By Alan in code — 20 Apr 2026 • 9 min read

man 7 Apple_PQ3_encryption_

man 7 Apple_PQ3_encryption

Apple’s PQ3 protocol is one of the biggest cryptographic upgrades ever shipped to iMessage. It adds post quantum protection not just to the first handshake, but throughout the lifetime of a conversation.

This matters because of harvest now, decrypt later attacks. An adversary can record encrypted messages today, then wait for future quantum computers to break older public key cryptography. PQ3 is Apple’s attempt to make that attack useless against iMessage.

introduction

Apple’s PQ3 is a cryptographic protocol that adds post quantum security to iMessage and other Apple services at massive scale.

It shipped with:

iOS 17.4
macOS 14.4
related Apple platform updates in 2024

Apple describes PQ3 as reaching level 3 security. In its taxonomy:

level	meaning
level 0	: no end to end encryption
level 1	: classical end to end encryption, no quantum protection
level 2	: post quantum protection during the initial handshake
level 3	: post quantum protection during the handshake and throughout the conversation

Most messaging apps are level 1. Signal’s PQXDH update reached level 2 by adding a post quantum algorithm to the initial handshake. PQ3 goes further by adding post quantum rekeying throughout the message exchange.

The core goal is simple:

protect today’s encrypted messages from attackers who record them now and try to decrypt them later with a quantum computer.

PQ3 combines classical elliptic curve cryptography with post quantum lattice based cryptography. The result is a hybrid system where breaking only one side should not be enough to decrypt the conversation.

cryptographic design

PQ3 starts every new iMessage session with a hybrid key exchange.

That means the sender performs two key agreements in parallel:

a classical elliptic curve Diffie Hellman exchange
a post quantum Kyber key encapsulation

When a sender starts a conversation, their device retrieves the recipient’s public key bundle from Apple’s Identity Directory Service.

Each PQ3 capable device registers two public encryption keys:

key type	algorithm	purpose
classical key	NIST P 256 ECDH	protects against classical attackers
post quantum key	Kyber KEM	protects against future quantum attackers

These keys are signed by the device’s Secure Enclave using ECDSA P 256 and tied to the user’s account identity and protocol version. This helps prevent spoofing and downgrade attacks.

initial handshake

The sender does two things.

1. classical ECDH

The sender generates an ephemeral P 256 key pair and computes a shared secret with the recipient’s static P 256 public key.

2. post quantum KEM

The sender uses the recipient’s Kyber public key to encapsulate a random secret. This produces a ciphertext that only the recipient’s Kyber private key can decapsulate.

The first message includes:

the sender’s ephemeral P 256 public key
the Kyber ciphertext

The recipient uses these values to derive the same two shared secrets.

key derivation

Apple combines both shared secrets using HKDF with SHA 384.

The rough structure is:

ECDH shared secret
        +
Kyber shared secret
        +
session metadata
        ↓
HKDF SHA 384
        ↓
initial session key material

The important property is that the session key depends on both the classical and post quantum components.

An attacker would need to break both:

elliptic curve Diffie Hellman
Kyber’s lattice based KEM

This is the hybrid security guarantee. PQ3 should not become weaker than the old classical protocol, even if one of the two cryptographic assumptions fails.

Apple uses:

phase	algorithm
initial post quantum exchange	Kyber 1024
classical exchange	P 256
key derivation	HKDF SHA 384

Kyber 1024 gives Apple a larger security margin for long lived static keys. P 256 gives 128 bit classical security. Combined through HKDF, the session is secure as long as either the classical or post quantum side remains unbroken.

session key ratcheting and self healing

PQ3 does not stop at the first handshake. It extends the Signal style double ratchet with post quantum rekeying.

Once a secure session exists, PQ3 keeps injecting fresh key material so that the conversation can recover even if some device state is compromised.

PQ3 effectively uses a triple ratchet:

symmetric ratchet
classical ECDH ratchet
post quantum KEM ratchet

symmetric ratchet

Every message gets a fresh message key derived from the previous key using HKDF SHA 384.

After a message key is used, it is deleted.

This gives forward secrecy:

if an attacker compromises the device later, they should not be able to decrypt old messages whose keys were already erased.

PQ3 uses 256 bit symmetric keys, which gives a safety margin even against Grover’s algorithm.

ECDH ratchet

PQ3 also includes a classical elliptic curve ratchet.

With every outgoing message, the sender includes a new ephemeral P 256 public key. This adds about 32 bytes of overhead per message.

