.com/blog/imessage-pq3/ is like combining the Signal protocol with a post-quantum KEM ...
RIN's user avatar
  • 21
0 votes
0 answers
108 views

Can we be certain that Signal doesn't log metadata (e.g. message graphs)?

I know Signal uses public/private key E2E encryption to ensure it's impossible for them to read the contents of messages. WhatsApp does too, hence Signal's main attraction is that it additionally ...
Seán Healy's user avatar
1 vote
1 answer
93 views

Signed vs unsigned prekeys

I am trying to understand the signal protocol better. I spend some time trying to understand their codebase (the backend is written in java). The signal protocol indicates that the user has to upload ...
Farhan Syedain's user avatar
3 votes
2 answers
245 views

What is the difference between Post-Compromise Security and Backward Security?

Post-Compromise Security and Backward Security seem to mean that the attacker has obtained the communication key between two parties or groups in the current state, but cannot further obtain ...
Guardzhan's user avatar
1 vote
1 answer
116 views

How often do Double ratchet in Signal protocol update DH ratchet key

I'm trying to understand the specification behind doubleratchet algorithm, item 2.4. Double Ratchet. According to wiki: A client renews session key material in interaction with the remote peer using ...
pacman's user avatar
  • 459
1 vote
1 answer
74 views

Signal protocol: are One-time prekeys derived from Signed Prekey or just randomly generated?

Do signal protocol derive One-time prekeys from Signed Prekey with some KDF or are they just randomly generated in the same way as Signed Prekey?
pacman's user avatar
  • 459
2 votes
1 answer
214 views

Double Ratchet Algorithm: Active Man in the Middle Attack without Root-Key or Ratchet-Key

I am currently studying the Double Ratchet Algorithm from Signal (link to the documentation). I stepped over a security issue which I was not able to find that it was mentioned anywhere. I assume that ...
p_1092131280's user avatar
5 votes
1 answer
138 views

Why is forward secrecy needed at X3DH?

In the official documentation of the X3DH Algorithm (link) is made an analysis about the forward secrecy. Forward secrecy would be an uselful property if we would repeat the protocol multiple times. ...
p_1092131280's user avatar
2 votes
1 answer
212 views

How to combine the keys in the Triple Diffie-Hellman (3DH) key exchange?

I was reading up on the Triple Diffie-Hellman (3-DH) key exchange and noticed that the wikipedia description [1] is different from the the original protocol definition [2] and the modified definition [...
n-l-i's user avatar
  • 752
2 votes
2 answers
1k views

How does perfect forward secrecy work for messaging?

I am struggling to understand how messaging protocols (like Signal) are able to use perfect forward secrecy. My understanding is that the server generates temporary keys which are used in combination ...
Randusr's user avatar
  • 45
3 votes
1 answer
149 views

Signal's Key Wrap: is it safe and is it custom?

The iOS version of Signal application (not the protocol) includes a form of key wrap that I've never seen elsewhere: SHA256-HMAC-SIV. It's used to encrypt your master key with your ...
Tim Shadel's user avatar
4 votes
0 answers
186 views

Are there any projects leveraging a combination of (1) Noise and (2) Signal / Double Ratchet to augment the former with per-message forward secrecy?

Are there examples (in code, or a blog post / writeup) of using Noise and Signal together? Here is a link to Noise. For example, using the Double Ratchet per each message to achieve forward secrecy, ...
user3325588's user avatar
1 vote
1 answer
165 views

Encrypt messages for two-participants chat

I need a chat between two users and I obviously want to make it as secure as possible. I am, by no means, a cryptography expert, so I turn to you guys for some advice. Because I like the idea of ...
SparxDev's user avatar
1 vote
0 answers
113 views

Signal double ratchet only giving "weak" forward secrecy?

I was just watching this video on the Double ratcheting protocol. at around 31:37, the presenter says that the protocol only provides weak forward secrecy. I've only ever heard about a distinction ...
Grazosi's user avatar
  • 131
1 vote
1 answer
156 views

RSA-based Double Ratchet Algorithm

I'm reading the Signal specification and they suggest to use EC keys, in particular with X25519 or X448 curves, both for the initial X3DH agreement and the DH ratchet. I've noticed that languages and ...
xonya's user avatar
  • 113
0 votes
0 answers
188 views

Difference between WhatsApp and Signal implementation of the Open Whisper Protocol

WhatsApp has taken the step of using the Open Whisper Protocol for their message encryption, borrowed from the Signal application. I was wondering if there was any obvious, high level, difference in ...
questioner's user avatar
4 votes
1 answer
286 views

Is there a difference between the strength of Telgram's (MTproto) forward secrecy and Signal's?

