Signal Protocol

https://signal.org/docs
Admin
A collection of specifications and software libraries for end-to-end encryption in messaging...
Tokens:27,754
Snippets:302
Trust Score:9.7
Update:4 months ago
Show doc for...
Tokens:
Raw
### Initialize Alice for ML-KEM Braid

Source: https://signal.org/docs/specifications/mlkembraid

Initializes Alice's protocol state to begin sending an encapsulation key header. Requires a shared secret for authentication setup.

```python
def InitAlice(shared_secret):
    epoch = 1
    auth = Authenticator.Init(epoch, shared_secret)
    return KeysUnsampled(epoch, auth)
```

--------------------------------

### Initialize Bob for ML-KEM Braid

Source: https://signal.org/docs/specifications/mlkembraid

Initializes Bob's protocol state to expect to receive the encapsulation key header. Requires a shared secret for authentication setup and initializes a decoder for the header.

```python
def InitBob(shared_secret):
    epoch = 1
    auth = Authenticator.Init(epoch, shared_secret)
    header_decoder = Decoder.new(KEM.HEADER_SIZE + MAC_SIZE)
    return NoHeaderReceived(epoch, auth, header_decoder)
```

--------------------------------

### Initialize Bob's Double Ratchet State

Source: https://signal.org/docs/specifications/doubleratchet

Initializes the state for Bob when starting a Double Ratchet session. Requires the shared secret key (SK) and Bob's own Diffie-Hellman key pair.

```python
def RatchetInitBob(state, SK, bob_dh_key_pair):
    state.DHs = bob_dh_key_pair
    state.DHr = None
    state.RK = SK
    state.CKs = None
    state.CKr = None
    state.Ns = 0
    state.Nr = 0
    state.PN = 0
    state.MKSKIPPED = {}
```

--------------------------------

### Initialize Alice's Double Ratchet State

Source: https://signal.org/docs/specifications/doubleratchet

Initializes the state for Alice when starting a Double Ratchet session. Requires the shared secret key (SK) and Bob's public Diffie-Hellman key.

```python
def RatchetInitAlice(state, SK, bob_dh_public_key):
    state.DHs = GENERATE_DH()
    state.DHr = bob_dh_public_key
    state.RK, state.CKs = KDF_RK(SK, DH(state.DHs, state.DHr))
    state.CKr = None
    state.Ns = 0
    state.Nr = 0
    state.PN = 0
    state.MKSKIPPED = {}
```

--------------------------------

### Ct2Sampled State Receive Function

Source: https://signal.org/docs/specifications/mlkembraid

Handles incoming messages when in the Ct2Sampled state. It checks if the message is from the next epoch, indicating the start of a new encapsulation key sending phase, and transitions to the KeysUnsampled state.

```python
def Ct2Sampled.Receive(state, msg):
  output_key = None
  
  if msg.epoch == state.epoch + 1:
      # Next epoch has begun
      # Transition (13)
      state = KeysUnsampled(state.epoch + 1, state.auth)

  receiving_epoch = state.epoch - 1
  return (receiving_epoch, output_key)
```

--------------------------------

### Ratcheted Authenticator Initialization and Update

Source: https://signal.org/docs/specifications/mlkembraid

Initializes the authenticator state with a root key and updates it with a new key and epoch. This is used to set up the initial authentication context.

```python
def Authenticator.Init(auth_state, epoch, key):
    auth_state = {root_key: '\0'*32, mac_key: None }
    auth_state.Update(epoch, key)

def Authenticator.Update(auth_state, epoch, key):
    auth_state.root_key, auth_state.mac_key 
      = KDF_AUTH(auth_state.root_key, key, epoch)
```

