Protecting the past and the future

The one-way ratchet

How can we renew a key for every message while guaranteeing that stealing the current state reveals nothing about the past? The answer lies in a mechanical image: the ratchet.

The ratchet image

A ratchet is that toothed mechanism found in a socket wrench or a winch: it only turns in one direction. Once it has advanced, there is no going back.

In cryptography, a ratchet advances a secret state message after message, without ever being able to return to previous states.

The symmetric ratchet

The heart of the mechanism is a key derivation function (KDF). A KDF takes a secret as input and produces new secrets, in a deterministic but one-way manner: you cannot go back from the output to the input.

At each step, we start from a chain key (the current state) and compute:

clé_chaîne  ->  KDF  ->  ( clé_message , nouvelle_clé_chaîne )

The message key is used to encrypt a single message, then is erased.
The new chain key replaces the old one, which is erased as well.

Then we start again from the new chain key. The state "advances" one notch, exactly like a ratchet.

CK0 --KDF--> (MK1, CK1)
              |          \
           chiffre msg1   CK1 --KDF--> (MK2, CK2)
                                        |          \
                                     chiffre msg2   CK2 --KDF--> (MK3, CK3)
                                                                  |
                                                               chiffre msg3

MK = clé de message (jetable)   CK = clé de chaîne (avance sans retour)

Why this gives forward secrecy

The KDF is a one-way function. Knowing CK2 lets you compute CK3, CK4… (the entire future of the chain), but never CK1 or CK0.

So if an attacker steals the current state CK3:

they cannot recover CK1, nor CK2;
the message keys MK1, MK2 have already been erased after use.

Past messages therefore remain protected: this is exactly the forward secrecy from the previous lesson, made concrete.

What the attacker steals (`CK3`)	Can they obtain it?
The future states `CK4`, `CK5`…	Yes (the KDF advances)
The past states `CK0`, `CK1`, `CK2`	No (one-way)
The already-encrypted messages `msg1`, `msg2`	No (`MK1`, `MK2` erased)

The limit of the symmetric ratchet alone

This ratchet protects the past wonderfully. But it has a blind spot: if the attacker steals CK3, they can follow the entire remainder of the chain and read the future messages. The symmetric ratchet therefore does not offer post-compromise security. A second mechanism will be needed for that — the subject of the next chapter.

In summary