keychat on Nostr: Alice and Bob use the Signal protocol to derive a key chain, sequentially using keys ...

Alice and Bob use the Signal protocol to derive a key chain, sequentially using keys to encrypt/decrypt messages, and delete each key after use.

Alice Bob

k1 k1
k2 k2
k3 k3
k4 k4
k5 k5
k6 k6
k7 k7
k8 k8
k9 k9
k10 k10
k11 k11
……. ……

quoting note1afk…g3wc

A ratchet can only turn in one direction.

The double ratchet means two types of ratchets: a KDF ratchet (the small ratchet in the diagram) and a DH ratchet (the large ratchet in the diagram).

KDF stands for Key Derivation Function. A hash function is the simplest KDF because it is one-way. K1=hash(K0), K2=hash(K1), K3=hash(K2), K4=hash(K3)... K1 is used to encrypt the first message, K2 to encrypt the second message, and so on. Once used, the key is deleted. If an attacker obtains the latest encryption key K5, they cannot reverse-engineer K4, K3, K2, or K1, ensuring the security of historical messages. Thus, the KDF provides forward secrecy to the encryption protocol.

However, the attacker can derive K6, K7, K8..., which means there is no backward secrecy. This is where the DH ratchet comes into play.

The Diffie–Hellman (DH) key exchange is a mathematical method for securely exchanging cryptographic keys over a public channel. Alice, using her private key S1 and Bob’s public key P2, can compute a value. Similarly, Bob, using his private key S2 and Alice’s public key P1, can compute a value. These two values are equal.

Alice and Bob continuously generate new DH key pairs for new messages on the client side and attach the public key in plaintext to the message. The message recipient can then use this public key and their private key to perform the DH computation. This DH ratchet effectively resets the KDF ratchet with the DH ratchet. Because the attacker does not know the latest DH private key, they cannot derive future encryption keys, thus providing backward secrecy.

Therefore, in the double ratchet algorithm, the KDF ratchet ensures forward secrecy, and the DH ratchet ensures backward secrecy, together achieving both forward and backward secrecy.

We recommend the following video, which provides a more intuitive animation demonstration.

https://youtu.be/9sO2qdTci-s?si=BXLU33BRANWAJKMz

https://youtu.be/7uEeE3TUqmU?si=jpPOR_O61IppgJxl

(We hope users can understand the basic principles to judge for themselves which chat applications are good.) note1ffg…ntlr