Signal shipped the group messaging half of its post-quantum work on Tuesday, roughly three years after the one-to-one protocol gained an ML-KEM layer. Group chats now derive keys through a construction the team calls the sparse post-quantum ratchet, which adds Kyber encapsulation to the sender key mechanism without the bandwidth cost that made a naive approach impractical. The change is live for all users on version 8.2 and above and requires no action. Signal also published a 46-page specification and an accompanying formal analysis from a team at ETH Zurich, which is the part of this release that cryptographers will spend the next month arguing about.
Why group chats were harder
One-to-one messaging in Signal uses the double ratchet, where each message advances key material in a way that limits the damage from any single key compromise. Adding post-quantum protection meant layering ML-KEM alongside the existing elliptic curve exchange, doubling some key sizes but leaving the structure intact. Groups work differently. Signal uses sender keys, where each participant distributes a symmetric key to the group and encrypts messages once rather than encrypting separately for each member, because the alternative scales quadratically.
Applying post-quantum encapsulation to sender key distribution naively means every key rotation carries a Kyber ciphertext to every member, and Kyber-768 ciphertexts are 1,088 bytes. For a 1,000 member group rotating keys on every membership change, that produces megabytes of traffic per event on connections that are often mobile and metered. Signal's solution rotates post-quantum material on a slower schedule than the classical material, accepting a bounded window of reduced post-compromise security in exchange for practicality.
The tradeoff, stated plainly
The specification is unusually honest about what is being given up. Classical post-compromise security recovers within one message after a compromise ends. Post-quantum post-compromise security in the group construction recovers within a window that depends on group size and activity, bounded at 100 messages or 24 hours, whichever comes first. An adversary with a quantum computer who compromises a device retains the ability to read group traffic for that window even after losing access.
Signal's argument for accepting this is that the threat model it defends against is harvest now, decrypt later, where an adversary records ciphertext today and decrypts it after building a quantum computer. Against that threat, any post-quantum protection is a discontinuous improvement over none. The scenario where an adversary has both a working quantum computer and live device compromise is one where the user has larger problems. Several academic cryptographers have accepted that reasoning; a minority argue the specification should offer a slow, expensive mode for high-risk users.
The story is rarely the launch. It is what breaks, what ships, and who owns the mess at 2 a.m.
The formal analysis
The ETH Zurich team, led by Kenny Paterson's group, produced a machine-checked proof in the symbolic model covering key indistinguishability and authentication under a specified adversary. Symbolic proofs catch structural flaws and do not catch implementation errors or issues arising from the concrete cryptographic assumptions, a limitation the paper states in its second paragraph. The analysis found no attacks and identified two places where the specification's wording permitted an implementation that would be insecure, both of which Signal tightened before release.
A computational proof, which would be stronger, is in progress and the team estimates it at a year of work. Signal chose to ship on the symbolic result plus internal review rather than wait, a decision that would be indefensible for a novel primitive and is more reasonable for a composition of well-studied ones. The implementation is in Rust in the libsignal repository, publicly auditable, and has been through a review by Trail of Bits that Signal commissioned and published alongside the release.
What this means for the broader migration
NIST finalized its post-quantum standards in 2024 and the US federal migration deadline for high-value systems is 2030, with a full transition targeted for 2035. Most of that work is in TLS and code signing, where the changes are comparatively mechanical. Messaging protocols with forward secrecy and post-compromise security properties are the hard case, and Signal is the reference implementation everyone else reads.
Apple's iMessage adopted a post-quantum layer called PQ3 in 2024 for one-to-one and has been quiet about groups. WhatsApp, which licenses Signal's protocol, has not announced a timeline and its group implementation diverges enough that Signal's construction does not transfer directly. Matrix has a proposal in draft. Given how much of the world's private communication runs on these four systems, the group messaging gap has been the largest unaddressed piece of the post-quantum transition in consumer software, and one of them just closed it.
Practical effects for users and operators
Ordinary users will notice nothing. Message send latency increased by a measured 4 milliseconds on median for groups under 200 members, and bandwidth per member per day rose about 2.4 kilobytes. Battery impact was below Signal's measurement threshold. The one visible change is that very large groups, above 800 members, take slightly longer to process a membership change, on the order of a second.
Organizations running Signal for internal communication, which includes a surprising number of newsrooms, legal teams, and government offices, should update their threat model documentation to reflect the bounded recovery window. It is a small change and the kind of detail that matters when an auditor asks what the protocol guarantees. Signal's specification is written clearly enough to cite directly, which is not something you can say about most cryptographic documentation.
Skarvonix will keep following this beat with reporting grounded in how systems behave outside the launch keynote.
- Zero Trust
- Privacy
