OMEMO is an end-to-end encryption protocol based on the Double Ratchet specified in section Double Ratchet. It provides the following guarantees under the threat model described in the next section:
Confidentiality: Nobody else except sender and receiver is able to read the content of a message.
-
Perfect forward secrecy: Compromised key material does not compromise previous or future message exchanges.
+
Forward Secrecy: Compromised key material does not compromise previous message exchanges.
+ It has been demonstrated, that OMEMO provides only weak forward secrecy (it protects the session key only once both parties complete the key exchange).
+
Post-Compromize Security: A session which has been compromised due to leakage of key material recovers from the compromise after a few communication rounds.
Authentication: Every peer is able to authenticate the sender or receiver of a message, even if the details of the authentication process is out-of-scope for this specification.
-
Immutability: Every peer can ensure that a message was not changed by any intermediate node.
-
Plausible deniability: No participant can prove who created a specific message.
+
Integrity: Every peer can ensure that a message was not changed by any intermediate node.
+
Deniability: X3DH is weakly offline deniable and provides no online deniability, as far as the research shows.
Asynchronicity: The usability of the protocol does not depend on the online status of any participant.
OMEMO is not intended to protect against the following use cases:
-
An attacker has permanent access to your device. Temporary access is covered by perfect forward secrecy.
+
An attacker has permanent access to your device. In this case, the attacker may extract decrypted messages from the device, eg. from the applications database. If the access is temporary, security will eventually be restored through forward secrecy.
You lost your device and an attacker can read messages on your notification screen.
Any kind of denial-of-service attack.
tbc
@@ -271,11 +273,11 @@
ratchet initialization
The Double Ratchet is initialized using the shared secret, ad and public keys as yielded by the X3DH key agreement protocol, as explained in the Double Ratchet specification.
MAX_SKIP
It is RECOMMENDED to keep around 1000 skipped message keys.
-
deletion policy for skipped message keys
Skipped message keys MUST be stored until MAX_SKIP message keys are stored. At that point, keys are discarded on a FIFO basis to make space for new message keys. Implementations SHOULD not keep skipped message keys around forever, but discard old keys on a different implementation-defined policy. It is RECOMMENDED to base this policy on deterministic events rather than time.
+
deletion policy for skipped message keys
Skipped message keys MUST be stored until MAX_SKIP message keys are stored. At that point, keys are discarded on a FIFO basis to make space for new message keys. Implementations SHOULD not keep skipped message keys around forever, but discard old keys on a different implementation-defined policy. It is RECOMMENDED to base this policy on deterministic events rather than time. To prevent an attacker from deleting arbitrary message keys, the deletion policy should be applied on a per-session basis.
authentication tag truncation
Authentication tags are truncated to 16 bytes/128 bits.
CONCAT(ad, header)
CONCAT(ad, header) = ad || OMEMOMessage.proto(header) NOTE: the OMEMOMessage.proto is initialized without the ciphertext, which is optional. NOTE: Implementations are not strictly required to return a parseable byte array, as the unpacked/parsed data is required later in the protocol.
-
KDF_RK(rk, dh_out)
HKDF-SHA-256 using the rk as HKDF salt, dh_out as HKDF input material and "OMEMO Root Chain" as HKDF info.
-
KDF_CK(ck)
HMAC-SHA-256 using ck as the HMAC key, a single byte constant 0x01 as HMAC input to produce the next message key and a single byte constant 0x02 as HMAC input to produce the next chain key.
+
KDF_RK(rk, dh_out)
HKDF-SHA-256 using the root key (rk) as HKDF salt, the output of a Diffie-Hellman (dh_out) as HKDF input material and "OMEMO Root Chain" as HKDF info.
+
KDF_CK(ck)
HMAC-SHA-256 using a chain key (ck) as the HMAC key, a single byte constant 0x01 as HMAC input to produce the next message key (mk) and a single byte constant 0x02 as HMAC input to produce the next chain key.
ENCRYPT(mk, plaintext, associated_data)
The encryption step uses authenticated encryption consisting of AES-256-CBC with HMAC-SHA-256.
@@ -290,6 +292,7 @@
+
Information on the functions mentioned above can be found in the Double Ratchet specification.
If encrypting this message required a key exchange, the X3DH header data is placed into a new OMEMOKeyExchange.proto structure together with the OMEMOAuthenticatedMessage.proto structure.
@@ -306,7 +309,7 @@
The contents are encrypted and authenticated using a combination of AES-256-CBC and HMAC-SHA-256.
-
Generate 32 bytes of cryptographically secure random data, called key in the remainder of this algorithm.
+
Generate 32 bytes of cryptographically secure random data, called key in the remainder of this algorithm.
Use HKDF-SHA-256 to generate 80 bytes of output from the key by providing the key as HKDF input, 256 zero-bits as HKDF salt and "OMEMO Payload" as HKDF info.
Divide the HKDF output into a 32-byte encryption key, a 32-byte authentication key and a 16 byte IV.
Encrypt the plaintext using AES-256-CBC with PKCS#7 padding, using the encryption key and IV derived in the previous step.
@@ -799,5 +802,6 @@ message OMEMOKeyExchange {
Big thanks to Daniel Gultsch for mentoring me during the development of this protocol. Thanks to Thijs Alkemade and Cornelius Aschermann for talking through some of the finer points of the protocol with me. And lastly I would also like to thank Sam Whited, Holger Weiss, and Florian Schmaus for their input on the standard.
The authors would like to thank the Chaosdorf for hosting them during the development of version 0.4.0 of this specification.
+
Furthermore, the authors want to thank Sofía Celi for her feedback and input on the document.