On February 21, 2024, Apple's Security Engineering and Architecture team published a long technical post on security.apple.com titled "iMessage with PQ3: The new state of the art in quantum-secure messaging at scale". The post described a major upgrade to iMessage's end-to-end encryption that Apple started rolling out to all users running iOS 17.4, iPadOS 17.4, macOS 14.4, and watchOS 10.4. The new protocol, named PQ3, replaced iMessage's previous Elliptic Curve key agreement with a hybrid post-quantum design that combines classical Curve25519 with ML-KEM-1024.
PQ3 is more aggressive than Signal's PQXDH in two important ways. First, it uses ML-KEM-1024 (NIST level 5) rather than ML-KEM-768. Second, and more importantly, it does not stop at the initial handshake. PQ3 introduces periodic post-quantum re-keying throughout the conversation lifetime, so even if a ratchet step is compromised, the next re-key restores quantum resistance. This matters for the harvest-now-decrypt-later threat in a stronger way than PQXDH's single-handshake design.
This article walks through PQ3 in plain English, focusing on what is novel and what is shared with other PQ messaging designs.
The Three Tiers of PQ3 Cryptography
Apple describes PQ3 as having "Level 3 security" using their own naming. The Apple post explains it as three concurrent ratchets running in parallel:
The Identity ratchet, which uses long-term identity keys to authenticate the initial handshake. This is hybrid Ed25519 + ML-DSA.
The Forward Secrecy ratchet, which is the per-message symmetric chain. This produces unique per-message keys and is the same idea as Signal's symmetric ratchet.
The Post-Compromise Security ratchet, which is a separate hybrid Curve25519 + ML-KEM-1024 ratchet that runs alongside the message chain and refreshes every few exchanges.
The "Level 3" name comes from Apple's internal classification system, which is broadly: Level 1 = no end-to-end (simple TLS), Level 2 = end-to-end with classical crypto (X3DH-style), Level 3 = end-to-end with hybrid PQ initial keying plus periodic PQ refresh.
Compared to PQXDH, the difference is the periodic PQ refresh in the third ratchet. Signal's PQXDH protects the initial handshake with hybrid PQ, but the Double Ratchet that follows uses only Curve25519 for its asymmetric step. PQ3 instead runs a parallel hybrid PQ ratchet so the conversation never goes long without a fresh ML-KEM exchange.
The Initial Handshake
The PQ3 initial handshake is conceptually similar to PQXDH but not identical. Each iMessage account has:
A long-term Identity key, which is a hybrid Ed25519 + ML-DSA-65 keypair (the ML-DSA component is the only PQ component used for signing).
A periodically rotated Pre-Key, which is a hybrid Curve25519 + ML-KEM-1024 keypair, signed by the identity key.
A pool of one-time Pre-Keys, which are also hybrid Curve25519 + ML-KEM-1024 keypairs, signed by the identity key.
When Alice sends her first message to Bob, her device fetches Bob's pre-key bundle from Apple's identity server. The bundle includes Bob's identity public keys, his current signed pre-key (both Curve25519 and ML-KEM components), and one one-time pre-key (both components).
Alice generates an ephemeral Curve25519 keypair, performs the X3DH-style four DH operations, and additionally encapsulates with ML-KEM-1024 against Bob's PQ pre-key public keys. The four DH outputs and the two KEM secrets are concatenated and run through HKDF-SHA-512 to produce the initial root key.
Note the SHA-512: PQ3 uses SHA-512 throughout rather than SHA-256, giving more room for the much larger inputs (ML-KEM-1024 secrets are 32 bytes each like SHA-512 outputs but the framing benefits from the wider hash).
The first message from Alice to Bob includes Alice's ephemeral public key, the ML-KEM ciphertexts, and the encrypted message itself. Bob decrypts and the conversation begins.
The Periodic PQ Re-Keying
This is the key innovation of PQ3 over PQXDH. After the initial handshake, the standard Signal Double Ratchet runs as usual: every direction switch produces a fresh Curve25519 DH and the symmetric chain advances per message. But periodically, one side initiates a PQ re-key.
In a PQ re-key, the initiator generates a fresh ML-KEM-1024 keypair, signs the public key with its identity key, and sends the public key in a special message frame. The responder generates a fresh encapsulation against that public key, derives a new shared secret, and mixes it into the ratchet's root key. From that point forward, the ratchet's root key is fed by both the ongoing Curve25519 DH chain and the fresh ML-KEM secret.
