You type a message, hit send, and the text shows up on someone else’s phone halfway around the world. In between it has travelled through servers you do not own, across networks someone may be recording, and onto a handset that could one day end up in the wrong hands. We call it end-to-end encryption, but that label hides a far more interesting machine: a protocol that rotates keys with every message and is designed so that, even if your phone is stolen tomorrow, yesterday’s traffic stays unreadable.
That protocol is the Double Ratchet, the centrepiece of Signal, WhatsApp in encrypted mode, Matrix and the secret chats of several other platforms. Before it can run, an initial handshake has to happen: X3DH (Extended Triple Diffie-Hellman), the mechanism that lets two people who have never been online at the same time agree on a shared secret.
The bootstrap: keys waiting on a server
The tricky part of a first contact is that there is no secure channel yet. X3DH solves it by splitting the process in time: each user publishes a bundle of public keys computed over Curve25519, a 255-bit elliptic curve that delivers security comparable to 3072-bit RSA with far shorter keys. The bundle holds a long-term identity key (IK), a signed prekey (SPK) that rotates periodically and is signed with the identity key via XEdDSA, and a batch of one-time prekeys (OPK).
Whoever starts the conversation takes that bundle and chains three or four Diffie-Hellman exchanges: with the recipient’s identity key and their own, with the signed prekey, with the sender’s ephemeral key and, if one is left, with a one-time prekey. The result goes through a key derivation function (HKDF) and out comes a master secret. The important detail is that authentication is mutual: the initiator knows who they are talking to, and the recipient knows it too, because only they hold the matching private keys. And since one-time prekeys are consumed, two different opening messages can never yield the same secret.
Two ratchets, two different guarantees
With the secret agreed, the double ratchet takes over, and it is really two mechanisms turning at once.
The first is the symmetric ratchet, or key chain. Starting from a root key and a chain key, every message derives the next chain key plus a message key through a KDF built on HMAC-SHA256. The message key is used exactly once — typically with AES-256 in CBC mode plus an HMAC-SHA256 in an encrypt-then-MAC construction, or with AES-GCM in more recent versions — and is then wiped from memory. This is the part that provides forward secrecy: whoever obtains the current key cannot decrypt anything earlier, because those keys no longer exist anywhere. Not even the phone itself can re-read the past from its cryptographic state.
The second is the Diffie-Hellman ratchet, which turns whenever a message arrives carrying a new public key from the other side. At that point the receiver mixes its current private key with that new public key to produce a fresh secret and resets the root key and the chains. Every time someone replies, the chain changes. That turn is what delivers post-compromise security: if the internal state of the session was stolen yesterday, the attacker is locked out as soon as the other side writes again, because the new key depends on a secret the attacker never had.
Out-of-order messages, groups and metadata
On a real network messages arrive late, jump ahead or get lost. The protocol does not require ordering: each message travels with a header containing the sender’s DH public key, the message counter for the current chain (N) and the length of the previous chain (PN). With those three values, the receiver can compute forward the keys it skipped and store them in a limited list of skipped message keys, so an attacker cannot exhaust memory by demanding a thousand future keys at once.
For groups, the double ratchet is not applied to every pair of members: Sender Keys are used instead, where each participant derives its own symmetric chain and distributes it encrypted one-to-one to the others. That is far more efficient than multiplying sessions, though it means a new member needs to receive those keys from everyone else.
And then there is the hole encryption does not plug: metadata. The server cannot read the content, but it knows who writes to whom and when. Against that, Signal added Sealed Sender, which encrypts the sender’s identity for the server itself using anonymous delivery credentials, so the message arrives without the infrastructure knowing who sent it.
The next turn: post-quantum cryptography
The double ratchet is solid against classical computing, but a sufficiently large quantum computer would break Diffie-Hellman exchanges over elliptic curves: they are vulnerable to Shor’s algorithm. The answer is already deployed: PQXDH, a variant that adds an exchange based on ML-KEM (the post-quantum standard derived from Kyber) alongside the elliptic-curve ones. If both mechanisms are well implemented, an attacker would need to break both at once, something considered beyond the reach of any known adversary today.
So when you hit send, nothing is encrypted with a fixed key: a new key is created for that message, destroyed once used, and the next message will use a different one, derived from a secret that changes with every reply. It is a system designed not to be invulnerable, but to make each compromised key worth exactly one message, and to make the value of anything stolen expire on its own.
