| Speaker: | Rolfe Schmidt |
| Affiliation: | Signal |
| Location: | United College, Room 105 |
Abstract: In 2023 Signal deployed PQXDH, a small change to the handshake that protects new conversations against adversaries who record traffic today and decrypt it with a future quantum computer. Two gaps remain: post-compromise security in the ratchet and authentication in the handshake both still rely on elliptic curves. This talk describes how we closed the first and how we plan to close the second.
In the first part, we look at the challenge of building a post-quantum ratcheted messaging protocol in a bandwidth-constrained setting, and build up Signal’s Sparse Post-Quantum Ratchet, deployed in 2025, step by step through a series of simpler protocols.
In the second part, we look ahead to a new handshake that completes the transition of Signal’s 1:1 messaging with hybrid, deniable authentication. While the post-quantum ratchet feels like an engineering variation on the classical one, the post-quantum key agreement takes a very different shape. Our need to save bandwidth still drives plenty of engineering, including Merkle trees, Falcon signature recovery modes, and context-specific optimizations.
I’ll close with open questions and a brief look at what it will take to make the rest of the Signal app quantum safe.