Apple Promises To Protect IMessage Chats From Quantum Computers

Apple says it's going to upgrade the cryptographic protocol used by iMessage to hopefully prevent the decryption of conversations by quantum computers, should those machines ever exist in a meaningful way.

The protocol, dubbed PQ3, is intended to safeguard users' chats in some future era of quantum computing, when these computers may be able to break classical encryption methods and render today's messaging security obsolete. While the technology isn't there yet, the fear is that, for one thing, government spies are already hoarding people's end-to-end encrypted conversations and other data observed in transit now to decrypt later if and when quantum computers have the ability to crack today's encryption systems.

Various developers are starting to use quantum-resistant algorithms to prevent this from happening, and Apple is joining them, using an approach it's called PQ3 to secure iMessages against future unauthorized decoding.

"PQ3 is the first messaging protocol to reach what we call Level 3 security — providing protocol protections that surpass those in all other widely deployed messaging apps," Apple boasted in an announcement today. "To our knowledge, PQ3 has the strongest security properties of any at-scale messaging protocol in the world."

iMessage with PQ3 is available now in developer previews and betas of iOS 17.4, iPadOS 17.4, macOS 14.4, and watchOS 10.4, which are due to be released to the public with that protocol support. Apple expects PQ3 to fully replace its existing end-to-end messaging protocol by the end of the year.

Here's how Apple breaks down the various security levels: Level 0 has no end-to-end encryption (E2EE) while Level 1 has strong E2EE turned on by default. Level 1 is what WhatsApp and iMessage uses prior to PQ3. Neither of these security levels protect against quantum attacks, Apple reckons.

• Google Chrome to shield encryption keys from promised quantum computers
• Signal adopts new alphabet jumble to protect chats from quantum computers
• Singapore's monetary authority advises banks to get busy protecting against quantum decryption
• Russia's tiny quantum computer is (probably) nothing to worry about

Moving into post-quantum cryptographic (PQC) protocols: There's Level 2 security, which establishes a PQC key for encryption. Signal reached this level in September when it added support for the PQXDH protocol. "This is a welcome and critical step that, by our scale, elevated Signal from Level 1 to Level 2 security," Cupertino sniffed.

Apple just so happens to put its new iMessage protocol at Level 3, using post-quantum cryptography in both the initial key establishment and the ongoing rekeying of the session.

In designing PQ3, Apple opted to continue using the Elliptic Curve cryptography (ECC) it employs today with iMessage but with Kyber post-quantum public keys during key establishment and rekeying. Kyber is one of the cryptographic mechanisms NIST in the US has recommended for post-quantum data protection.

The announcement has more technical details if you're into that – including an interesting aside that iMessage switched from RSA to ECC in 2019 – though here's an important part:

And it goes on:

Cupertino says it has verified PQ3, both internally by its Security Engineering and Architecture (SEAR) team, as well as externally with cryptography experts.

These outside boffins included Professor David Basin, head of the Information Security Group at ETH Zürich and one of the inventors of Tamarin, and Professor Douglas Stebila at the University of Waterloo.

None of the experts found any security holes with PQ3, we're told. ®