--------------------------------

### HeaderSent State Send and Receive Logic

Source: https://signal.org/docs/specifications/mlkembraid

Handles sending the next chunk of the ek_vector and receiving Ct1 messages. Transitions to Ct1Received if Ct1 is complete.

```python
def HeaderSent.Send(state):
  # Generate next ek_vector chunk
  chunk = state.ek_encoder.next_chunk()
  msg = {epoch: state.epoch, type: Ek, data: chunk}
  
  # Return values
  output_key = None
  sending_epoch = state.epoch - 1
  return (msg, sending_epoch, output_key)
```

```python
def HeaderSent.Receive(state, msg):
  output_key = None
  receiving_epoch = state.epoch - 1
  
  if msg.epoch == state.epoch and msg.type == Ct1:
      # Add chunk to decoder
      state.ct1_decoder.add_chunk(msg.data)
      
      # Check if ct1 is complete
      if state.ct1_decoder.has_message():
          ct1 = state.ct1_decoder.message()
          
          # Update state
          # Transition (3)
          state = Ct1Received(
            state.epoch, 
            state.auth, 
            state.dk, 
            ct1, 
            state.ek_encoder)
  
  return (receiving_epoch, output_key)
```

--------------------------------

### Initialize Alice's SCKA State

Source: https://signal.org/docs/specifications/doubleratchet

Initializes Alice's state for the SCKA protocol using an initial shared secret key. Populates root key, KDF chains, and SCKA state.

```python
def RatchetInitAliceSCKA(state, SK):
  state.scka_state = SCKAInitAlice(SK)
  state.direction = A2B
  state.RK, CKs, CKr = KDF_SCKA_INIT(SK)
  state.epoch = 0
  state.kdfchains = {}
  state.kdfchains[0] = {}
  state.MKSKIPPED = {}
  state.kdfchains[0].send = KDFChain(CKs)
  state.kdfchains[0].receive = KDFChain(CKr)
```

--------------------------------

### Initialize Double Ratchet for Bob (Header Encryption)

Source: https://signal.org/docs/specifications/doubleratchet

Initializes the Double Ratchet state for Bob using shared secrets and Diffie-Hellman key pairs. This function prepares Bob's state for receiving and sending encrypted messages.

```python
def RatchetInitBobHE(state, SK, bob_dh_key_pair, shared_hka, shared_nhkb):
    state.DHRs = bob_dh_key_pair
    state.DHRr = None
    state.RK = SK
    state.CKs = None
    state.CKr = None
    state.Ns = 0
    state.Nr = 0
    state.PN = 0
    state.MKSKIPPED = {}
    state.HKs = None
    state.NHKs = shared_nhkb
    state.HKr = None
    state.NHKr = shared_hka
```

--------------------------------

### Initialize Double Ratchet for Alice (Header Encryption)

Source: https://signal.org/docs/specifications/doubleratchet

Initializes the Double Ratchet state for Alice using shared secrets and Diffie-Hellman public keys. This function sets up the necessary keys and counters for secure communication.

```python
def RatchetInitAliceHE(state, SK, bob_dh_public_key, shared_hka, shared_nhkb):
    state.DHRs = GENERATE_DH()
    state.DHRr = bob_dh_public_key
    state.RK, state.CKs, state.NHKs = KDF_RK_HE(SK, DH(state.DHRs, state.DHRr))
    state.CKr = None
    state.Ns = 0
    state.Nr = 0
    state.PN = 0
    state.MKSKIPPED = {}
    state.HKs = shared_hka
    state.HKr = None
    state.NHKr = shared_nhkb
```

--------------------------------

### KeysUnsampled State Send Function

Source: https://signal.org/docs/specifications/mlkembraid

Handles sending messages from the KeysUnsampled state. It generates a new keypair, constructs a header message with a MAC, and transitions to the KeysSampled state.

```python
def KeysUnsampled.Send(state):
  # Generate keypair and header
  (dk, ek_seed, ek_vector) = KEM.KeyGen()
  hek = SHA3-256(ek_seed || ek_vector)
  header = ek_seed || hek
  mac = state.auth.MacHdr(state.epoch, header)
  header_encoder = Encode(header || mac)
  
  # Generate message
  chunk = header_encoder.next_chunk()
  msg = {epoch: state.epoch, type: Hdr, data: chunk}
  
  # Update state
  # Transition (1)
  state = KeysSampled(
    state.epoch, 
    state.auth, 
    dk, 
    ek_seed, 
    ek_vector, 
    hek, 
    header_encoder)
  
  # Return values
  output_key = None
  sending_epoch = state.epoch - 1
  return (msg, sending_epoch, output_key)
```

