A symmetric ratchet protects long-lived conversations from the theft of a current key. Instead of encrypting messages with one permanent session key, it repeatedly turns a chain key into the next chain key and a one-time message-encryption key. section 10.4.3
For each direction of a conversation:
- Start with a sending or receiving chain key derived from the session setup. section 10.4.3
- Pass the chain key through a one-way function to obtain the next chain key and the message key. section 10.4.3
- Maintain separate sending and receiving chains so each message direction evolves independently. section 10.4.3
A stolen current key
Suppose an attacker obtains Alice’s current sending chain key. The one-way update prevents that key from revealing earlier chain keys or earlier message keys. Previously received messages gain the same protection from Bob’s receiving chain. section 10.4.3
The mechanism limits cryptographic exposure, but a compromised phone may already contain old messages in plaintext. Deleting old messages is therefore relevant to realizing the intended protection. section 10.4.3
