Post-Quantum Chats: How Signal and iMessage PQ3 Armored Your Messages

Your iPhone and your Signal app are probably defending your messages against a quantum computer that does not exist yet. Nobody asked you to opt in, and no banner appeared to tell you. The protocols upgraded quietly, and the conversations kept flowing.

Before you read: The NIST standards behind all of this are explained in The Quantum Time Bomb: Why NIST’s New Encryption Standards Can’t Wait. For the browser and server side of the same algorithms, see Your Browser Already Went Quantum-Safe.

Table of contents

• Chat Is Not a Handshake
• Signal’s PQXDH: Stapling Kyber to the Prekey
• The Ratchet Was the Hard Part
• Apple Went All In on PQ3
• Where the Armor Still Has Gaps
• Did You Know
• Sources

Chat Is Not a Handshake

A TLS connection needs both parties online at the same moment, swapping keys over a few round trips. A messenger has no such luxury. You can text a friend whose phone is sitting in a drawer. So Signal and Apple both lean on prekeys: public keys uploaded to a server ahead of time, waiting for someone to start a conversation. Every post-quantum key has to be sitting on that server before anybody needs it. Browser coverage skips this wrinkle entirely, and it changes the whole design.

Signal’s PQXDH: Stapling Kyber to the Prekey

Signal shipped PQXDH in September 2023. It runs X25519 alongside Kyber-1024, the pre-standard name for what became ML-KEM-1024, and feeds both shared secrets into the session key. The Kyber public key is a 1,568-byte blob that the server stores as a signed prekey. Signal also keeps a last-resort post-quantum prekey, so a user who has burned through their one-time keys can still receive a first message. It is a tidy design. The server only ever handles public keys, so it never holds anything worth stealing.

The Ratchet Was the Hard Part

A handshake happens once. A conversation can last years. Signal’s Double Ratchet gives every message a fresh key, so a stolen key exposes very little. Post-quantum protection at the handshake alone leaves the ratchet exposed: an attacker who records today’s traffic and later breaks the classical Diffie-Hellman steps could read everything after the handshake.

Signal’s answer, SPQR, announced in October 2025, adds a post-quantum ratchet next to the classical one, which Signal calls a triple ratchet. The obstacle is size. An ML-KEM-768 ciphertext runs 1,088 bytes, and stuffing that into every message would make chat sluggish on a bad cell connection. So SPQR uses erasure coding to split the payload into fragments and spreads them across ordinary messages. The fresh post-quantum key only takes effect once enough fragments have arrived. That is a clever trade, and a slightly odd one: the conversation has to keep moving for the armor to finish putting itself on.

Apple Went All In on PQ3

Apple announced PQ3 in February 2024 and called it the first messaging protocol to reach what its own framework labels Level 3. The levels are Apple’s invention, which makes the word ‘first’ a claim graded by the company that wrote the rubric. Still, the design is serious. The key exchange combines elliptic-curve Diffie-Hellman on P-256 with ML-KEM-768, and the post-quantum keys are woven into the ratchet from day one instead of arriving as a later patch. Apple says it modeled the protocol with ProVerif, a symbolic verification tool, before shipping.

The detail I like most is the rekeying cadence. PQ3 refreshes its keys periodically during a conversation rather than only at setup, so one compromised moment does not expose the whole thread. Apple’s engineers were not trying to win a theoretical argument. They wanted iMessage to behave like iMessage on a train with one bar of signal.

Where the Armor Still Has Gaps

Here is the part the press releases skip. Neither system hides who talks to whom. Signal’s sealed sender shrinks what the server learns, but timing and connection patterns still leak, and Apple can see the metadata of every iMessage routed through its infrastructure. Post-quantum ciphers do nothing about a snoop who knows you messaged a family lawyer at 2 a.m.

Authentication is the second gap. Signal’s identity keys are still elliptic-curve signatures, so a future quantum attacker who forges them could impersonate a contact during a fresh setup. The defense is the safety-number check, and it is exactly the step most of us never open. Quantum-proofing the cipher does not help much if the verification screen stays closed.

My take: putting post-quantum secrecy on the messages of hundreds of millions of people, without asking anyone, is a real achievement. But calling it quantum-safe messaging describes the secrecy of the message well and says very little about the metadata or the identity of whoever is on the other end.

Did You Know

The Double Ratchet was published by Trevor Perrin and Moxie Marlinspike in 2016, and it now underpins Signal, WhatsApp, and a long list of other apps.

A Kyber-1024 public key at 1,568 bytes is 49 times the size of the 32-byte X25519 public key it sits beside.

Sources

• Signal Blog: ‘Announcing PQXDH’ (September 2023)
• Signal Blog: SPQR post-quantum ratchet announcement (October 2025)
• Apple Security Research Blog: ‘iMessage with PQ3’ (February 2024)
• NIST FIPS 203, ML-KEM (August 2024)
• Trevor Perrin and Moxie Marlinspike, ‘The Double Ratchet Algorithm’ (2016)