If I understood correctly, the Signal protocol generates a new key after every message sent and forgets the previous one. Telegram, on the other hand, renews the key only after 100 messages or one ...
lstk44's user avatar
  • 73
1 vote
2 answers
190 views

X3DH and key exchange between Alice identity key and Bob pre signed key (DH1)

I'm getting familiar with Signal key exchange phase and as far as I understand all 3 exchanges between Alice ephemeral key and all of Bob keys from the bundle, I have some thoughts about key exchange ...
Jakub Bibro's user avatar
6 votes
1 answer
320 views

Introduce a reference for cryptanalysis of WhatsApp software

I am studying on cryptanalysis of WhatsApp software. I know this is secure software but I want to present a documentary on this topic as a seminar at the university for applied mathematics students. ...
user3571's user avatar
2 votes
1 answer
410 views

Is it safe to implement elliptic curve Diffie Hellman with secp256k1

I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
shotex's user avatar
  • 121
2 votes
0 answers
160 views

Glue between X3DH and Double-Ratchet

While studying Signal and more particulartly X3DH and Double-Ratchet one particular apsect seems unspoken or not really documented. X3DH provides a shared secret however Double-Ratchet needs a shared ...
Hlen's user avatar
  • 21
3 votes
1 answer
479 views

Signal protocol: X3DH

I've been trying to get a grasp of how the Signal protocol works. According to the spec, DH is done on four keys: IK_A, SPK_B, <...
John M.'s user avatar
  • 131
2 votes
2 answers
451 views

Does the diffie helman rachet in double ratchet do anything if one side never replies?

I am a little confused on how this functions so apologies in advance if the question is naive. The way i understand it, the function of the standard sending and receiving ratchets in Double Ratchet is ...
idk's user avatar
  • 45
2 votes
1 answer
223 views

What does DH(IPKa, IPKb) notation mean? Diffie-Hellman confusion

I'm trying to implement X3DH (extended triple Diffie-Hellman) in a network of mine. The way I understand it, a bundle (IPKb,SPKb,OTKb) is retrieved by Alice from Bob, through the server, and using her ...
idk's user avatar
  • 45
2 votes
1 answer
457 views

Is it possible to safely implement the Signal Protocol (X3DH) without using XEdDSA

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key. Because the identity private-key is in ...
Si Bxxx's user avatar
  • 31
1 vote
2 answers
346 views

How often is Ratchet key pair changed in signal protocol?

At first I thought the new ratchet key is created with each first incoming message. After that I believed it depends on the implementation. But after closer look at the signal documentation and ...
Dante's user avatar
  • 83
1 vote
0 answers
52 views

Is fingerprint authentication meaningless if the server/client is closed source?

I'm talking about when two chat users want to verify their identities via public key fingerprints. If the Client app is closed source, and we cannot see what it is doing, isn't the Server able to play ...
Dante's user avatar
  • 83
2 votes
1 answer
689 views

Purpose of signing the signed prekey in X3DH?

I'm trying to understand the X3DH protocol used in Signal and many other end to end encrypted messaging apps. There are other questions on this site asking about why the signed prekey exists. I'm ...
Soham Roy's user avatar
1 vote
1 answer
253 views

What is keyId in Signal Protocol JavaScript library?

I'm trying to implement the Signal Protocol JavaScript library for a school project. On this page, the generatePreKey function takes as parameter a keyId. I can't find what that is in the ...
Thomas's user avatar
  • 113
4 votes
1 answer
3k views

What is Post-Compromise security exactly?

After reading these papers on Post-Compromise Security: Post Compromise Security Asynchronous Ratcheting Trees My understanding is the following: it is possible for a key-agreement protocol to ...
vxek's user avatar
  • 477
1 vote
0 answers
104 views

Signal Key Stretching Regarding Their Blog Post

I just read this blog post (Signal - Technology Preview for secure value recovery) by Signal and something is not quite clear to me. In section "Stretching beyond a KDF" they generate a ...
user2403221's user avatar
2 votes
0 answers
123 views

Use Signal protocol without server [closed]

I'm trying to establish E2E secured channel with nearby devices (using WiFi direct). Obviously, I wouldn't like to rely on internet connection. Can I use the signal protocol without a server? 1)Will ...
Noam's user avatar
  • 121
2 votes
2 answers
268 views

Iterative hashing increases number of security bits?

