Post-compromise security (PCS), also called backward or future secrecy, lets a protocol recover after keys are exposed. Once an attacker loses access, fresh shared entropy can restore protection for later messages. section 10.4.3 section 8.2
A Double Ratchet restores protection through a repeating exchange-and-derivation cycle:
- Advertise a ratchet public key with messages. section 10.4.3
- When a new peer key arrives, perform an ephemeral Diffie–Hellman exchange. section 10.4.3
- Feed the exchange output into the symmetric ratchet to derive message keys. section 10.4.3
- Generate and advertise a new local ratchet key, creating a ping-pong of fresh exchanges. section 10.4.3
A compromise, then recovery
Suppose an attacker learns the session secrets during a conversation but later loses access to both devices. The next ratchet exchange introduces entropy the attacker cannot obtain, allowing subsequent keys to become protected again. Recovery fails while the attacker still controls a device. section 10.4.3
Figure 10.19 The Double Ratchet (from Alice’s point of view) combines the DH ratchet (on the left) with the symmetric ratchet (on the right). This provides PCS as well as forward secrecy to the post-X3DH protocol. In the first message, Alice does not yet know Bob’s ratchet key so she uses his presigned key instead.
The combined Double Ratchet diagram shows how the DH ratchet supplies PCS while the symmetric ratchet supplies message-level forward secrecy. section 10.4.3
