prekey

A prekey, in modern cryptography and secure messaging, is a cryptographic key that is published or made available ahead of time to enable secure communication with a party that may be offline at the moment of initiation. The concept supports asynchronous key agreement by allowing a sender to establish a secure session without requiring real-time participation from the recipient.

In practice, secure messaging protocols often organize prekeys into a prekey bundle. A typical bundle includes an identity key (a long-term public key), a signed prekey (a long-term public key signed by the identity key and rotated periodically), and a set of one-time prekeys (ephemeral keys intended for single use). A server or directory may store these prekeys so that an initiator can retrieve them when starting a conversation.

How prekeys are used is generally described by key agreement schemes such as the Extended Triple Diffie-Hellman (X3DH). The initiator uses their own ephemeral and static keys in combination with the recipient’s prekeys to compute a shared secret. This enables the first message to be encrypted in a way that the recipient can later decrypt, even if they were offline when the session began. One-time prekeys, when available, provide additional forward secrecy and unlinkability because they are consumed after use.

Security considerations include reliance on the availability and integrity of the prekey server and the proper rotation and revocation of keys. If prekeys are compromised or mismanaged, it can undermine the confidentiality guarantees of the session. The concept is used in several secure messaging systems and is central to enabling asynchronous, forward-secure communication.