How Apple is Preparing iMessage for the Quantum Computing Era with PQ3

When you send someone an iMessage today, it's protected by end-to-end encryption. That means only you and the recipient can read the conversation. For years, this level of encryption has been considered highly secure because breaking it would require solving mathematical problems that are practically impossible for today's computers.

But what if tomorrow's computers are fundamentally different? That's exactly the challenge quantum computing introduces.

Although quantum computers capable of breaking today's encryption don't exist yet, security researchers are already preparing for that future. One reason is a threat known as "Harvest Now, Decrypt Later."

The idea is surprisingly simple. An attacker can collect and store encrypted messages today, even if they can't read them. Years later, if powerful enough quantum computers become available, those same encrypted messages could potentially be decrypted.

Apple believes messaging protocols need to start preparing for that possibility now. To address this, Apple introduced PQ3, a new cryptographic protocol for iMessage that protects conversations not only against today's threats but also against future quantum attacks.

According to Apple, PQ3 is the first messaging protocol to achieve what it calls Level 3 security, combining post-quantum protection during both the start of a conversation and throughout the entire messaging session.

So, what exactly makes PQ3 different from previous messaging protocols? Let's understand in this blog today.

Why Quantum Computing is a Problem for Today's Encryption

Most modern messaging applications rely on public key cryptography to establish secure communication between devices. Algorithms such as RSA, Elliptic Curve Cryptography (ECC), and Diffie-Hellman have protected encrypted communication for years because they're based on mathematical problems that are extremely difficult for classical computers to solve.

Quantum computers change that assumption. A sufficiently powerful quantum computer could solve some of these mathematical problems much faster than traditional computers, potentially weakening many of the cryptographic systems used today.

While these quantum computers don't yet exist, attackers don't necessarily have to wait for them before launching an attack. Instead, they can begin collecting encrypted data today and simply keep it until quantum technology becomes capable of decrypting it in the future. This strategy is known as Harvest Now, Decrypt Later. This means that messages sent today could still become valuable targets years from now.

The Evolution of Secure Messaging

To explain where PQ3 fits, Apple describes messaging security as progressing through different levels. Most messaging applications today fall into one of two categories.

Level 0 includes applications that don't provide end-to-end encryption by default and offer no protection against quantum attacks.

Level 1 includes applications that do provide end-to-end encryption, but still rely entirely on classical cryptographic algorithms.

More recently, messaging protocols started introducing post-quantum cryptography. Apple highlights Signal's PQXDH protocol as an important step because it adds post-quantum protection during the initial key establishment between two devices. Apple refers to this as Level 2 security. However, Apple argues that protecting only the beginning of a conversation isn't enough.

Why Initial Protection Alone Isn't Sufficient

When two devices begin a secure conversation, they first establish encryption keys. Those keys are then used to encrypt subsequent messages. The problem is that if an attacker somehow compromises those conversation keys, they may be able to continue decrypting messages until the keys change. In other words, protecting only the first handshake doesn't automatically protect the rest of the conversation.

Apple believes messaging protocols should continuously refresh their cryptographic keys so that even if one key is compromised, only a limited portion of the conversation is exposed. This ability to recover from a compromised key is what Apple refers to as cryptographic self-healing.

That idea became one of the core design goals behind PQ3.

Apple's Goal: Level 3 Security

Rather than simply replacing one encryption algorithm with another, Apple redesigned the iMessage cryptographic protocol around several key objectives.

The new protocol needed to:

• Introduce post-quantum cryptography from the very beginning of a conversation.

• Limit the impact of compromised encryption keys.

• Combine new post-quantum algorithms with existing Elliptic Curve cryptography instead of replacing it completely.

• Keep message sizes practical despite the additional cryptographic information.

• Formally verify the protocol to ensure its security.

Meeting all of these goals resulted in PQ3, which Apple says is the first messaging protocol to reach Level 3 security.

How PQ3 Establishes a Secure Conversation

The first step in any encrypted conversation is allowing two devices to establish a shared secret. To do this, every device using PQ3 generates a new post-quantum public key during iMessage registration.

Apple chose Kyber, a post-quantum key encapsulation algorithm that was selected by NIST as the ML-KEM standard after extensive evaluation by the cryptography community. When someone sends you the first message, your device can obtain these public keys from Apple's Identity Directory Service and immediately establish a quantum-resistant encrypted session even if your device is currently offline. Apple refers to this process as the initial key establishment.

But securing the beginning of a conversation was only half of Apple's solution. The company also wanted conversations to become secure again automatically, even if an encryption key was compromised later.

Building Self-Healing Conversations

One of the biggest innovations in PQ3 is its periodic post-quantum rekeying mechanism. Instead of relying on the same encryption keys throughout an entire conversation, PQ3 periodically introduces fresh cryptographic keys as messages are exchanged. These new keys generate entirely new message encryption keys that cannot be calculated from previous ones.

As a result, even if an attacker somehow obtained an earlier encryption key, future messages would eventually become protected again after the next rekeying event. Apple describes this as giving PQ3 self-healing properties.