--------------------------------

### Initialize Triple Ratchet for Alice

Source: https://signal.org/docs/specifications/doubleratchet

Initializes the Triple Ratchet state for Alice using pre-shared secret keys and Bob's public key. This function calls underlying initialization functions for the EC and SCKA states.

```python
def RatchetInitAliceTR(state, SKec, SKscka, bob_dh_public_key):
    RatchetInitAlice(state.ec_state, SKec, bob_dh_public_key)
    RatchetInitSCKA(state.spqr_state, SKscka)
```

--------------------------------

### Initialize Triple Ratchet for Bob

Source: https://signal.org/docs/specifications/doubleratchet

Initializes the Triple Ratchet state for Bob using pre-shared secret keys and Bob's key pair. This function calls underlying initialization functions for the EC and SCKA states.

```python
def RatchetInitBobTR(state, SKec, SKscka, bob_dh_key_pair):
    RatchetInitBob(state.ec_state, SKec, bob_dh_key_pair)
    RatchetInitSCKA(state.spqr_state, SKscka)
```

--------------------------------

### Calculate Twisted Edwards Key Pair from Montgomery Private Key

Source: https://signal.org/docs/specifications/xeddsa

Generates a twisted Edwards public key (A) and private key (a) from a Montgomery private key (k). It ensures the public key's sign bit is zero, adjusting the private key if necessary.

```pseudocode
calculate_key_pair(k):
 E = kB
 A.y = E.y
 A.s = 0
 if E.s == 1:
  a = -k (mod q)
 else:
  a = k (mod q)
 return A, a
```

--------------------------------

### Initialize Bob's SCKA State

Source: https://signal.org/docs/specifications/doubleratchet

Initializes Bob's state for the SCKA protocol using an initial shared secret key. Note the reordering of sender and receiver chain keys compared to Alice's initialization.

```python
def RatchetInitBobSCKA(state, SK):
  state.scka_state = SCKAInitBob(SK)
  state.direction = B2A
  state.RK, CKr, CKs = KDF_SCKA_INIT(SK) # note the reordering of CKs and CKr
  state.epoch = 0
  state.kdfchains = {}
  state.kdfchains[0] = {}
  state.MKSKIPPED = {}
  state.kdfchains[0].send = KDFChain(CKs)
  state.kdfchains[0].receive = KDFChain(CKr)
```

--------------------------------

### Perform Diffie-Hellman Ratchet Step

Source: https://signal.org/docs/specifications/doubleratchet

Updates the Diffie-Hellman keys and re-seeds the sending and receiving chain keys based on a new Diffie-Hellman exchange with the received header's public key.

```python
def DHRatchet(state, header):
    state.PN = state.Ns
    state.Ns = 0
    state.Nr = 0
    state.DHr = header.dh
    state.RK, state.CKr = KDF_RK(state.RK, DH(state.DHs, state.DHr))
    state.DHs = GENERATE_DH()
    state.RK, state.CKs = KDF_RK(state.RK, DH(state.DHs, state.DHr))
```

--------------------------------

### KeysSampled State Send Function

Source: https://signal.org/docs/specifications/mlkembraid

Sends the next chunk of the header message from the KeysSampled state. This continues until the complete header has been transmitted.

```python
def KeysSampled.Send(state):
  # Generate next header chunk
  chunk = state.header_encoder.next_chunk()
  msg = {epoch: state.epoch, type: Hdr, data: chunk}
  
  # Return values
  output_key = None
  sending_epoch = state.epoch - 1
  return (msg, sending_epoch, output_key)
```

