Incryptography, theDouble Ratchet Algorithm (previously referred to as theAxolotl Ratchet[2][3]) is akey managementalgorithm that was developed byTrevor Perrin andMoxie Marlinspike in 2013. It can be used as part of acryptographic protocol to provideend-to-end encryption forinstant messaging. After an initialkey exchange it manages the ongoing renewal and maintenance of short-lived session keys. It combines a cryptographic so-called "ratchet" based on theDiffie–Hellman key exchange (DH) and a ratchet based on akey derivation function (KDF), such as ahash function, and is therefore called a double ratchet.
The algorithm provides forward secrecy for messages, and implicit renegotiation of forward keys; properties for which the protocol is named.[4]
This has been extended as of October 2025 to theSparse Post Quantum Ratchet (SPQR) with aCRYSTALS-Kyber quantum ratchet to provide post-quantum Forward Secrecy and Post-Compromise Security guarantees in what the Signal authors call aTriple Ratchet.[5]
The Double Ratchet Algorithm was developed by Trevor Perrin and Moxie Marlinspike (Open Whisper Systems) in 2013 and introduced as part of theSignal Protocol in February 2014. The Double Ratchet Algorithm's design is based on the DH ratchet that was introduced byOff-the-Record Messaging (OTR) and combines it with a symmetric-key ratchet modeled after theSilent Circle Instant Messaging Protocol (SCIMP). The ratchet was initially named after the critically endangered aquatic salamanderaxolotl, which has extraordinary self-healing capabilities.[6] In March 2016, the developers renamed the Axolotl Ratchet as the Double Ratchet Algorithm to better differentiate between the ratchet and the full protocol,[3] because some had used the name Axolotl when referring to the Signal Protocol.[7][3]
The Double Ratchet Algorithm features properties that have been commonly available in end-to-end encryption systems for a long time: encryption of contents on the entire way of transport as well asauthentication of the remote peer and protection against manipulation of messages. As a hybrid ofDH andKDF ratchets, it combines several desired features of both principles. FromOTR messaging it takes the properties offorward secrecy and automatically reestablishing secrecy in case of compromise of a session key, forward secrecy with a compromise of the secret persistent main key, andplausible deniability for the authorship of messages. Additionally, it enables session key renewal without interaction with the remote peer by using secondary KDF ratchets. An additional key-derivation step is taken to enable retaining session keys for out-of-order messages without endangering the following keys.
It is said[by whom?] to detect reordering, deletion, and replay of sent messages, and improve forward secrecy properties against passive eavesdropping in comparison to OTR messaging.
Combined withpublic key infrastructure for the retention of pregenerated one-time keys (prekeys), it allows for the initialization of messaging sessions without the presence of the remote peer (asynchronous communication). The usage oftriple Diffie–Hellman key exchange (3-DH) as initial key exchange method improves the deniability properties. An example of this is the Signal Protocol, which combines the Double Ratchet Algorithm, prekeys, and a 3-DH handshake.[8] The protocol provides confidentiality, integrity, authentication, participant consistency, destination validation, forward secrecy, backward secrecy (aka future secrecy), causality preservation, message unlinkability, message repudiation, participation repudiation, and asynchronicity.[9] It does not provide anonymity preservation, and requires servers for the relaying of messages and storing of public key material.[9]
A client attempts to renew session key material interactively with the remote peer using a Diffie-Hellman (DH) ratchet. If this is impossible, the clients renew the session key independently using a hash ratchet. With every message, a client advances one of two hash ratchets—one for sending and one for receiving. These two hash ratchets get seeded with a common secret from a DH ratchet. At the same time it tries to use every opportunity to provide the remote peer with a new public DH value and advance the DH ratchet whenever a new DH value from the remote peer arrives. As soon as a new common secret is established, a new hash ratchet gets initialized.
As cryptographic primitives, the Double Ratchet Algorithm uses
The following is a list of applications that use the Double Ratchet Algorithm or a custom implementation of it.
The Double Ratchet Algorithm does not attempt to solve the inherent vulnerability of centralized networks tobackdoors that introduce flaws in the algorithm implementation, the cryptographical protocol (which the algorithm is part of) or implementation thereof, or unrelated parts of the official application. It has been implemented nonetheless in a number of official clients for various centralized networks:
| Email clients | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Secure communication |
| ||||||||||||||
| Disk encryption (Comparison) | |||||||||||||||
| Anonymity | |||||||||||||||
| File systems(List) | |||||||||||||||
| Security-focused operating system | |||||||||||||||
| Service providers | |||||||||||||||
| Educational | |||||||||||||||
| Anti–computer forensics | |||||||||||||||
| Related topics | |||||||||||||||
| General | |||
|---|---|---|---|
| Software packages | |||
| Community | |||
| Organisations | |||
| Licenses |
| ||
| Challenges | |||
| Related topics | |||
