Post-Quantum Encrypted Messaging, Explained

The problem: harvest now, decrypt later

The key exchanges behind most secure messaging, from the padlock in your browser to the classic Signal Protocol, rely on elliptic-curve cryptography. It is strong against every computer that exists today. It is not strong against a sufficiently large quantum computer running Shor’s algorithm, which could recover the private keys.

Nobody has built that machine yet. The reason it matters now is that encrypted traffic can be recorded today and stored until it can be opened. Messages about your health, your money, your children or your business are often still sensitive ten or twenty years later. If they were protected only by elliptic curves, a recording made today is a liability later.

What makes encryption "post-quantum"

In 2024 the US National Institute of Standards and Technology published FIPS 203, the ML-KEM standard. ML-KEM is the standardized form of CRYSTALS-Kyber, a key-encapsulation mechanism built on lattice problems. No known quantum algorithm solves those problems efficiently.

A key-encapsulation mechanism does one job: it lets two devices agree on a shared secret without ever sending the secret itself. Everything else, the actual sealing of your messages, is done with a fast symmetric cipher using keys derived from that secret.

• ML-KEM-512, 768 and 1024 are the three standardized strengths. IronCircles uses ML-KEM-1024, the highest.
• Symmetric ciphers such as XChaCha20-Poly1305 are already considered safe against quantum attack at 256-bit key sizes.
• The weak point was always the key exchange. That is the part post-quantum cryptography replaces.

Why the ratchet matters as much as the algorithm

A strong key exchange done once is not enough. If one long-lived key protects a whole conversation, stealing that key from a phone exposes everything it ever protected.

A ratchet fixes that. Keys move forward with every message, and old keys are destroyed. A key taken from a device today does not open last month’s messages (forward secrecy), and fresh key material soon locks the attacker back out (break-in recovery).

IronCircles runs a double ratchet with an ML-KEM key exchange inside it. Every message is sealed with its own key using XChaCha20-Poly1305, an authenticated cipher, so tampering is detected rather than just hidden.

Which apps are post-quantum today

Post-quantum messaging went from research to shipping products quickly. As of October 2026:

• Signal added a post-quantum initial key exchange (PQXDH) in 2023, and in October 2025 a Sparse Post-Quantum Ratchet that mixes ML-KEM-768 into its Double Ratchet, which Signal calls the Triple Ratchet.
• Apple’s iMessage moved to its PQ3 protocol in 2024.
• IronCircles uses ML-KEM-1024 in its ratchet for messages, photos, video and files in every circle.

So post-quantum protection is no longer a differentiator on its own. What still differs between apps is everything around the encryption: what the service collects about you, whether it needs your phone number, who can join your groups, and whether the company makes money from your attention.

What encryption does not protect

End-to-end encryption protects what you say. It does not, by itself, hide who you talk to, when, or from where. That information, called metadata, is often what services collect and what gets handed over.

IronCircles keeps that list short by design: signup is a username and password, with no phone number, email, real name or contacts. We do not log IP addresses or location. The one identifier we hold is a device ID, so we can tell your phone that a new message has arrived.

Questions