--------------------------------

### EkReceivedCt1Sampled State Send and Receive Logic

Source: https://signal.org/docs/specifications/mlkembraid

Handles sending ct1 chunks and receiving acknowledgments in the EkReceivedCt1Sampled state. It completes encapsulation upon receiving an acknowledgment and transitions to Ct2Sampled.

```python
def EkReceivedCt1Sampled.Send(state):
  # Generate next ct1 chunk
  chunk = state.ct1_encoder.next_chunk()
  msg = {epoch: state.epoch, type: Ct1, data: chunk}
  
  # Return values
  output_key = None
  sending_epoch = state.epoch - 1
  return (msg, sending_epoch, output_key)

def EkReceivedCt1Sampled.Receive(state, msg):
  output_key = None
  receiving_epoch = state.epoch - 1
  
  if msg.epoch == state.epoch and msg.type == EkCt1Ack:
      # Complete encapsulation
      ct2 = KEM.Encaps2(
        state.encaps_secret, state.ek_seed, state.ek_vector)
      mac = state.auth.MacCt(state.epoch, state.ct1 || ct2)
      ct2_encoder = Encode(ct2 || mac)
      
      # Update state
      # Transition (12)
      state = Ct2Sampled(state.epoch, state.auth, ct2_encoder)
  
  return (receiving_epoch, output_key)
```

--------------------------------

### Double Ratchet Receive Key Update

Source: https://signal.org/docs/specifications/doubleratchet

Modifies the Double Ratchet's receive key generation to handle epoch advancements. It calls SealPrevReceivingChain when a new epoch begins, using the PN from the header.

```python
def SCKARatchetReceiveKey(state, header):
    receiving_epoch, key_epoch, key = SCKAReceive(state.scka_state, header.msg)
    if receiving_epoch > state.receiving_epoch:
        assert receiving_epoch == state.receiving_epoch + 1
        SealPrevReceivingChain(state, header.PN)
        state.receiving_epoch = receiving_epoch
    # remainder of the function is unchanged.

```

--------------------------------

### Ct1Received State Send and Receive Logic

Source: https://signal.org/docs/specifications/mlkembraid

Handles sending ek_vector chunks with acknowledgment and receiving Ct2 messages. Transitions to EkSentCt1Received upon receiving a complete Ct2.

```python
def Ct1Received.Send(state):
  # Generate next ek_vector chunk with acknowledgment
  chunk = state.ek_encoder.next_chunk()
  msg = {epoch: state.epoch, type: EkCt1Ack, data: chunk}
  
  # Return values
  output_key = None
  sending_epoch = state.epoch - 1
  return (msg, sending_epoch, output_key)
```

```python
def Ct1Received.Receive(state, msg):
  output_key = None
  receiving_epoch = state.epoch - 1
  
  if msg.epoch == state.epoch and msg.type == Ct2:
      # Initialize ct2 decoder
      ct2_decoder = Decoder.new(KEM.CT2_SIZE + MAC_SIZE)
      ct2_decoder.add_chunk(msg.data)
      
      # Update state
      # Transition (4)
      state = EkSentCt1Received(
        state.epoch, 
        state.auth, 
        state.dk, 
        state.ct1, 
        ct2_decoder)
  
  return (receiving_epoch, output_key)
```

--------------------------------

### Hash to Point Function

Source: https://signal.org/docs/specifications/xeddsa

Converts a byte sequence into an Edwards point on the curve. This involves hashing the input, mapping the hash to a Montgomery u-coordinate using Elligator 2, converting to an Edwards point, and multiplying by the cofactor.

```pseudocode
hash_to_point(**X**):
  h = hash2(**X**)
  r = h (mod 2|p|)
  s = floor((h mod 2b) / 2b-1)
  u = elligator2(r)
  P.y = u_to_y(u)
  P.s = s
  return cP
```

