The Signal protocol

The double ratchet

The symmetric ratchet from chapter 1 protects the past, but not the future after a theft. Signal solves this problem by combining two ratchets. This is the Double Ratchet algorithm, at the heart of Signal, WhatsApp, and many others.

Two ratchets, two roles

The Double Ratchet runs two interlocking mechanisms:

The symmetric ratchet: a KDF applied to each message, as in chapter 1. It ensures fine-grained forward secrecy, message by message.
The Diffie-Hellman ratchet: a new DH exchange performed on each round trip of the conversation (when switching from sender to receiver). Its result is mixed into the keys. It ensures post-compromise security.

The role of the Diffie-Hellman ratchet

At each turn to speak, the sender attaches a new ephemeral DH public key to their message. Each party combines its private key with the received public key to produce a fresh DH secret, which resets the chain keys.

This is what "repairs" the system: if an attacker has stolen the state at a given moment, they know the current chain keys. But at the very next round trip, a new DH introduces a secret they do not possess (they would also have to steal the new ephemeral private key). From that point on, they lose the thread — the system has healed itself.

        Cliquet DH (à chaque aller-retour)
   RK0 --DH frais--> RK1 --DH frais--> RK2 ...
        |                 |                |
        v                 v                v
   Cliquet symétrique (à chaque message)
    CK -KDF-> CK'      CK -KDF-> CK'    CK -KDF-> CK'
     |          |        |         |      |         |
    MK1        MK2      MK3       MK4    MK5       MK6

RK = clé racine (root key)   CK = clé de chaîne   MK = clé de message

The complementarity

The two ratchets divide the work:

Ratchet	Rhythm	Property ensured	Protects…
Symmetric (KDF)	each message	fine-grained forward secrecy	the past
Diffie-Hellman	each round trip	post-compromise	the future

The symmetric ratchet, one-way, guarantees that stealing the state does not reveal past messages.
The DH ratchet, by continually injecting fresh randomness, guarantees that the system becomes safe again after a theft: it protects the future.

Together, they reduce the scope of a compromise to a tiny window: at worst, a few messages around the moment of the theft, never the entire conversation.

Massive adoption

This algorithm, published by Open Whisper Systems, did not remain confidential: the Signal protocol powers the Signal app, but also WhatsApp (more than two billion users), Messenger, Google Messages and others. It is today the de facto standard for end-to-end encryption in messaging.

In summary