# How does master secret calculates in encryption protocol used by WhatsApp?

I have read the algorithm behind WhatsApp encryption in this document. I can not understand how the initiator calculates a master secret.

The initiator calculates a master secret as:

master_secret = ECDH(Iinitiator, Srecipient) || ECDH(Einitiator, Irecipient) || ECDH(Einitiator, Srecipient) || ECDH(Einitiator, Orecipient).


If there is no One Time Pre Key, the final ECDH is omitted.

• I've read that paper twice and it is so hard to understand it. I hope someone here can explain it in layman's term. Commented Apr 9, 2018 at 13:24
• WhatsApp uses the Signal protocol, you should read the Signal protocol docs.
– Z.T.
Commented May 16, 2019 at 18:14

The ECDH() refers to Elliptic-curve Diffie–Hellman. It's mentioned in the paper only indirectly by referring to the Signal Protocol by Open Whisper Systems and Curve25519. This is a commercially focused white paper, so it does't really intend to get into the mathematics.

The reason for using 3–4 different Diffie–Hellman key pairs and concatenating (||) the operations is to prevent stolen private keys to be used to decrypt any previously captured communication: medium-term and one-time keys have changed during the time, while the long-term key pair proves it's still the same person. Because all these keys are needed, it also gives plausible deniability; any proofs of authenticity of the decrypted messages gets lost when the conversation finishes.

Quick recap.

Parameters generated by the initiator:

1) Iinitiator, Identity Key (keypair) of the initiator;

2) Einitiator, an ephemeral (ie temporary) elliptic curve keypair.

Parameters generated by the recipient:

3) Irecipient, the recipient's identity key (keypair);

4) Srecipient, the recipient's signed pre key (keypair);

5) Orecipient, the recipient's one-time pre-key (keypair).

ECDH(Ka, Kb) is the Elliptic Curve Diffie Hellman procedure between two parties, A with a keypair Ka and B with a keypair Kb.

|| is the concatenation operator.

The formula

 master_secret = ECDH(Iinitiator, Srecipient) || ECDH(Einitiator, Irecipient) || ECDH(Einitiator, Srecipient) || ECDH(Einitiator, Orecipient)


means that the ECDH protocol is run four times, using as keypairs:

1) Iinitiator and Srecipient;

2) Einitiator and Irecipient;

3) Einitiator and Srecipient;

4) Einitiator and Orecipient,

respectively. As you can see, each time two keypairs, each of which belongs to a different party, are used, which means all those ECDH(. , .) operations are valid.

Each of this operation generates a shared secret without directly revealing it to anyone else listening on the channel, thanks to the properties of the Diffie-Hellman protocol.

The results are concatenated, thus forming the master secret.