The end-to-end encryption used by Signal, WhatsApp and others, now with quantum-safe protection.
The idea: Signal sets up a conversation even when your contact is offline, using keys they uploaded in advance (PQXDH combines X25519 with ML-KEM). After that it keeps "ratcheting": every message moves the keys forward with a one-way function, and replies keep mixing in fresh key-exchange material. A key stolen today can't decrypt yesterday's messages, and the conversation heals itself after a compromise.
Why it matters: Protects billions of private messages.
The details
On the map: PQXDH + triple ratchet: X25519 + ML-KEM hybrid, XEdDSA prekey signatures, AES-CBC + HMAC
End-to-end encryption for Signal, WhatsApp, Google Messages and Facebook Messenger[1].
The first handshake uses PQXDH: X25519 combined with Kyber, the scheme NIST standardized as ML-KEM (since September 2023)[2, 3].
The Double Ratchet gives forward secrecy and recovery after a compromise[4]. A post-quantum "triple ratchet" (SPQR, using ML-KEM) was added in October 2025[5].
Identity keys sign prekeys with XEdDSA[6, 7], an EdDSA variant.
It falls if any part falls, except the hybrid key exchange, which needs both halves to fall.
Nothing on the map depends on it: it is an end point, something people use directly.
References
Katriel Cohn-Gordon, Cas Cremers, Benjamin Dowling et al. A Formal Security Analysis of the Signal Messaging Protocol. 2017 IEEE European Symposium on Security and Privacy (EuroS&P). doi:10.1109/eurosp.2017.27