The Double Ratchet Algorithm Explained
The Double Ratchet is the algorithm at the heart of the Signal Protocol that gives each message its own encryption key. It combines a Diffie–Hellman "ratchet" with a symmetric-key "ratchet" so that keys are constantly renewed and destroyed, providing forward secrecy (past messages stay safe) and post-compromise security (the session heals after a key leak).
The word "ratchet" is the key metaphor: like a ratchet wrench, the algorithm only turns forward. Once a key has been used and the state advances, you cannot turn it back to recover previous keys. Two independent ratchets run at once — hence "double."
The two ratchets
The symmetric-key ratchet
For a run of messages in one direction, the algorithm maintains a chain key. Each time you send (or receive) a message, the chain key is passed through a key-derivation function (a KDF, typically HMAC-based) to produce two things: a fresh message key that encrypts exactly one message, and the next chain key. The old chain key and message key are then deleted. Because a KDF is one-way, knowing a later chain key tells you nothing about earlier message keys. This alone provides forward secrecy within a chain.
The Diffie–Hellman ratchet
Every time the direction of the conversation changes, each party generates a new ephemeral Diffie–Hellman key pair and attaches the new public key to their message. Combining the new key pair with the other side's latest public key produces fresh shared secret material, which reseeds the chains via a root key. This periodic injection of brand-new randomness is what gives post-compromise security: even if an attacker steals the entire current state, once a new DH exchange happens they are locked out of future messages again.
Forward secrecy vs. post-compromise security
Forward secrecy looks backward: a key stolen today cannot decrypt yesterday's messages, because the keys that encrypted them were already deleted. Post-compromise security (sometimes "future secrecy") looks forward: after a compromise, the conversation automatically returns to a secure state once fresh Diffie–Hellman material is exchanged. The Double Ratchet delivers both at once, and it also handles out-of-order and dropped messages by caching skipped message keys.
Why the Double Ratchet matters
Earlier encryption schemes often used one long-lived key per conversation. If that key ever leaked — through a seized device, a bug, or coercion — every message ever sent could be decrypted, and every future message too. The Double Ratchet turns a single catastrophic key into thousands of short-lived keys, each protecting only one message. It transforms a compromise from "everything, forever" into "at most a tiny window."
Common misconceptions
- "Double just means encrypting twice." No — "double" refers to running two different ratchets (DH and symmetric-key) together, not double encryption.
- "The ratchet hides who you talk to." It protects content and keys, not metadata.
- "If my device is seized, the ratchet protects my old chats." Forward secrecy protects messages the app has already deleted. Messages still stored in plaintext on an unlocked device are readable regardless.
Handling dropped and out-of-order messages
Real networks are messy: messages arrive late, out of order, or not at all. A naive per-message key scheme would break the moment a single message went missing, because the receiver's key chain would be out of step with the sender's. The Double Ratchet is explicitly designed to cope. Each message carries a small header indicating its position in the chain, so if messages arrive out of order the receiver can advance its symmetric-key ratchet to the right point and derive the correct message key. When messages are skipped, the receiver caches the skipped message keys so it can still decrypt those messages if they show up later, then deletes them once used or after a reasonable limit. This is why secure messengers can offer per-message forward secrecy without becoming fragile: the algorithm gracefully tolerates the unreliability of real-world delivery, including delivery over lossy mesh links.
How OSHI uses the Double Ratchet
OSHI implements a Double Ratchet on top of X25519 Diffie–Hellman and AES-256-GCM, following the Signal Protocol design. In practice this means every OSHI message is sealed with a unique, single-use key, and the session continually reseeds itself. The result is strong forward secrecy and post-compromise security by default. OSHI is open source under the MIT license, so this behavior is fully auditable.
Related guides & features
Signal Protocol Perfect forward secrecy End-to-end encryption AES-256 What is metadata All OSHI features Compare OSHIFrequently Asked Questions
What is the Double Ratchet algorithm?
It is the algorithm in the Signal Protocol that gives every message its own encryption key by combining a Diffie-Hellman ratchet with a symmetric-key ratchet, providing forward secrecy and post-compromise security.
Why is it called a ratchet?
Because the key state only advances forward, like a ratchet wrench. Once a key is used and the state moves on, you cannot go back to recover previous keys. Two such ratchets run together, hence Double.
What is the difference between forward secrecy and post-compromise security?
Forward secrecy means a key stolen today cannot decrypt past messages. Post-compromise security means the conversation returns to a secure state after a compromise, once fresh Diffie-Hellman key material is exchanged.
Does the Double Ratchet encrypt each message differently?
Yes. Each message is encrypted with a unique, single-use message key derived from a chain that advances with every message, and the used keys are deleted.
Does OSHI use the Double Ratchet?
Yes. OSHI implements a Double Ratchet over X25519 and AES-256-GCM, so every message uses a fresh key and the session provides forward secrecy and post-compromise security by default.
Private messaging, by design
OSHI is a free, open-source, Swiss encrypted messenger. No phone number, no ads, no tracking.