Data flow: Detailed BBM Enterprise key exchange process

  1. Each device generates a long-lived encryption key pair and a signing key pair.
    1. The initiator’s device generates:
      (KsignA, K'signA) = EC-GEN ()
(KencA, K'encA) = EC-GEN ()
    2. The recipient’s device generates:
      (KsignB, K'signB) = EC-GEN ()
(KencB, K'encB) = EC-GEN ()
  2. The initiator chooses or autogenerates a secret password. This shared password is sent automatically in-band or is sent manually out-of-band to the recipient using an SMS text message, email, phone call, or in person. For details, see Key exchange process.
  3. The initiator sends the first BBM message, which is an invitation that contains the initiator's contact information and the highest version of BBM Enterprise that they support.
    Version = 0
p = KDF ("EC-SPEKE Password", F || S), forget S, where sizeof(p) = 256 bits
(SA, S'A) = EC-SPEKE-GEN (p), forget p
invite_id = 64-bit nonce
    The initiator’s invitation message (Message #1) is: (VersionA, invite_id, PINA, SA)
  4. The recipient responds to the invitation and provides the highest version of BBM Enterprise that the recipient supports, proof that they know the secret password, and the recipient's long-lived public encryption and signing keys.
    Version = 0
p = KDF ("EC-SPEKE Password", F || S), forget S, where sizeof(p) = 256 bits
(SB, S'B) = EC-SPEKE-GEN (p), forget p
Version = MIN (VersionA, VersionB)
SSAB = EC-DH (S'B, SA)
(Kenc, Kmac, nonce) = KDF ("BBM Enterprise Key Exchange", F || SSAB)
Message #2 payload = P2 = (invite_id, KsignB, KencB)
Message #2 payload signature = S2 = EC-SIGN {K'signB} (F || versionB || P2 || SA || SB)
Message #2 encrypted payload = E2 = ENCMAC {Kenc, Kmac, nonce} (P2 || S2)
    The recipient’s response message (Message #2) is: (VersionB, SB, E2)
  5. The initiator responds to the acceptance and provides proof that they know the secret password, the initiator's long-lived public encryption and signing keys, and proof that the initiator's private keys correspond to the public keys that the initiator claims to own.
    Version = MIN (VersionA, VersionB)
Increment password_attempts.
If (password_attempts > 5) then abort.
SSAB = EC-DH (S'_A, S_B)
(Kenc, Kmac, nonce) = KDF ("BBM Enterprise Key Exchange", F || SSAB)
(P2, S2) = DECMAC {Kenc, Kmac, nonce} (E2)
(Ksign_B,Kenc_B) = P2
Verify signature S2.
KencAB = EC-DH (K'encA, KencB)
Kproof = KDF ("K_proof", F || KencAB), where sizeof(Kproof) = 256 bits
Message #3 Auth Tag = T3 = MAC {Kproof} (F || KsignB|| KencB)
Message #3 payload = P3 = (KsignA, KencA, T3)
Message #3 payload signature = S3 = EC-SIGN {K'signA} (F || P3 || SB || SA || KsignB || KencB)
Message #3 encrypted payload = E3 = ENCMAC {Kenc, Kmac, nonce}(P3 || S3)
    The initiator’s response message (Message #3) is: E3
  6. The recipient responds with proof that they own the recipient's private keys.
    (P3, S3) = DECMAC {Kenc, Kmac, nonce} (E3)
(KsignA, KencA, T3') = P3
Verify signature S3.
KencAB = EC-DH (K'enc_B, KencA)
Kproof' = KDF ("K_proof", F || KencAB), where sizeof (Kproof) = 256 bits
T3 = MAC {Kproof'} (F || KsignB || KencB)
Check T3 == T3'
Message #4 Auth Tag = T4 = MAC {Kproof'}(F || KsignA || KencA)
E4 = ENCMAC {Kenc, Kmac, nonce} (T4)
    The initiator’s response message (Message #4) is: E4
  7. After the initiator verifies the final message from the recipient, each party knows the other’s public keys and that they belong to someone who knows both the associated private keys and the secret password.
    T4' = DECMAC {Kenc, Kmac, nonce} (Message #4)
Check T4' against MAC {Kproof} (F || KsignA || KencA)

After the key exchange is completed, the security of messages no longer depends on the secrecy of the passphrase or the ephemeral key pairs. The public keys for encryption and signing are stored for each contact and the contact is confirmed as the owner of the private keys.