The new ECDH shared secret is mixed into the session state through HKDF.

This gives classical post compromise security:

if an attacker steals the current session state, the conversation can recover after new ECDH ratchet material is exchanged.

post quantum KEM ratchet

PQ3 adds a Kyber based ratchet on top of the classical ratchet.

Periodically, the sender generates a one time Kyber key pair, encapsulates a secret, and sends the new Kyber public key plus ciphertext in band.

The recipient decapsulates the ciphertext, and both sides mix the resulting secret into the session state.

This gives post quantum post compromise security:

even if an attacker records traffic and later compromises a device, they should not be able to decrypt messages after the most recent post quantum rekey.

Apple uses Kyber 768 for these ratchet steps. It is smaller than Kyber 1024 and sufficient for ephemeral one time rekeying.

This is one of PQ3’s most important differences from Signal’s PQXDH. Signal adds post quantum security to the initial handshake. PQ3 also adds post quantum security to the ongoing ratchet.

cryptographic primitives and overhead

phase	component	algorithm	size / overhead	purpose
initial key exchange	classical DH	P 256 ECDH	32 byte public key	classical shared secret
initial key exchange	post quantum KEM	Kyber 1024	1568 byte public key, 1568 byte ciphertext	post quantum shared secret
session key derivation	KDF	HKDF SHA 384	48 byte output	combines ECDH and Kyber secrets
message ratchet	symmetric ratchet	HKDF SHA 384	32 byte AES 256 key	forward secrecy per message
classical ratchet	ECDH	ephemeral P 256	32 bytes per message	classical post compromise recovery
post quantum ratchet	KEM	Kyber 768	about 2.2 KB per rekey	quantum resistant self healing
encryption	cipher	AES 256 CTR	16 byte IV plus ciphertext	encrypts message payload
authentication	signature	ECDSA P 256	64 bytes per signature	authenticates message sender

PQ3 balances security and performance by making the cheap ECDH ratchet happen frequently, while making the larger Kyber ratchet happen periodically.

implementation in iMessage and Apple’s ecosystem

Apple integrated PQ3 into iMessage without requiring user action.

When an iMessage device comes online, it generates:

a P 256 key pair
a Kyber 1024 KEM key pair

The private keys remain on device. The public keys are uploaded to Apple’s Identity Directory Service with:

timestamp
protocol version
device signatures
account identity binding

This lets other devices verify that the key bundle is legitimate and that the recipient supports PQ3.

downgrade resistance

The protocol version is part of the signed key bundle. This helps prevent an attacker from replacing a PQ3 capable key bundle with an older non PQ key bundle.

In practice:

if both devices support PQ3, iMessage uses PQ3
if one device is older, iMessage falls back for that device
each device pair negotiates independently

This works because iMessage already sends separate encrypted payloads to each recipient device.

use beyond iMessage

Although PQ3 is mostly discussed as an iMessage feature, it appears to be part of a broader secure messaging layer across Apple services.

Reported uses include:

iMessage
FaceTime
HomeKit
HomePod handoff

The important idea is that Apple did not just patch one app. It built a reusable hybrid encrypted messaging layer across its ecosystem.

message format and compatibility

A PQ3 message includes more metadata than older iMessage messages.

The first message may include:

sender’s ephemeral P 256 public key
Kyber ciphertext for the recipient’s static Kyber key

Regular messages may include:

a new 32 byte ECDH public key
occasionally, a larger Kyber rekey bundle

To reduce metadata leakage, Apple uses padding. This helps hide whether a message contains a post quantum rekey and makes ciphertext lengths less revealing.

Older devices either ignore PQ3 specific fields or receive legacy encrypted payloads depending on capability negotiation.

performance considerations and trade offs

Post quantum cryptography has larger keys than classical elliptic curve cryptography.

For example:

item	approximate size
P 256 public key	32 bytes
Kyber 768 ciphertext	1088 bytes
Kyber 768 public key	1184 bytes
Kyber 768 rekey bundle	about 2.2 KB

Doing a Kyber rekey on every message would be too expensive for a consumer messaging app.

So Apple amortizes the cost.

PQ3 performs a post quantum rekey roughly:

once every 50 messages
or at least once every 7 days in low volume conversations

Most messages only carry the smaller ECDH ratchet overhead. The larger Kyber payload appears occasionally.

example overhead

Suppose Alice and Bob exchange 100 messages.

