X3DH protocol - What are One-time prekeys for? I'm reading about Signal Protocol and this protocol uses the X3DH Protocol to establish a shared secret key between the two parties but I couldn't understand why we use one-time prekeys in the flow. This keys are optional and if there is any in the server, in the first message between Bob and Alice, an extra Diffie-Hellman is calculate between this prekey and ephemeral key. What is the advantage of using One-time Prekeys?
The short answer is ‘for forward secrecy’, but that glib term obscures the meaning of the property we hope for.

Suppose Alice sends a message to Bob.  If Alice and Bob both erase the message, what is the time at which all key material that can ever decrypt a transcript of network packets on the wire is erased?

Without prekeys, the following are all the sets of keys that can decrypt the wire transcript:


Alice's long-term identity key $\mathit{IK}_\mathrm A$ and Alice's ephemeral key $\mathit{EK}_\mathrm A$.
Bob's long-term identity key $\mathit{IK}_\mathrm B$ and Bob's long-term signed prekey $\mathit{SPK}_\mathrm B$.


While Alice will erase her ephemeral key immediately, Bob is intended to never erase his long-term identity key—at least, as long he wants to maintain his identity—and to rotate his long-term signed prekey only occasionally so that delayed messages can get through.  Thus, a set of keys that can decrypt the wire transcript can be found on Bob's device long after the message has arrived.

With prekeys, the following are all the sets of keys that can decrypt the wire transcript:


Alice's long-term identity key $\mathit{IK}_\mathrm A$ and Alice's ephemeral key $\mathit{EK}_\mathrm A$.
Bob's long-term identity key $\mathit{IK}_\mathrm B$, Bob's long-term signed prekey $\mathit{SPK}_\mathrm B$, and Bob's one-time prekey $\mathit{OPK}_\mathrm B$.


Alice will again erase her ephemeral key immediately.  Bob won't immediately erase anything, because he might be offline—this is an asynchronous protocol.  But as soon as he receives the message, he will erase his one-time prekey.  Thus, as soon as Bob has processed the message, all sets of keys that can decrypt the wire transcript will be erased.

Of course, Alice or Bob might keep a copy of the message on their respective devices for all eternity.  But one-time prekeys guarantee that they have the option to erase messages without leaving targets on their devices for retroactive decryption of wire transcripts.