The Signal protocol
X3DH: the initial setup
Before a single message circulates, two people must establish a first shared secret. Signal performs this step with a protocol named X3DH, designed for a world where people are rarely online at the same moment.
The challenge: the recipient is offline
On a mobile messaging app, when Alice writes to Bob, his phone is often turned off or out of range. We therefore cannot rely on a live dialogue between the two devices to reach an agreement.
The trick: Bob publishes in advance, on a server, a batch of public keys. Alice retrieves them whenever she wants and can establish the secret all by herself, without Bob being connected.
The keys involved
X3DH stands for Extended Triple Diffie-Hellman. It combines several public keys:
- IK — the identity key, permanent, unique to each person (it authenticates who you are);
- SPK — a signed prekey, renewed periodically, signed by the identity key to prove its origin;
- OPK — a one-time prekey, consumed for a single session;
- EK — an ephemeral key that Alice generates specifically for this exchange.
Bob publishes IK_B, SPK_B and a stock of OPK_B on the server in advance. Alice brings IK_A and EK_A.
Combining several Diffie-Hellman exchanges
A Diffie-Hellman (DH) exchange lets two keys (one private on one side, one public on the other) produce a common secret. X3DH computes several of them and concatenates them, then passes the whole thing through a KDF:
DH1 = DH( IK_A , SPK_B ) <- lie l'identité d'Alice à la pré-clé de Bob
DH2 = DH( EK_A , IK_B ) <- lie l'éphémère d'Alice à l'identité de Bob
DH3 = DH( EK_A , SPK_B ) <- éphémère d'Alice x pré-clé signée de Bob
DH4 = DH( EK_A , OPK_B ) <- éphémère x pré-clé à usage unique (si dispo)
secret_partagé = KDF( DH1 || DH2 || DH3 || DH4 )
Why this combination
Each DH brings a precise guarantee, and it is their accumulation that gives the protocol its strength:
| DH | What it brings |
|---|---|
| DH1 | authenticates Bob (his signed prekey) to Alice |
| DH2 | authenticates Alice (her identity) to Bob |
| DH3, DH4 | bring fresh randomness -> forward secrecy from the start |
The result: a shared secret that authenticates both identities and already starts with forward secrecy, all without Bob being online. This secret then serves as the seed (the first chain key) for the double ratchet.
In summary
- X3DH establishes the first shared secret of a Signal conversation.
- It combines several Diffie-Hellman exchanges between identity keys, ephemeral keys and prekeys published on a server.
- Prekeys make it possible to establish the session even if the recipient is offline.
- The protocol authenticates both identities and already provides forward secrecy.