Editing Diffie–Hellman key exchange (section)

=== Extended Triple Diffie–Hellman (X3DH) ===
X3DH was initially proposed as part of the [[Double Ratchet Algorithm]] used in the [[Signal Protocol]]. The protocol offers forward secrecy and cryptographic deniability. It operates on an elliptic curve.<ref name=x3dh>{{cite web |title=Specifications >> The X3DH Key Agreement Protocol |url=https://www.signal.org/docs/specifications/x3dh/ |website=Signal Messenger |language=en}}</ref>

The protocol uses five public keys. Alice has an identity key IK<sub>A</sub> and an ephemeral key EK<sub>A</sub>. Bob has an identity key IK<sub>B</sub>, a signed prekey SPK<sub>B</sub>, and a one-time prekey OPK<sub>B</sub>.<ref name=x3dh/> Bob first publishes his three keys to a server, which Alice downloads and verifies the signature on. Alice then initiates the exchange to Bob.<ref name=x3dh/> The OPK is optional.<ref name=x3dh/>