Replying to Avatar JeffG

That’s incorrect. Each time the root (dh) ratchet is turned, the party turning generates a brand new keypair, does a dh calc, then includes the pubkey of the new keypair. As a tag. The output of that ratchet generates a new chain key. The other party has to use their current state plus the new pubkey to do a turn to catch up and then another (with another new ephemeral key) to get their other new chain key.

There is a DH exchange on each turn.
Avatar
semisol 1y ago

The only reference that I could find after looking through the spec a few times is a tag, and I couldn’t find any other documentation on this.

There also seems to be an assumption that there is strict message ordering.

Reply to this note

Please Login to reply.

Discussion

Avatar
JeffG 1y ago

Check out the demo app code that is linked in the NIP. It should make it more clear about when each ratchet is turned and what data goes into each calculation.

It also shows you how skipped/out of order messages are handled.