--------------------------------

### Ct1Sampled State Send and Receive Logic

Source: https://signal.org/docs/specifications/mlkembraid

Handles sending chunks of ct1 and receiving ek_vector chunks or acknowledgments in the Ct1Sampled state. It manages transitions based on the order of received data and acknowledgments.

```python
def Ct1Sampled.Send(state):
  # Generate next ct1 chunk
  chunk = state.ct1_encoder.next_chunk()
  msg = {epoch: state.epoch, type: Ct1, data: chunk}
  
  # Return values
  output_key = None
  sending_epoch = state.epoch - 1
  return (msg, sending_epoch, output_key)

def Ct1Sampled.Receive(state, msg):
  output_key = None
  receiving_epoch = state.epoch - 1
  
  if msg.epoch == state.epoch and msg.type == Ek:
      # Add ek_vector chunk
      state.ek_decoder.add_chunk(msg.data)
      
      # Check if ek_vector is complete
      if state.ek_decoder.has_message():
          ek_vector = state.ek_decoder.message()
          
          # Verify ek_vector integrity
          if SHA3-256(state.ek_seed || ek_vector) != state.hek:
              raise Error("EK integrity check failed")
          
          # Update state
          # Transition (10)
          state = EkReceivedCt1Sampled(
            state.epoch, 
            state.auth, 
            state.encaps_secret,
            state.ct1, 
            state.ek_seed, 
            ek_vector, 
            state.ct1_encoder)
  
  elif msg.epoch == state.epoch and msg.type == EkCt1Ack:
      # Add ek_vector chunk (with acknowledgment)
      state.ek_decoder.add_chunk(msg.data)
      
      # Check if ek_vector is complete
      if state.ek_decoder.has_message():
          ek_vector = state.ek_decoder.message()
          
          # Verify ek_vector integrity
          if SHA3-256(state.ek_seed || ek_vector) != state.hek:
              raise Error("EK integrity check failed")
          
          # Complete encapsulation
          ct2 = KEM.Encaps2(
            state.encaps_secret, state.ek_seed, ek_vector)
          mac = state.auth.MacCt(state.epoch, state.ct1 || ct2)
          ct2_encoder = Encode(ct2 || mac)
          
          # Update state
          # Transition (9)
          state = Ct2Sampled(state.epoch, state.auth, ct2_encoder)
      else:
          # Update state
          # Transition (8)
          state = Ct1Acknowledged(
            state.epoch, 
            state.auth, 
            state.encaps_secret,
            state.ek_seed, 
            state.hek, 
            state.ct1, 
            state.ek_decoder)
  
  return (receiving_epoch, output_key)
```

--------------------------------

### Perform Diffie-Hellman Ratchet Step

Source: https://signal.org/docs/specifications/doubleratchet

Executes the Diffie-Hellman ratchet step for the Double Ratchet algorithm. This involves updating keys and counters after a successful decryption that requires a DH ratchet.

```python
def DHRatchetHE(state, header):
    state.PN = state.Ns
    state.Ns = 0
    state.Nr = 0
    state.HKs = state.NHKs
    state.HKr = state.NHKr
    state.DHRr = header.dh
    state.RK, state.CKr, state.NHKr = KDF_RK_HE(state.RK, DH(state.DHRs, state.DHRr))
    state.DHRs = GENERATE_DH()
    state.RK, state.CKs, state.NHKs = KDF_RK_HE(state.RK, DH(state.DHRs, state.DHRr))
```

--------------------------------

### KeysSampled State Receive Function

Source: https://signal.org/docs/specifications/mlkembraid

Handles receiving messages in the KeysSampled state. Upon receiving a Ct1 message, it initializes the ciphertext decoder and transitions to the HeaderSent state.

```python
def KeysSampled.Receive(state, msg):
  output_key = None
  receiving_epoch = state.epoch - 1
  
  if msg.epoch == state.epoch and msg.type == Ct1:
      # Initialize ct1 decoder and ek encoder
      ct1_decoder = Decoder.new(KEM.CT1_SIZE)
      ct1_decoder.add_chunk(msg.data)
      ek_encoder = Encode(state.ek_vector)
      
      # Update state
      # Transition (2)
      state = HeaderSent(
        state.epoch, 
        state.auth, 
        state.dk, 
        ct1_decoder, 
        ek_encoder)
  
  return (receiving_epoch, output_key)
```

--------------------------------

### Try Skipped Message Keys in SCKA

Source: https://signal.org/docs/specifications/doubleratchet

Attempts to retrieve a message key from the skipped message keys cache for a given epoch and message number. Returns None if the key is not found.

```python
def TrySkippedMessageKeys(state, key_epoch, n):
    if key_epoch in state.MKSKIPPED and n in state.MKSKIPPED[key_epoch]:
        mk = state.MKSKIPPED[key_epoch][n]
        del state.MKSKIPPED[key_epoch][n]
        if len(state.MKSKIPPED[key_epoch]) == 0:
            del state.MKSKIPPED[key_epoch]
        return mk
    else:
        return None
```

