The ratchet is the hard part

Nothing about post-quantum messaging is urgent in the way a live exploit is urgent, which is exactly what makes it easy to postpone. Signal's 2023 announcement says why postponing is the wrong call: if a sufficiently powerful quantum computer were built in the future, "it could be used to compute a private key from a public key thereby breaking encrypted messages. This kind of threat is known as Harvest Now, Decrypt Later (HNDL)." An adversary who records your ciphertext today does not need a quantum computer today. The damage is done at recording time and paid out later, which makes it the one class of attack you cannot patch after the fact.

The first move is easy to describe. PQXDH takes the classical handshake and adds one post-quantum key encapsulation to it. The shared secret becomes SK = KDF(DH1 || DH2 || DH3 || SS), where the first three terms are the elliptic-curve exchanges that were always there and SS is the secret pulled out of the KEM. The published spec is Revision 3 and still names Crystals-Kyber-1024 as its example; NIST standardised the algorithm as ML-KEM in FIPS 203 on 13 August 2024, in three parameter sets — ML-KEM-512, 768 and 1024.

One secret is not a conversation

PQXDH runs once, at session setup. Signal said so at the time: it "protects messages exchanged on Signal against the threat of a future quantum computer. We will need to make further upgrades to address the threat of an attacker with a contemporaneous quantum computer."

The reason is structural. A ratchet needs a fresh secret again and again, forever, so that a break at one moment does not extend forwards or backwards. Elliptic-curve Diffie–Hellman suits that perfectly: both sides attach 32 bytes to a message, both compute the same new secret, and the exchange is symmetric — neither party has to go first.

KEMs do not work that way. As Signal's engineers put it, they "require ordered, asymmetric messages to be passed between their clients." Alice must publish an encapsulation key; only then can Bob encapsulate and send back a ciphertext. And the objects are large — over 1000 bytes each for ML-KEM-768, against 32 for ECDH. Now add reality: one party is offline for two weeks, messages are dropped, messages arrive out of order, Alice sends ten messages before Bob sends one. And add an adversary who simply drops any message that is a thousand bytes bigger than the others, so no new secret is ever agreed.

What Signal actually had to build

The Sparse Post Quantum Ratchet, announced on 2 October 2025, answers those problems rather than the cryptography. A state machine decides who owes what. The large keys are broken into erasure-coded chunks, so any sufficient subset reconstructs the whole — which turns selective dropping into total denial of service, and total denial of service is visible. And the ML-KEM operations were reordered — Signal calls it the ML-KEM Braid — so most of the encapsulation key and most of the ciphertext travel in opposite directions at once.

The most interesting finding is a negative one: generating new secrets faster made more messages vulnerable, not fewer.

Running several epochs in parallel means the initiator holds several unused decapsulation keys at once, so a single point-in-time breach exposes not just the current epoch but every in-flight one. Speed and healing pull against each other — the sort of thing you learn by simulating a protocol rather than reasoning about it.

The output is mixed rather than substituted. Signal runs the Double Ratchet and SPQR side by side and feeds both keys into a KDF — the Triple Ratchet, now written into Revision 4 of the Double Ratchet specification. "An attacker has to break both our elliptic curve and ML-KEM to even be able to distinguish this key from random bits."

Why everybody ships hybrid

That mixing is what hybrid means, and the reasoning is not timidity — it is that lattice cryptography is young. Signal's explanation is the honest one: "During NIST's standardization process, one of the post-quantum algorithm candidates was found to be attackable by a classical computer… it also suggests that one should integrate these new post-quantum options cautiously." So: "we do not want to simply replace our existing elliptic curve cryptography foundations with a post-quantum public key cryptosystem. Instead, we are augmenting our existing cryptosystems such that an attacker must break both systems."

Hybrid has since been packaged as a primitive in its own right. X-Wing is a hybrid KEM built from X25519 and ML-KEM-768 with a security proof for the combination, and it is being specified at the IETF as draft-connolly-cfrg-xwing-kem.

Where OSHI is, precisely

OSHI uses X-Wing — ML-KEM-768 with X25519 — and absorbs its secret once, into the initial root key of a v3 session, domain-separated under the HKDF info string RootKey-XWing-v1. That is PQXDH-shaped: the root feeds every later Diffie–Hellman step, so an adversary who breaks every X25519 exchange in the conversation still cannot advance the root without the post-quantum secret. The mode and the KEM ciphertext are bound into the AEAD's associated data, so stripping them fails authentication rather than producing a quieter, weaker session.

Now the parts that are not flattering. It is iOS 26 and macOS 26 only, because it rides on the platform's ML-KEM implementation. It is negotiated per peer, and when the peer has no key it falls back to classical rather than refusing — a deliberate choice, and one that means you cannot assume any given conversation has it. Android and desktop have no KEM at all. The identity signatures are still Ed25519, which is classically fine and quantum-vulnerable. And OSHI has no post-quantum ratchet: one absorption at session start is the first step Signal took in 2023, not the one it took in 2025. Everything in this article about why that second step is hard is also a description of work we have not done.