The re-key cadence is described by Apple as "every several minutes" of active conversation, though the exact threshold is not public. The cost is one ML-KEM-1024 ciphertext (1568 bytes) per re-key per direction. Compared to a typical iMessage's payload, this is significant but tolerable for the security gain.
The benefit is that even if a quantum attacker recovered one Curve25519 DH ratchet step, the next PQ re-key restores quantum-resistance. The attacker can no longer follow the conversation forward indefinitely. They get a window of plaintext between PQ re-keys and then are locked out.
The Three Concurrent Ratchets in Detail
Apple's diagram in their PQ3 post shows three ratchets running together:
- The Curve25519 Diffie-Hellman ratchet, which is the standard Signal-style asymmetric step on every direction switch. This ratchet runs frequently (often every message in a busy conversation).
- The ML-KEM-1024 ratchet, which runs every several minutes or every several messages, whichever comes first. Each step encrypts a fresh ML-KEM ciphertext over the current Curve25519 link.
- The symmetric per-message ratchet, which derives unique encryption keys for each individual iMessage. This is the same idea as Signal's symmetric chain.
The root key is mixed from inputs of all three ratchets. The symmetric per-message keys are the AES-CTR-CBC keys that protect the actual message bytes (Apple uses AES-CTR plus HMAC-SHA-512 in PQ3, similar to classical iMessage but with the larger hash).
The redundancy gives layered protection. Even an attacker who somehow got a fresh ML-KEM secret would still need to follow the Curve25519 DH ratchet. Even an attacker who broke Curve25519 (with a quantum computer) would still need to break ML-KEM-1024 within the re-key window.
Cryptographic Auditing and Formal Verification
Apple commissioned formal verification of PQ3 from outside cryptographers. The post mentions Professor David Basin from ETH Zurich and Professor Felix Günther from IBM Research / ETH Zurich performed independent analyses, including symbolic protocol analysis using the Tamarin prover and computational analysis using the proof technique of Cohn-Gordon et al. for the Signal protocol.
The published reports (which Apple links from their post) confirm that PQ3 maintains the standard messaging protocol security properties: message confidentiality, message integrity, forward secrecy, post-compromise security, and the new property of "post-quantum forward secrecy" — confidentiality holds against an adversary that records traffic now and runs a quantum computer later.
This level of external verification is unusual in production protocols. Signal also published external reviews of PQXDH but PQ3's analysis is more comprehensive in the formal-methods sense.
What PQ3 Does Not Do
PQ3's initial handshake authentication is hybrid Ed25519 + ML-DSA-65. The signature on every iMessage is verified using the sender's identity public key. A future quantum attacker who broke Ed25519 could forge signatures retroactively but the ML-DSA component blocks that.
What PQ3 does not have is a complete replacement of Curve25519 throughout. The Double Ratchet's per-step asymmetric work is still Curve25519 alone. The PQ re-key happens periodically, not on every step. So there is a small window between PQ re-keys where Curve25519 is the only asymmetric protection. The window is bounded by the re-key cadence (several minutes / several messages).
PQ3 also does not address group iMessage. Group iMessage uses a different protocol, sender-key based, similar to WhatsApp's group design. Apple has not publicly described a PQ migration plan for group iMessage.
PQ3 does not protect metadata. Apple's servers see who is messaging whom, when, and how often. The end-to-end protection is for content, not relationship graph. This is a fundamental limitation of any centralized messaging service and is not unique to PQ3.
Rollout
Apple began rolling out PQ3 to users on iOS 17.4 and corresponding macOS / iPadOS / watchOS releases starting in March 2024. The rollout was gradual to allow monitoring for issues and to allow the population of pre-key bundles to accumulate before full activation.
By late 2024 essentially all eligible Apple devices had the PQ3 protocol code. New conversations between two devices both running iOS 17.4 or later automatically use PQ3. Conversations involving older devices fall back to classical iMessage.
The transition is invisible to users. There is no UI indicator showing PQ vs classical (a deliberate choice, similar to Signal's quiet PQXDH rollout). Users do not have to enable anything.
Comparison Table: PQXDH vs PQ3
| Property | Signal PQXDH | Apple PQ3 |
|---|---|---|
| KEM | ML-KEM-768 | ML-KEM-1024 |
| Initial handshake hybrid PQ | Yes | Yes |
| Periodic PQ re-key in ratchet | No | Yes |
| Identity signature | Ed25519 | Ed25519 + ML-DSA-65 hybrid |
| Bulk cipher | AES-256-GCM | AES-CTR + HMAC-SHA-512 |
| KDF | HKDF-SHA-256 | HKDF-SHA-512 |
| Group support | Sender keys (Signal protocol) | Sender keys (separate protocol) |
| External formal verification | Yes (NCC Group, Cure53) | Yes (Basin, Günther) |
| Deployed | September 2023 | March 2024 |
PQ3 is more conservative on parameters (ML-KEM-1024 over ML-KEM-768) and more aggressive on protocol structure (periodic PQ re-key). Both are state-of-the-art in 2024 and 2025. The choice between PQ3-style periodic re-keying and PQXDH-style single-shot hybrid handshakes is a design tradeoff between bandwidth and security margin.
