Transport encryption vs. end-to-end encryption
TLS (covered in the previous module) encrypts data between a client and a server — the server itself sees the plaintext. End-to-end encryption (E2EE) encrypts data between two end users, such that the server relaying it, even if fully compromised, cannot read the content. Signal, and protocols derived from it (including WhatsApp's), are the most widely deployed implementations of this model for messaging.
X3DH: agreeing on a key while offline
Messaging has a problem TLS doesn't: the recipient may not be online to participate in a live key exchange. The Extended Triple Diffie-Hellman (X3DH) protocol solves this by having each user publish a set of pre-generated key material to a server in advance, so a sender can compute a shared secret and send a first encrypted message even if the recipient is offline at that moment.
X3DH: starting a conversation while the recipient is offline
- 1
Bob publishes key bundles
Bob uploads a long-term identity key and a batch of pre-generated one-time keys to the server, then goes offline.
- 2
Alice fetches a bundle
Alice downloads one of Bob's pre-keys, even though Bob isn't online right now.
- 3
Alice derives a shared secret
She combines several Diffie-Hellman exchanges (her keys with Bob's identity and pre-key) into one shared secret.
- 4
Alice sends the first message
Encrypted with a key derived from that secret — Bob decrypts it once he comes back online, using the matching private keys.
X3DH, as messages crossing the wire
The same exchange, viewed as traffic rather than internal steps: Bob's half happens entirely before Alice's, with no live round trip between them — the server in the middle only ever relays already-published key material, never anything secret.
The Double Ratchet
After the initial key agreement, the Double Ratchet algorithm derives a new encryption key for every single message, combining a Diffie-Hellman ratchet (fresh key material exchanged periodically) with a symmetric-key ratchet (a one-way chain deriving each message key from the last). The result is forward secrecy at the level of individual messages — compromising one message's key doesn't expose earlier ones — plus post-compromise security: if an attacker briefly compromises a device's state, the ratchet's ongoing Diffie-Hellman exchanges eventually heal the session back to a secure state.
Symmetric-key ratchet
- •Each message key is derived from the previous one via a one-way chain
- •Fast — no new Diffie-Hellman exchange needed per message
- •Alone, it wouldn't recover if a chain key were ever exposed
Diffie-Hellman ratchet
- •New DH key pairs exchanged periodically alongside messages
- •Injects fresh randomness that heals the session after a compromise
- •Combined with the symmetric ratchet, gives both forward secrecy and post-compromise security
The symmetric-key ratchet, drawn out
Within a single Diffie-Hellman step, each message key comes from a one-way chain: every chain key derives that message's encryption key plus the next chain key, and the current chain key is discarded immediately after — so recovering a later chain key never lets you walk the chain backward to reconstruct earlier message keys.
Each chain key derives that message's encryption key and the next chain key, then discards itself — a one-way chain that only ever runs forward.