A More Complete Analysis of the Signal Double Ratchet Algorithm

Seminal works by Cohn-Gordon, Cremers, Dowling, Garratt, and Stebila [EuroS &P 2017] and Alwen, Coretti and Dodis [EUROCRYPT 2019] provided the first formal frameworks for studying the widely-used Signal Double Ratchet ( $$\textsf{DR}$$ for short) algorithm. In this work, we develop a new Universally Composable (UC) definition $$\mathcal {F}_{\textsf{DR}}$$ that we show is provably achieved by the $$\textsf{DR}$$ protocol. Our definition captures not only the security and correctness guarantees of the $$\textsf{DR}$$ already identified in the prior state-of-the-art analyses of Cohn-Gordon et al. and Alwen et al., but also more guarantees that are absent from one or both of these works. In particular, we construct six different modified versions of the $$\textsf{DR}$$ protocol, all of which are insecure according to our definition $$\mathcal {F}_{\textsf{DR}}$$ , but remain secure according to one (or both) of their definitions. For example, our definition is the first to fully capture CCA-style attacks possible immediately after a compromise—attacks that, as we show, the $$\textsf{DR}$$ protocol provably resists, but were not fully captured by prior definitions. We additionally show that multiple compromises of a party in a short time interval, which the $$\textsf{DR}$$ is expected to be able to withstand, as we understand from its whitepaper, nonetheless introduce a new non-trivial (albeit minor) weakness of the $$\textsf{DR}$$ . Since the definitions in the literature (including our $$\mathcal {F}_{\textsf{DR}}$$ above) do not capture security against this more nuanced scenario, we define a new stronger definition $$\mathcal {F}_{\textsf{TR}}$$ that does. Finally, we provide a minimalistic modification to the $$\textsf{DR}$$ (that we call the $$\text {Triple Ratchet}$$ , or $$\textsf{TR}$$ for short) and show that the resulting protocol securely realizes the stronger functionality $$\mathcal {F}_{\textsf{TR}}$$ . Remarkably, the modification incurs no additional communication cost and virtually no additional computational cost. We also show that these techniques can be used to improve communication costs in other scenarios, e.g. practical Updatable Public Key Encryption schemes and the re-randomized TreeKEM protocol of Alwen et al. [CRYPTO 2020] for Secure Group Messaging.