Haute Lumière · The Stack · The room
A ratchet only turns one way — and why ours does not turn at all yet.
The construction the room actually uses, the guarantee it gives, the one it does not, and why the right thing to build next is not the thing Signal built.
A ratchet is a mechanism that only turns one way. Signal's Double Ratchet is two of them, stacked, and the stacking is the whole idea.
Every message key comes off a chain key, and the moment it does, the chain key replaces itself with one derived from itself.
Because a key derivation function runs one way only, somebody holding chain key six can compute seven, eight and every one after it — and can never compute five. The keys that opened last week's messages are not stored somewhere and then deleted. They are arithmetically unreachable. That property is called forward secrecy, and it is what makes a seized phone stop being a confession.
Every time the conversation changes direction — you send, they reply — each side makes a fresh Diffie-Hellman key pair and sends the new public half along with the message. Both sides run a new exchange and derive a whole new chain from it.
So an attacker who compromises your device today is locked out again the moment your correspondent replies with a new key. They have to break in a second time to keep reading. That is post-compromise security, and it is the property people mean when they say a conversation heals itself.
Keys turn on every message, and again on every change of direction. Two ratchets. Hence the name.
This is a good construction and it does something the ratchet does not do easily: it addresses many recipients at once, cleanly, with one sealed body and one small envelope per person. The server carries envelopes it cannot open and forwards them to devices it cannot impersonate. Breaking one message yields exactly one message.
Look at step four. The sender's half of that exchange is ephemeral and destroyed. The recipient's half is their long-lived identity key. And the ephemeral public key has to travel with the message in the clear, because the recipient needs it to do their side of the arithmetic.
So consider an adversary who does two ordinary things: archives ciphertext off the wire for six months, and then, later, obtains the recipient's identity private key — by seizure, by malware, by a court. For every message in that archive they now have both halves. They recompute ECDH(eph.pub, identity.priv), unwrap every message key, and read six months at once.
Against a double ratchet the same theft yields almost nothing historical, because each chain ratcheted forward and left no way back.
One key, stolen once, opening everything ever said — that is the failure a ratchet exists to prevent.
| Property | The room today | Double Ratchet |
|---|---|---|
| Server can read messages | No | No |
| One message broken opens others | No | No |
| Old messages safe if identity key stolen | No | Yes |
| Recovers after a compromise | No | Yes |
| Handles a room of eight people | Natively | Poorly |
For a journalist whose device may be seized, an activist under a state that stores traffic, or a lawyer holding privileged material, the missing property is serious and a ratchet is the right answer.
For readers discussing chapter seven of a book on developmental psychology, the exposure is real and modest. And the room is already far ahead of the ordinary case: every mainstream messaging and storage service in this market holds a key that opens everything, permanently, by design. The gap being described here is the difference between very good and best-in-class, not between safe and unsafe.
What matters more than the gap is that it is written down. It is in the source file, in a comment, where an engineer will find it. It is on the sales page, where a customer will. A house that tells you the shape of its weakness is telling you the truth about its strengths.
This is the part worth getting right, because the obvious answer is the wrong one.
The Double Ratchet was designed for a conversation between two people. Groups strain it badly: the standard approach is a separate pairwise ratchet session for every pair of members, on every device, which means a room of eight people on two devices each is a great many sessions to keep in step — and every one of them has to survive messages arriving late, out of order, or not at all.
The room's current envelope-per-recipient design is better suited to a room than a ratchet is. That is not a consolation; it is the reason the design was chosen.
The right target
MLS — Messaging Layer Security, RFC 9420. The standardised construction for group end-to-end encryption. It provides forward secrecy and post-compromise security, like the ratchet, but it is built for groups from the start rather than adapted to them, and it scales with the size of the room instead of with the square of it.
It is more work than a ratchet, not less — a tree of keys, a defined set of group operations, real state to maintain when somebody joins or leaves. It is not a weekend. But it is the thing that is actually being converged on for this shape of product, and building the wrong ratchet first would mean building twice.
So when the question comes — and it will come, from the first person technical enough to ask — the answer is not a hedge. It is: we built for rooms, and the room-shaped version of that guarantee is MLS, which is where we are going.