Post-quantum key agreement

At the heart of modern messaging apps lies a key exchange protocol. Whether it’s Signal, WhatsApp, or Facebook Messenger, all rely on end-to-end encryption to ensure confidentiality. For this encryption to work, both parties must first share a secret key used for encrypting and decrypting messages.

The most widely used method for key exchange is the Diffie-Hellman protocol. However, with the growing threat of quantum computers, this approach is no longer possible, as quantum algorithms can efficiently recover the shared secret key used for end-to-end encryption. This poses direct threats to users, as both all their messages can be read, and adversaries can impersonate the user.
On one hand, this threat may seem not as drastic, because the chance that someone with a quantum computer attacking your own device is relatively small. However, this is not just a threat to everyone, but also to governments and protest groups in non-democratic countries fearing surveillance.

To address this, researchers have explored alternative key exchange mechanisms over the past decades. One promising approach relies on lattice-based cryptography, which provides security based on mathematical problems believed to be resistant to quantum attacks.

While establishing a shared key is a requirement to secure messaging, there are other privacy aspects to consider. Apps like Signal offer a range of security properties that must be preserved when transitioning to new cryptographic protocols. One of these is deniability. Deniability ensures that there is no proof of having initiated a communication with another party. For protest groups this means that there is no way to digitally figure out who sent messages within that group pre-venting identification of protest leaders.

Although there is growing motivation to develop such secure alternatives, challenges remain in designing protocols that meet all these requirements.
The goal is to develop protocols that are strongly security against quantum threats and preserve ideal properties needed for modern messengers while still being run on classical devices like a smartphone.