In cryptography, the Double Ratchet Algorithm is a key management algorithm that was developed by Trevor Perrin and Moxie Marlinspike in 2013. It can be used as part of a cryptographic protocol to provide end-to-end encryption for instant messaging. After an initial key exchange it manages the ongoing renewal and maintenance of short-lived session keys. It combines a cryptographic so-called ″ratchet″ based on the Diffie–Hellman key exchange and a ratchet based on a key derivation function like e.g. a hash function and is therefore called a double ratchet. The developers refer tothe algorithm as self-healing because under certain conditions, it disables an attacker from accessing the cleartext of messages after having compromised a session key. This condition is that between the compromise of the key and the communication in question, there has been at least one message which was not tampered with by the attacker. This effectively forces the attacker to interceptall communication between the honest parties, since he loses access as soon as one uncompromised message is passed between them. This property was later named Future Secrecy, or Post-Compromise Security.
Etymology
The term "ratchet" in cryptography is used similarly to a mechanical ratchet. In the mechanical sense, a ratchet only allows advancement in one direction; a cryptographic ratchet only allows keys to be generated from the previous key. However, unlike a mechanical ratchet, each state is unique.
Origin
The Double Ratchet Algorithm was developed by Trevor Perrin and Moxie Marlinspike in 2013 and introduced as part of the Signal Protocol in February 2014. The Double Ratchet Algorithm's design is based on the DH ratchet that was introduced by Off-the-Record Messaging and combines it with a symmetric-key ratchet modeled after the Silent Circle Instant Messaging Protocol. The ratchet was initially named after the critically endangeredaquatic salamanderaxolotl, which has extraordinary self-healing capabilities. In March 2016, the developers renamed the Axolotl Ratchet as the Double Ratchet Algorithm to better differentiate between the ratchet and the full protocol, because some had used the name Axolotl when referring to the Signal Protocol.
Properties
The Double Ratchet Algorithm features properties that have been commonly available in end-to-end encryption systems for a long time: encryption of contents on the entire way of transport as well as authentication of the remote peer and protection against manipulation of messages. As a hybrid of DH and KDF ratchets, it combines several desired features of both principles. From OTR messaging it takes the properties of forward secrecy and automatically reestablishing secrecy in case of compromise of a session key, forward secrecy with a compromise of the secret persistent main key, and plausible deniability for the authorship of messages. Additionally, it enables session key renewal without interaction with the remote peer by using secondary KDF ratchets. An additional key-derivation step is taken to enable retaining session keys for out-of-order messages without endangering the following keys. It is said to detect reordering, deletion and replay of sent messages and improve forward secrecy properties in comparison to OTR messaging. Combined with public key infrastructure for the retention of pregenerated one-time keys, it allows for the initialization of messaging sessions without the presence of the remote peer. The usage of triple Diffie–Hellman key exchange as initial key exchange method improves the deniability properties. An example of this is the Signal Protocol, which combines the Double Ratchet Algorithm, prekeys, and a 3-DH handshake. The protocol provides confidentiality, integrity, authentication, participant consistency, destination validation, forward secrecy, backward secrecy, causality preservation, message unlinkability, message repudiation, participation repudiation, and asynchronicity. It does not provide anonymity preservation, and requires servers for the relaying of messages and storing of public key material.
Functioning
A client renews session key material in interaction with the remote peer using Diffie–Hellman ratchet whenever possible, otherwise independently by using a hash ratchet. Therefore, with every message a client using the double ratchet advances one of two hash ratchets which get seeded with a common secret from a DH ratchet. At the same time it tries to use every opportunity to provide the remote peer with a new public DH value and advance the DH ratchet whenever a new DH value from the remote peer arrives. As soon as a new common secret is established, a new hash ratchet gets initialized. As cryptographic primitives, the Double Ratchet Algorithm uses ; for the DH ratchet ; for message authentication codes ; for symmetric encryption ; for the hash ratchet
Applications
The following is a list of applications that use the Double Ratchet Algorithm or a custom implementation of it:
