That’s incorrect. Each time the root (dh) ratchet is turned, the party turning generates a brand new keypair, does a dh calc, then includes the pubkey of the new keypair. As a tag. The output of that ratchet generates a new chain key. The other party has to use their current state plus the new pubkey to do a turn to catch up and then another (with another new ephemeral key) to get their other new chain key.

There is a DH exchange on each turn.

Reply to this note

Please Login to reply.

Discussion

The only reference that I could find after looking through the spec a few times is a tag, and I couldn’t find any other documentation on this.

There also seems to be an assumption that there is strict message ordering.