Alice (Caller) Server (WhatsApp) Bob (Callee)

HKDF : (Key, Info, Salt, i) æ {0, 1}

i◊8

Enck : (m) æ AES-128-ICMk (m)

Authak : (m, j) æ HMAC-SHA1ak (m) œ {0, 1}
j◊8

StreamInit : (Key, IV , Nonce) æ StreamContext

256
ms Ω$ {0, 1}
256
idcall Ω$ {0, 1}
Noise(idcall , idA , idB , Signal(ms))

Noise(idcall , idA , idB , Signal(ms))

kA0 , sA0 Ω HKDF(ms, idA , 0, 46) kA0 , sA0 Ω HKDF(ms, idA , 0, 46)
kA1 , sA1 Ω ? kA1 , sA1 Ω ?
kA2 , sA2 Ω ? kA2 , sA2 Ω ?

nA0 Ω HKDF(idcall , idA , 0, 4) nA0 Ω HKDF(idcall , idA , 0, 4)

nA1 Ω HKDF(idcall , idA , 1, 4) nA1 Ω HKDF(idcall , idA , 1, 4)
nA2 Ω HKDF(idcall , idA , 4, 4) nA2 Ω HKDF(idcall , idA , 4, 4)

akA0 Ω ? akA0 Ω ?
akA1 Ω ? akA1 Ω ?
akA2 Ω ? akA2 Ω ?

cAi Ω EnckAi (mAi )

srtpHeader Ai Ω ssrc Ai , seqAi , t
authA0 Ω AuthakA0 (0, 4)
authA1 Ω AuthakA1 (0, 4)
authA2 Ω AuthakA2 (srtpHeader A2 |cA2 , 10)

streamAi Ω StreamInit(kAi , sAi , nAi ) streamAi Ω StreamInit(kAi , sAi , nAi )

srtpHeader Ai , cAi , authAi

kB0 , sB0 Ω HKDF(ms, idB , 0, 46) kB0 , sB0 Ω HKDF(ms, idB , 0, 46)
kB1 , sB1 Ω ? kB1 , sB1 Ω ?
kB2 , sB2 Ω ? kB2 , sB2 Ω ?

nB0 Ω HKDF(idcall , idB , 0, 4) nB0 Ω HKDF(idcall , idB , 0, 4)

nB1 Ω HKDF(idcall , idB , 1, 4) nB1 Ω HKDF(idcall , idB , 1, 4)
nB2 Ω HKDF(idcall , idB , 4, 4) nB2 Ω HKDF(idcall , idB , 4, 4)

akB0 Ω ? akB0 Ω ?
akB1 Ω ? akB1 Ω ?
akB2 Ω ? akB2 Ω ?

cBi Ω EnckBi (mBi )

srtpHeader Bi Ω ssrc Bi , seqBi , t
authB0 Ω AuthakB0 (0, 4)
authB1 Ω AuthakB1 (0, 4)
authB2 Ω AuthakB2 (srtpHeader B2 |cB2 , 10)

streamBi Ω StreamInit(kBi , sBi , nBi ) streamBi Ω StreamInit(kBi , sBi , nBi )

srtpHeader Bi , cBi , authBi

Figure 6.1: WhatsApp VoIP Protocol