The Signal Protocol and the ratchet that forgets on purpose
The axolotl is a Mexican salamander that can regrow a lost limb in a matter of weeks. Moxie Marlinspike, an anarchist security researcher working out of San Francisco in 2013, thought the animal made a reasonable model for a cipher: if an attacker stole a session key, the system would simply grow another one, leaving the stolen piece worthless.
Marlinspike — the name derives partly from a childhood nickname, which tells you something — co-founded Whisper Systems in 2010 with roboticist Stuart Anderson, shipping TextSecure and RedPhone as free, open-source encrypted messaging apps. Twitter acquired the company in November 2011 and made him head of cybersecurity. He lasted fourteen months. He is, as a matter of public record, an anarchist who has published essays in The Anarchist Library. Corporate employment was perhaps always going to be temporary.
He left Twitter in January 2013 to found Open Whisper Systems as a nonprofit. Six months later, in June 2013, Edward Snowden’s disclosures confirmed what Marlinspike had been building toward: that mass surveillance of digital communications was not paranoia, but policy.
The cryptographic problem at the center of it all was simple to state. Earlier encrypted systems such as Off-the-Record (OTR) offered forward secrecy — compromise a key today and yesterday’s messages stayed safe, because yesterday’s key had already been destroyed. What OTR couldn’t handle was asynchronous messaging: both parties had to be online simultaneously, like a phone call. Smartphones had shattered that assumption. A message sent at midnight needed to sit encrypted until its recipient woke up hours later.
Working with cryptographer Trevor Perrin, Marlinspike built a solution from two interlocking ratchets. The first derived a fresh encryption key for each message and deleted it immediately. The second periodically reshuffled the entire key state using ephemeral Diffie-Hellman keys exchanged invisibly alongside the message text. Breach one window of the conversation and the cipher had already moved on; retrieve a device months later and the deleted keys revealed nothing. They called it the Axolotl Ratchet — the salamander’s limb was always regrowing.
The first full version shipped as part of TextSecure v2 in February 2014. In November 2014, WhatsApp — then at 600 million users — announced a partnership with Open Whisper Systems. By April 2016, all of WhatsApp’s billion-plus conversations were encrypted end-to-end with the Signal Protocol. No employee could read them; no subpoena could compel transcripts the company didn’t hold. The largest deployment of end-to-end encryption in history happened behind a default-on toggle that most users never noticed.
Cryptographers from Oxford, Queensland University of Technology, and McMaster University audited the protocol in 2016 and found it sound. Google Messages, Facebook Messenger, and Skype’s private conversations each adopted it. The algorithm one man built at a nonprofit, after walking away from Twitter, became the cryptographic backbone for roughly half the world’s private digital conversations.
In 2016 the Axolotl was renamed the Double Ratchet — more descriptive, considerably less charismatic. The ratchet still turns, invisibly, in every encrypted message sent today. The salamander just kept growing back.
Sources
- Signal Protocol — Wikipedia — Development history, TextSecure v2 release (February 2014), WhatsApp partnership (November 2014 through April 2016), adoption by Google, Facebook, and Skype.
- Moxie Marlinspike — Wikipedia — Biographical details: co-founding Whisper Systems in 2010, Twitter acquisition November 2011, founding Open Whisper Systems January 2013, anarchist background and publications.
- The Double Ratchet Algorithm — Signal Specification — Technical description of the ratchet mechanism, forward secrecy and post-compromise security properties, authorship by Trevor Perrin and Moxie Marlinspike.