Whatsapp uses 5200 iterations of SHA-512 over user's public key and identity according to WhatsApp Security Whitepaper. I wonder why? According to: Why iterate 5200 times when computing Safety ...
Alexander Smirnov's user avatar
3 votes
1 answer
188 views

Does the authenticity of messages by Alice still holds if the state of bob is compromised in Double Ratchet

In the double ratchet algorithm, let's say if bob's device is compromised including his long term key. Does the ephemeral keys generated by Alice during the half Diffie–Hellman key exchange produces ...
Shrenik Chhajer's user avatar
7 votes
4 answers
3k views

Is encrypted e-mail sent over TLS 1.3 a form of "forward secrecy" (similar to something like Signal)?

One common complaint about GPG-encrypted e-mail is that it doesn't provide forward secrecy; however with opportunistic TLS becoming increasingly common in both IMAP and SMTP, it's not unreasonable to ...
philomathic_life's user avatar
2 votes
1 answer
86 views

Encypted comms between two parties with facilitating middleman

Charlie knows both Alice and Bob. Alice wants to send a message to Bob. Charlie must at all times know that Alice is sending Bob a message but must never know the content of the message. The message ...
cryptotan's user avatar
6 votes
1 answer
3k views

Signal protocol, how is Signed PreKey created?

I am getting confused with what exactly is the nature of the Signed Prekey (SPK) used in signal protocol. I understand what it is used for, but I think the confusion stems from its name. Is it just ...
Dante's user avatar
  • 83
7 votes
0 answers
1k views

Signal Protocol - Better way to generate one time pre keys (OTPK)

The following explains a different way (then one-time pre keys) for Bob to securely generate ephemeral keys asynchronously without a limit while still being able to delete the private key immediately ...
OughtToPrevail's user avatar
0 votes
1 answer
372 views

Signal Protocol Header key encryption initialization vector

In Signal Protocol when you use a Double Ratchet you have 2 options: Normal encryption = header + ciphertext Encrypted header encryption = ...
OughtToPrevail's user avatar
1 vote
2 answers
204 views

Purpose of key evolution?

When generating and exchanging keys, what is the purpose of performing key evolution after public key exchange + authenticated encryption?
Alejandra's user avatar
1 vote
1 answer
276 views

Signal Protocol - Counter over TCP?

Signal Protocol uses a counter (discussed in DoubleRatchet documentation) to define how many times KDF has derived a new key (aka a KDF step) which is then sent along with every message for the end ...
OughtToPrevail's user avatar
12 votes
0 answers
2k views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
OughtToPrevail's user avatar
1 vote
1 answer
2k views

Signal protocol: when, and why, is X3DH run again between the same two users?

This question concerns the Signal protocol's X3DH key agreement protocol as documented here. Obviously, if Alice and Bob have never contacted each other before, they need to run X3DH at least once to ...
swineone's user avatar
  • 880
2 votes
1 answer
721 views

Signal Protocol: What extra features does double ratchet algorithm add to Diffie-Hellman ratchet?

I have been reading the documentation of Signal protocol and could not find out why they came up with double ratchet instead of using Diffie-Hellman ratchet which was available at first place in OTR?
Farzad Vertigo's user avatar
1 vote
1 answer
237 views

Signal/TextSecure multiparty Chat. Does the protocol transmits a symmetric key?

As I look over the TexSecures specifications for multi-party chat I have noticed this. Also as far as I understood in TextSecure (now known as Signal) the minimal steps required to do a secure ...
Dimitrios Desyllas's user avatar
3 votes
1 answer
428 views

How does future secrecy fail for Signal group messaging?

In the paper More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema, the abstract claims that We additionally show that strong security properties, such as ...
rlee827's user avatar
  • 234
3 votes
1 answer
2k views

Is it possible to implement the Signal Protocol without a server?

My question is regarding the Signal Protocol[1]. Is it possible to implement the protocol securely, without a server? (I have no particular motivation for the question other than to understand better ...
Andrew Peace's user avatar
4 votes
2 answers
1k views

Signal Double Ratchet - How can Alice send 2+ messages in the beginning of the Signal Protocol?

I'm studying about Signal Protocol and I had a doubt in Double Ratchet Algorithm. This section describes how to derive the receiving and sending key messages. Alice is initialized by Bob public ...
Vivi's user avatar
  • 159