X3DH

As explained in Real-World Cryptography

X3DH is a non-interactive key-exchange protocol that combines multiple Diffie-Hellman exchanges to establish shared keying material for asynchronous messaging.

X3DH lets someone start an end-to-end encrypted conversation even when the recipient is offline. It combines several Diffie-Hellman exchanges, using public keys prepared in advance, to create shared keying material for the first message. section 10.4.2

The handshake builds on three kinds of keys:

• Identity keys represent users over the long term, but cannot provide forward secrecy by themselves. section 10.4.2
• One-time prekeys are ephemeral public keys uploaded in advance, used once, and deleted afterward to add forward secrecy while the recipient is offline. section 10.4.2
• Signed prekeys provide a fallback when one-time prekeys run out; rotating them periodically limits how long that fallback remains current. section 10.4.2
• The sender retrieves a prekey bundle, performs the relevant exchanges, concatenates their outputs, and passes them through a KDF for the initial message. section 10.4.2

Figure 10.12 Building on figure 10.10, to send a message to Bob, Alice fetches a prekey bundle containing Bob’s long-term key, Bob’s signed prekey, and optionally, one of Bob’s one-time prekeys. After performing different key exchanges with the different keys, all outputs are concatenated and passed into a KDF to produce an output used in a subsequent post-X3DH protocol to encrypt messages to Bob.

Trace the practical flow from fetching a recipient’s prekey bundle through deriving material for the initial encrypted message. section 10.4.2

How Real-World Cryptography covers it

How deep it goes

Explains key roles and the handshake flow through prekey retrieval, multiple exchanges, concatenation, and KDF processing.

Examples

Uses Alice and Bob exchanging an initial message while Bob is offline as the central protocol example.

What it assumes

Assumes familiarity with Diffie-Hellman, public-key pairs, key derivation, and forward secrecy.

What you can do after

Evaluate how an asynchronous handshake preserves forward secrecy when recipients may be offline.

How it connects

Connects Diffie-Hellman, forward secrecy, prekey bundles, trust on first use, and the Signal protocol.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• Diffie–Hellman key exchangeuses · Diffie–Hellman key exchange is a public-key key-agreement protocol that enables parties to derive a shared secret over an insecure channel without transmitting it.
• key derivation functionuses · A key derivation function transforms input keying material into one or more cryptographic keys or related pseudorandom values.
• key exchangekind of · Key exchange is a cryptographic protocol by which communicating parties establish a shared secret over a communication channel without directly transmitting that secret.
• non-interactive key exchangekind of · A non-interactive key exchange establishes shared keying material with a recipient without requiring an exchange of interactive messages.
• Signal protocolpart of · The Signal protocol is an end-to-end encrypted messaging protocol that combines authenticated key exchange, ratcheted key evolution, and encrypted message transport.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.