Why ML-KEM-1024 Specifically
Apple chose ML-KEM-1024 for the strongest NIST level (level 5, comparable to AES-256 in classical security). Signal chose ML-KEM-768 (level 3, comparable to AES-192) for size and performance. Both choices are reasonable.
The size cost on Apple's side is real. ML-KEM-1024 ciphertexts are 1568 bytes vs 1088 bytes for ML-KEM-768 — about 50 percent larger. Apple stores per-device pre-key bundles on its identity server. Per-device storage and per-message bandwidth grow accordingly.
Apple's choice signals that they wanted maximum quantum security headroom and were willing to pay the size cost. This makes sense given the long lifetime of iMessage chats — many users keep messages for years on their devices, and the stored content benefits from the strongest possible quantum-era confidentiality.
QNSQY's Connection to PQ3
QNSQY's Business tier uses ML-KEM-1024 (the same parameter as iMessage PQ3) combined with X25519 (the same curve as Curve25519). QNSQY also uses HKDF for key derivation and AES-256-GCM for AEAD. The hybrid principle is identical.
The difference is QNSQY's domain: file encryption rather than streaming messages. QNSQY does not need a ratchet because each file gets a fresh session key. For file-at-rest the static hybrid handshake is sufficient. For streaming messages, the periodic re-keying that PQ3 does is necessary. See Hybrid Encryption and ML-KEM Explained.
Frequently Asked Questions
Do I need to enable PQ3?
No. It activates automatically when both devices in a conversation are running iOS 17.4 or later (and corresponding macOS / iPadOS / watchOS).
Can I see whether a conversation is using PQ3?
Apple does not show an explicit indicator. The contact card shows that the contact's identity key is verified, but it does not distinguish PQ3 from older iMessage. You can infer PQ3 by checking that both devices are on supported OS versions.
Is iMessage now post-quantum-safe?
Yes for content with two devices both on iOS 17.4 or later. The initial handshake is hybrid PQ and the conversation keys are periodically refreshed with hybrid PQ. Older conversations or mixed-version pairs fall back to classical.
Does PQ3 affect SMS-iMessage interop?
When iMessage falls back to SMS (because the recipient is on Android or iMessage is unreachable), the message goes via the carrier in cleartext SMS. PQ3 does not protect SMS at all. iMessage falls back to SMS only when the recipient is unreachable through iMessage.
How often does PQ re-keying happen?
Apple's post says "periodically" without specifying. Reasonable inferences from the published architecture suggest every few minutes of active conversation or every few dozen messages, whichever comes first. The exact threshold is implementation-dependent.
Sources
- Apple Security Engineering and Architecture. "iMessage with PQ3: The new state of the art in quantum-secure messaging at scale." security.apple.com, February 21, 2024. https://security.apple.com/blog/imessage-pq3/
- NIST FIPS 203. "Module-Lattice-Based Key-Encapsulation Mechanism Standard." August 2024. https://csrc.nist.gov/pubs/fips/203/final
- NIST FIPS 204. "Module-Lattice-Based Digital Signature Standard." August 2024. https://csrc.nist.gov/pubs/fips/204/final
- Basin, D., Brzuska, C., Cremers, C., Fischlin, M., Sasse, R., Stebila, D. "A Mechanised Cryptographic Proof of the WireGuard Virtual Private Network Protocol." (Methodology paper for Tamarin-style proofs cited by Apple PQ3 analysis.)
- Signal Foundation. "The PQXDH Key Agreement Protocol." Signal blog, September 19, 2023. https://signal.org/blog/pqxdh/
- Krawczyk, H., Eronen, P. "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)." IETF RFC 5869, May 2010. https://datatracker.ietf.org/doc/html/rfc5869
Related Articles
- Signal PQXDH Deep Dive
- Signal, WhatsApp, iMessage: Quantum-Safe Status
- WhatsApp PQ Status
- Hybrid Encryption: Why Combining Old and New Crypto Is Stronger
- ML-KEM Explained: How NIST's Lattice KEM Works
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.