Comment

Comment by thadt

It's easy to get thrown off by the fact that it uses Diffie-Hellman in two places: 3DH for the original key exchange, but then also as part of the continuing key stream. There is only one hash ratchet, but occasionally each party will generate another DH keypair, ratcheting the key stream forward [1].

The hash ratchet protects new messages, but if the hash key is compromised at one point in time, an attacker can derive all future message keys indefinitely. The DH ratchet defeats that by generating a new key. If the attacker can't get that key, they lose the chain, making the protocol self healing against point-in-time key compromises.

[1] https://signal.org/docs/specifications/doubleratchet/#diffie...

parent thadt 2 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton