Skip to main content
2 of 3
added 23 characters in body

Double Ratchet Algorithm: Active Man in the Middle Attack without Root-Key or Ratchet-Key

I am currently studying the Double Ratchet Algorithm from Signal (link to the documentation). I stepped over an security issue of which I was not able to find that it was mentioned anywhere.

I assume that an attacker is able to delay messages at the public channel. Let's say Alice and Bob are having a conversation via double ratchet encrypted messages.

At double ratchet, if an attacker has compromised a message key, it is going to be able to calculate the next message keys until the next diffie hellman ratchet step. But assume that attacker compromises a sending-chain-key / message key from alices sending ratchet. Because Alice sent the message, Bob might do another diffie hellman ratchet step. The attacker could now stop all messages from alice, so Bob never receives a message which indicates another diffie hellman ratchet step. The attacker may now send as many messages as he wants to Bob. It just needs to calculate more message keys in the compromised sending-chain.

This attack also assumes that the attacker knows how to calculate the associated data.

Does this attack actually work or am I missing anything?

Thanks in advance!!