To provide even stronger protection, PQ3 uses a hybrid design. Rather than abandoning existing Elliptic Curve Cryptography (ECC), Apple combines it with the new post-quantum cryptography during both the initial key establishment and future rekeying operations.

According to Apple, this means an attacker would need to break both the classical cryptographic algorithms and the post-quantum algorithms to compromise the protocol. However, introducing post-quantum cryptography also comes with a practical challenge. Post-quantum keys are much larger than traditional elliptic curve keys.

Instead of attaching them to every single message, Apple designed PQ3 to perform post-quantum rekeying periodically, balancing stronger security with message size, network efficiency, and overall user experience.

Proving the Protocol is Actually Secure

Designing a secure cryptographic protocol is only part of the challenge. The harder part is proving that it actually provides the security guarantees it claims. To build confidence in PQ3, Apple didn't rely only on internal testing. The company also worked with external cryptography researchers and used formal verification, a mathematical technique used to analyze whether a protocol satisfies specific security properties under different attack scenarios.

According to Apple, this process helped verify important properties such as:

• End-to-end encryption

• Recovery after key compromise

• Protection against future quantum attacks

The protocol was also reviewed by independent cryptography experts before its public release.

How PQ3 Continuously Refreshes Encryption Keys

One of the main ideas behind PQ3 is that encryption shouldn't rely on a single key throughout an entire conversation. Instead, the protocol continuously derives fresh keys as messages are exchanged. Apple achieves this using multiple ratchets.

A ratchet is simply a mechanism that moves the encryption state forward, producing new keys over time. Once the protocol advances, it cannot return to previous keys. This helps limit the impact of a compromised key because future keys are derived independently.

PQ3 combines three different ratchets.

Symmetric Ratchet

The symmetric ratchet generates new encryption keys as messages are exchanged between two devices. This ensures that each message is protected using fresh cryptographic material rather than repeatedly using the same key.

ECDH Ratchet

PQ3 also continues to use Elliptic Curve Diffie-Hellman (ECDH). Whenever both participants contribute new ephemeral keys, the protocol derives fresh shared secrets that strengthen the encryption state.

Apple retains this mechanism because it continues to provide strong protection against classical attacks while complementing the new post-quantum algorithms.

Kyber Ratchet

The biggest addition in PQ3 is the Kyber Ratchet. Unlike previous messaging protocols that use post-quantum cryptography only during the initial key exchange, PQ3 periodically introduces new Kyber key material throughout the conversation.

This means post-quantum protection isn't limited to the beginning of a chat. Instead, it continues as the conversation progresses, allowing the protocol to recover from earlier compromises over time.

Balancing Security and Efficiency

Post-quantum cryptography offers stronger protection, but it also introduces larger cryptographic keys and additional computation. Instead of performing post-quantum rekeying for every message, PQ3 performs it periodically.

According to Apple, this provides a practical balance between stronger security, network efficiency, and message size while still allowing conversations to regularly refresh their cryptographic state.

Protecting Messages Beyond Key Exchange

Establishing secure keys is only one part of protecting a conversation. Apple also explains that PQ3 includes mechanisms for encrypting and authenticating every message after the keys have been established.

The protocol derives message keys using HKDF before encrypting messages with AES-CTR. Authentication is provided separately using HMAC-SHA256, ensuring that messages cannot be modified without detection.

Apple also describes how long-term identity keys remain protected using the Secure Enclave on supported devices, adding another layer of protection for the protocol's identity management.

Source: Apple’s Blog

Looking Ahead

Apple describes PQ3 as an important step toward preparing secure messaging for the quantum computing era. While large-scale quantum computers capable of breaking today's public key cryptography are not yet available, Apple believes messaging systems should begin preparing well before that day arrives.

By combining post-quantum cryptography with existing elliptic curve cryptography, periodically refreshing keys, and formally verifying the protocol, PQ3 is designed to provide stronger long-term protection for iMessage conversations.

Key Takeaways

• Quantum computers may eventually threaten many of today's public key cryptographic algorithms.

• PQ3 is Apple's new iMessage protocol designed to provide protection against both current and future quantum attacks.

• Unlike earlier approaches, PQ3 introduces post-quantum cryptography during both the initial key establishment and throughout the conversation using periodic rekeying.

• Apple combines classical elliptic curve cryptography with post-quantum cryptography instead of replacing one with the other.

• The protocol was formally verified and reviewed by independent cryptography researchers before deployment.

Official blog from Apple: iMessage with PQ3: The new state of the art in quantum-secure messaging at scale

By now, you must have had a clear idea of, How Apple is Preparing iMessage for the Quantum Computing Era with PQ3? In a nutshell, Apple introduced PQ3 to prepare iMessage for the quantum era. By combining post-quantum cryptography, periodic rekeying, and formal verification, PQ3 aims to protect conversations against both today's attacks and future quantum threats.

Congratulations! You've just advanced another step in your tech journey. Keep progressing!