A classical ratchet might add:

100 × 32 bytes = 3.2 KB

PQ3 might add:

100 × 32 bytes ECDH overhead = 3.2 KB
2 × 2.2 KB Kyber rekeys = 4.4 KB
total = 7.6 KB

That is meaningfully larger than classical only messaging, but still practical.

A naive post quantum ratchet on every message would add:

100 × 2.2 KB = 220 KB

That would be a bad trade off.

PQ3’s design lands in the middle: frequent cheap classical updates, occasional expensive quantum resistant updates.

latency

PQ3 keeps the initial session setup to one round.

The first message carries enough information for the receiver to derive the shared keys immediately. No extra visible handshake is needed.

Apple also uses encrypted delivery receipts to help complete ratchet updates even when the recipient does not manually reply.

The occasional 2 KB Kyber payload may add overhead on bad networks, but because it happens infrequently, users are unlikely to notice.

Kyber operations are also relatively efficient on modern devices, so computation is not the main bottleneck. Bandwidth is the larger concern.

security analysis and community feedback

PQ3 received unusually serious formal analysis before deployment.

Apple worked with outside cryptographers to verify the protocol’s security properties.

The analyses focused on whether PQ3 preserves secrecy even when:

attackers record encrypted traffic
attackers compromise some session state
attackers later gain quantum computing capabilities

The core result is that PQ3’s security reduces to the strength of its underlying primitives. An attacker should not be able to break message confidentiality unless both the classical and post quantum components fail.

what PQ3 does well

PQ3 improves iMessage security in several ways:

protects the first message with a hybrid handshake
adds post quantum protection to ongoing conversations
supports self healing after compromise
uses conservative Kyber parameters
keeps performance practical
integrates with Apple’s key transparency and device identity systems

trade off: deniability

One major difference from Signal style protocols is that Apple signs every message with ECDSA P 256.

This gives strong authentication, but weakens deniability.

In Signal style systems, the protocol is designed so a transcript is harder to prove cryptographically to a third party after the fact. Apple’s message signatures make authorship easier to prove if someone obtains the transcript.

This is not a confidentiality failure, but it is a real design trade off.

remaining limitation: post quantum authentication

PQ3 protects confidentiality against future quantum computers, but it still uses classical ECDSA P 256 signatures for authentication.

That means a sufficiently capable quantum computer could theoretically forge signatures in real time.

This is less urgent than harvest now, decrypt later encryption attacks, because forging signatures requires the attacker to have a quantum computer during the conversation, not years later.

Still, true post quantum authentication would be the next step.

Possible future upgrades could involve:

ML DSA
Dilithium style signatures
other post quantum signature schemes
new deniable post quantum authentication protocols

For now, PQ3 focuses on the more immediate threat: future decryption of messages recorded today.

summary

Apple’s PQ3 is a hybrid post quantum messaging protocol for iMessage and other Apple services.

Its main design idea is simple:

combine classical elliptic curve cryptography with post quantum Kyber, then keep refreshing the session with both classical and post quantum ratchets.

PQ3 improves on earlier messaging protocols by applying post quantum protection not only during the initial handshake, but throughout the conversation.

Its strongest properties are:

hybrid security
forward secrecy
post compromise recovery
post quantum rekeying
practical bandwidth overhead
large scale deployment

Its main trade offs are:

larger message overhead
increased protocol complexity
reduced deniability due to message signatures
no post quantum authentication yet

For users, the upgrade is invisible. For secure messaging, it is a major shift. PQ3 shows that post quantum encryption is no longer just a research topic. It can ship at global scale without turning the app into a slow bloated mess.

sources

Apple Security Engineering and Architecture, “iMessage with PQ3: The new state of the art in quantum secure messaging at scale,” Feb. 2024.
Apple Security Engineering and Architecture, “Security analysis of the iMessage PQ3 protocol,” analysis by Douglas Stebila.
Felix Linker, Ralf Sasse, David Basin, ETH Zürich, “A formal analysis of Apple’s iMessage PQ3 protocol,” 2024.
PQShield Research, “Post quantum messaging: examining Apple’s new PQ3 protocol,” Feb. 2024.
WIRED, “Apple’s iMessage is getting post quantum encryption,” Feb. 21, 2024.
InfoQ, “Apple debuts post quantum cryptography cipher PQ3 for iMessage,” Feb. 29, 2024.
“Apple adds PQ primitives to iMessage,” 2024.
D. Eijkman, “An analysis of Apple’s iMessage PQ3 algorithm using ProVerif,” BSc thesis, Radboud University, 2025.