--------------------------------

### Elligator 2 Mapping Function

Source: https://signal.org/docs/specifications/xeddsa

Implements the Elligator 2 mapping from an integer r to a Montgomery u-coordinate. It uses modular arithmetic and the Legendre symbol to ensure a valid mapping.

```pseudocode
elligator2(r):
  u1 = -A * inv(1 + nr2) (mod p)
  w1 = u1(u12 + Au1 + 1) (mod p)
  if w1(p-1)/2 == -1 (mod p):
    u2 = -A - u1 (mod p)
    return u2
  return u1
```

--------------------------------

### KeysUnsampled State Receive Function

Source: https://signal.org/docs/specifications/mlkembraid

Handles receiving messages in the KeysUnsampled state. This state ignores all incoming messages, as specified by the protocol.

```python
def KeysUnsampled.Receive(state, msg):
  # No action taken
  output_key = None
  receiving_epoch = state.epoch - 1
  return (receiving_epoch, output_key)
```

--------------------------------

### HeaderReceived State - Receive Function

Source: https://signal.org/docs/specifications/mlkembraid

Handles receiving messages in the HeaderReceived state. No action is taken in this state as the agent is waiting to send ct1.

```python
def HeaderReceived.Receive(state, msg):
  # No action taken
  output_key = None
  receiving_epoch = state.epoch - 1
  return (receiving_epoch, output_key)
```

--------------------------------

### VXEdDSA Verify Pseudocode

Source: https://signal.org/docs/specifications/xeddsa

Pseudocode for the vxeddsa_verify function, which verifies a VXEdDSA signature and returns the VRF output if valid. It takes a public key component (u), message (M), and a VXEdDSA signature (V || h || s) as input.

```pseudocode
vxeddsa_verify(u , M , (V || h || s)):
 if u >= p or V.y >= 2|p| or h >= 2|q| or s >= 2|q|:
 return false
 A = convert_mont(u)
 Bv = hash_to_point(A || M)
 if not on_curve(A) or not on_curve(V):
 return false
 if cA == I or cV == I or Bv == I:
 return false
 R = sB - hA
 Rv = sBv - hV
 hcheck = hash4(A || V || R || R v || M) (mod q)
 if bytes_equal(h , h check):
 v = hash5(cV) (mod 2b)
 return v
 return false
```

--------------------------------

### EkSentCt1Received State Send and Receive Logic

Source: https://signal.org/docs/specifications/mlkembraid

Handles no outgoing data and receiving Ct2 messages. Decapsulates the shared secret and transitions to NoHeaderReceived upon successful Ct2 reception and verification.

```python
def EkSentCt1Received.Send(state):
  # No data to send
  msg = {epoch: state.epoch, type: None}
  
  # Return values
  output_key = None
  sending_epoch = state.epoch - 1
  return (msg, sending_epoch, output_key)
```

```python
def EkSentCt1Received.Receive(state, msg):
  output_key = None
  receiving_epoch = state.epoch - 1
  
  if msg.epoch == state.epoch and msg.type == Ct2:
      # Add chunk to decoder
      state.ct2_decoder.add_chunk(msg.data)
      
      # Check if ct2 is complete
      if state.ct2_decoder.has_message():
          ct2_with_mac = state.ct2_decoder.message()
          ct2 = ct2_with_mac[:KEM.CT2_SIZE]
          mac = ct2_with_mac[KEM.CT2_SIZE:]
          
          # Decapsulate shared secret
          ss = KEM.Decaps(state.dk, state.ct1, ct2)
          ss = KDF_OK(ss, state.epoch)
          
          # Update authenticator and verify MAC
          state.auth.Update(state.epoch, ss)
          state.auth.VfyCt(state.epoch, state.ct1 || ct2, mac)
          
          # Prepare for next epoch
          header_decoder = Decoder.new(KEM.HEADER_SIZE + MAC_SIZE)
          
          # Update state and return key
          # Transition (5)
          state = NoHeaderReceived(
            state.epoch + 1, 
            state.auth, 
            header_decoder)
          output_key = (state.epoch - 1, ss)
  
  return (receiving_epoch, output_key)
```

