## 4 Proposed Protocol
For more information, see the detailed diagram provided in Figure 4.  
In the final stage of the algorithm, [PERSON] calculates a new key \(K_{1}\) using a symmetric ratchet with the input of the new chain key \(CK_{1}\) and the WT. She stores the key \(K_{1}\) and generates a random key \(T_{Key}\). In the subsequent step, she encrypts the name \"[PERSON]\" and stores it in her database. Additionally, she encrypts the randomly generated key \(T_{Key}\) using the derived key \(K_{1}\) and then deletes the key \(T_{Key}\). The importance of these steps in the proposed protocol is to mitigate the risk of key compromise when [PERSON] is offline or if the device is lost. ### [PERSON]'s Session Setup  
Upon receiving [PERSON]'s data, which consist of [PERSON]'s identity public key, two ephemeral public keys, and the ciphertext corresponding to the randomly generated key, [PERSON] follows the steps outlined in Algorithm 2 to establish a shared key between [PERSON] and [PERSON]. Figure 4: Asymmetric ratchet. Figure 3: Symmetric ratchet. ```
1:Input:\((IDPK_{[PERSON]},EPK_{[PERSON]}^{0},EPK_{[PERSON]}^{1},C_{1})\)\(\triangleright\) Inputs of Algorithm 1 retrieved from the server Output:\((T_{key}^{\prime},NT_{key}^{\prime})\)
2:\(DH_{1}^{\prime}\gets [PERSON](IDPK_{[PERSON]},SSK_{[PERSON]})\)\(\triangleright\) Secret 1 exchange through DH1
3:\(DH_{2}^{\prime}\gets DH(EPK_{[PERSON]}^{0},IDSK_{[PERSON]}))\)\(\triangleright\) Secret 2 exchange through DH2
4:\(DH_{3}^{\prime}\gets DH(EPK_{[PERSON]}^{0},SSK_{[PERSON]})\)\(\triangleright\) Secret 3 exchange through DH3
5:\(DH_{4}^{\prime}\gets DH(EPK_{[PERSON]}^{0},OTSK_{[PERSON]})\)\(\triangleright\) Secret 4 exchange through DH4
6:\(SK^{\prime}\gets KDF(DH_{1}^{\prime}||DH_{2}^{\prime}||DH_{3}^{\prime}||DH_{4}^{ \prime})\)\(\triangleright\) Secret Key generated through DH secrets
7:\(([PERSON]_{0}^{\prime},[PERSON]_{0}^{\prime})\gets HKDF(SK,WT)\)\(\triangleright\) Root Key and Chain Key through
8:\(SK_{1}^{\prime}\gets DH(EPK_{Alice}^{1},SSK_{Bob})\)\(\triangleright\) Updated Secret Key through DH
9:\((RK_{1}^{\prime},CK_{1}^{\prime})\gets HKDF\Big{(}RK_{0}^{\prime},SK_{1}^{ \prime},WT\Big{)}\)\(\triangleright\) Updated Root Key and Chain Key
10:\((K_{1}^{\prime},[PERSON]_{2}^{\prime})\gets KDF(CK_{1}||WT)\)\(\triangleright\) Secret key for Decrypting random key
11:\(T_{key}^{\prime}\gets DEC(C_{1},K_{1}^{\prime})\)\(\triangleright\) The Plaintext \"\(T_{k}\)\"
12:\(NT_{key}=\bot\)
```  
**Algorithm 2** [PERSON]'s Session Setup  
The steps in Algorithm 2 are the same as those given in Algorithm 1. However, in [PERSON]'s session setup, he uses his private key and the public key received from [PERSON] for the XDH. Since the output of both XDH operations is the same, as both parties use their private key and the other party's public key, both parties generate the same root keys and chains through symmetric and asymmetric ratcheting. Consequently, Algorithm 2 correctly outputs the key for decrypting the randomly generated key \(T_{key}\). The detailed corrective analysis is given in the following Lemma 1. **Lemma 1**. : _The output \(T_{key}^{\prime}\) of Algorithm 2 is the same as the randomly generated key \(T_{key}\) produced by [PERSON] in Algorithm 1._  
Proof. : Assume identical parameters \(a,b,and\)\(p\) for \(Curve25519\), _identical DH_, \(ENC\), and \(DEC\) algorithms, and that \(KDF/HKDF\) are employed in both Algorithms 1 and 2. Given that the output of Algorithm 1 is the input for Algorithm 2, and Algorithm 1 produces the public parameters \(PK_{Alice}\) corresponding to the private parameters \(SK_{Alice}\) used in XHD, it follows that for all \(i\), where \(0\leq i\leq 3\), \(DH_{i}=DH_{i}^{\prime}\). This, in turn, implies \(SK=SK^{\prime}\). Consequently, for all \(j\), where \(0\leq j\leq 2\), the root key \(RK_{j}\) and chain key \(CK_{j}\) are equal, i.e., \(RK_{j}=RK_{j}^{\prime}\) and \(CK_{j}=CK_{j}^{\prime}\). This equality extends to the encryption keys, establishing that \(K_{1}=K_{1}^{\prime}\).