Forward Secrecy

[kenforthewin]

Here's what Whatsapp does:

1. The sender generates a random 32-byte Chain Key.
2. The sender generates a random Curve25519 Signature Key key pair.
3. The sender combines the 32-byte Chain Key and the public key from the Signature Key into a Sender Key message.
4. The sender individually encrypts the Sender Key to each member of the group, using the pairwise messaging protocol explained previously. For all subsequent messages to the group:
5. The sender derives a Message Key from the Chain Key, and updates the Chain Key.
6. The sender encrypts the message using AES256 in CBC mode.
7. The sender signs the ciphertext using the Signature Key.
8. The sender transmits the single ciphertext message to the server, which does server-side fan-out to all group participants. The “hash ratchet” of the message sender’s Chain Key provides forward secrecy. Whenever a group member leaves, all group participants clear their Sender Key and start over.

A better explanation of double ratchet from Signal can be found here.