--------------------------------

### Double Ratchet Send Key Update

Source: https://signal.org/docs/specifications/doubleratchet

Modifies the Double Ratchet's send key generation to handle epoch advancements. It calls SealPrevSendingChain when a new epoch begins.

```python
def SCKARatchetSendKey(state):
    msg, sending_epoch, key_epoch, key = SCKASend(state.scka_state)
    if sending_epoch > state.sending_epoch:
        assert sending_epoch == state.sending_epoch + 1
        SealPrevSendingChain(state)
        state.sending_epoch = sending_epoch
    # remainder of the function is unchanged
    # ...

```

--------------------------------

### NoHeaderReceived State - Send Function

Source: https://signal.org/docs/specifications/mlkembraid

Handles sending messages in the NoHeaderReceived state. No data is sent in this state.

```python
def NoHeaderReceived.Send(state):
  # No data to send
  msg = {epoch: state.epoch, type: None}
  
  # Return values
  output_key = None
  sending_epoch = state.epoch - 1
  return (msg, sending_epoch, output_key)
```

--------------------------------

### HeaderReceived State - Send Function

Source: https://signal.org/docs/specifications/mlkembraid

Handles sending messages in the HeaderReceived state. Computes shared secret, generates ct1, and transitions to Ct1Sampled state.

```python
def HeaderReceived.Send(state):
  # Generate shared secret and ct1
  (encaps_secret, ct1, ss) = KEM.Encaps1(state.ek_seed, state.hek)
  ss = KDF_OK(ss, state.epoch)
  
  # Update authenticator
  state.auth.Update(state.epoch, ss)
  
  # Encode ct1 for transmission
  ct1_encoder = Encode(ct1)
  chunk = ct1_encoder.next_chunk()
  msg = {epoch: state.epoch, type: Ct1, data: chunk}
  
  # Update state
  # Transition (7)
  state = Ct1Sampled(
    state.epoch, 
    state.auth, 
    state.ek_seed, 
    state.hek, 
    encaps_secret, 
    ct1, 
    ct1_encoder, 
    state.ek_decoder)
  
  # Return values
  output_key = (state.epoch, ss)
  sending_epoch = state.epoch - 1
  return (msg, sending_epoch, output_key)
```

--------------------------------

### Domain-Separated Hash Function

Source: https://signal.org/docs/specifications/xeddsa

Defines a family of hash functions (hashi) used for cryptographic domain separation in XEdDSA. Each function applies a cryptographic hash to an input byte sequence, prepended with a specific byte sequence derived from 'i'.

```pseudocode
hashi(X):
 return hash(2^b - 1 - i || X)
```

--------------------------------

### Encrypt Message with Triple Ratchet

Source: https://signal.org/docs/specifications/doubleratchet

Encrypts a plaintext message using the Triple Ratchet protocol. It retrieves message keys from both ratchets, combines them using a KDF, and constructs a composite header before encryption.

```python
def TripleRatchetEncrypt(state, plaintext, AD):
    ecNs, ec_mk = RatchetSendKey(state.ec_state)
    scka_msg, pqN, pq_mk = SCKARatchetSendKey(state.spqr_state)
    mk = KDF_HYBRID(ec_mk, pq_mk)
    header.ec_header = HEADER(state.ec_state.DHs, state.ec_state.PN, ecNs)
    header.scka_header = SCKA_HEADER(scka_msg, pqN)
    return header, ENCRYPT(mk, plaintext, CONCAT(AD, header))
```

--------------------------------

### Convert Montgomery u-coordinate to Twisted Edwards Point

Source: https://signal.org/docs/specifications/xeddsa

Converts a Montgomery u-coordinate to a twisted Edwards point by applying a birational map and setting the sign bit to zero. This is used for public key representation.

```pseudocode
convert_mont(u):
 ummasked = u (mod 2|p|)
 P.y = u_to_y(umasked)
 P.s = 0
 return P
```
Tokens:
Raw