Non-interactive key exchange establishes shared keying material without requiring the recipient to exchange messages immediately. Hybrid encryption uses it to send encrypted data to a public key; Signal uses it to start conversations with an offline recipient. section 6.2.2 section 10.4.2
Hybrid encryption follows a short, practical sequence:
- Generate a symmetric key and use authenticated encryption to encrypt the message. section 6.2.2
- Encrypt the symmetric key with the recipient’s public key. section 6.2.2
- Send both ciphertexts; the recipient uses the private key to recover the symmetric key, then decrypts the message. section 6.2.2
- Use authenticated encryption rather than unauthenticated symmetric encryption, so tampering can be detected. section 6.2.2
Starting a Signal conversation while Bob is offline
Bob registers identity keys, a signed prekey, and optional one-time prekeys. Alice retrieves this prekey bundle, performs several Diffie–Hellman exchanges, combines their outputs through a KDF, and uses the result to initialize encrypted messaging. One-time prekeys add forward secrecy even when Bob is offline; signed prekeys provide a fallback when one-time keys run out. section 10.4.2
Figure 10.10 Signal’s flow starts with a user registering with a number of public keys. If Alice wants to talk to Bob, she first retrieves Bob’s public keys (called a prekey bundle), then she performs an X3DH key exchange with these keys and creates an initial message using the output of the key exchange. After receipt of the message, Bob can perform the same on his side to initialize and continue the conversation.
Trace registration, prekey retrieval, X3DH, and initial-message creation in an asynchronous conversation. section 10.4.2
