Skip to main content

Five locks in one cascade

xoron
xoron
positive-intentions

One lock is a single failure mode. A messaging app that only did today’s elliptic-curve handshake would be finished for 2016. Glitr encrypts to a person with five independent wraps on the same payload: AES, then Signal, then PQXDH, then RSA hybrid, then ML-KEM.

That stack is defense-in-depth, not a spec-recommended profile. PQXDH already includes X25519, ML-KEM-1024, and a ratchet. The extra Signal and standalone ML-KEM layers are independent wraps. Password sealing of your mailbox files stays outside that cascade. Mixing those two jobs is how products start lying about what a password does.

Two crypto jobs​

These must stay separate.

Recipient cascadePassword at rest
JobEncrypt a payload to a contactSeal your documents so a host is not reading the file
UnlockTheir public bundles and the shared sessionThe encryption password you type at connect
WhereOutbound, signaling, live chat bodies, live file payloadsContacts, inbox, sent, file transfers, profile secrets, protocol sessions

The recipient path is: AES → Signal → PQXDH on the inside, then RSA hybrid → ML-KEM on the outside. The at-rest path is Argon2id then AES-GCM on flush. The encryption try path can toggle a password layer for teaching; the product recipient path never does.

What each lock is for​

AES-GCM is the inner envelope: authenticated symmetric encryption of the plaintext. It is fast, familiar, and the first thing an attacker who only got the outer wraps would still have to open.

Signal is the classical handshake and ratchet — X3DH key agreement, the Double Ratchet, identity keys, signed prekeys, one-time prekeys. It is the machinery that lets two people agree on keys and keep advancing them so old messages stay gone if a key leaks later. The library is open source. It is research-grade. It is not a substitute for a formal audit of the whole messenger, and it is not wire-compatible with the Signal app.

PQXDH is Signal’s post-quantum extended Diffie–Hellman: classical X25519 combined with ML-KEM-1024, so you do not throw away today’s hardness while you add tomorrow’s. Glitr’s crate aims at Signal PQXDH revision 3. Documented deviations exist (separate X25519 and Ed25519 keys, HKDF-SHA-256, simple encodings instead of libsignal protobufs). Spec-faithful and educational, not libsignal wire-compatible.

RSA hybrid is an independent asymmetric wrap: RSA-OAEP-4096 plus AES-256-GCM. It is a different primitive family from both the elliptic-curve Signal layer and the lattice KEM. A break in one family does not automatically open this envelope.

ML-KEM-1024 (FIPS 203) is the outer post-quantum KEM. The wrapper uses the same libcrux-ml-kem crate and pin as libsignal, plus hybrid AES-256-GCM. Lattice review lives in libcrux, not in the wrapper. The 1024 parameter set is the Signal PQXDH production size: 1568-byte public key, 1568-byte ciphertext, 32-byte shared secret.

Where the cascade runs​

The same recipient encryption covers git outbound, signaling SDP, live chat bodies, and live file payloads. Detection is by shape, not by folder name. A live file is sealed as one cascade blob; the data channel then carries slices of that ciphertext, not a second encryption layer.

Git and live share one protocol session per contact so the ratchet does not fork. Git cannot consume one-time prekeys off a peer repository the way a live prekey server would. The signed prekey is the last-resort path.

Old outbound rows that still look like { wrappedKey, nonce, ciphertext } still decrypt (hybrid fallback). New sends use the cascade envelope.

How to talk about this without lying​

Safe sentences:

  • Messages are encrypted so a git host is not reading the thread.
  • Recipient payloads run AES → Signal → PQXDH, then RSA hybrid → ML-KEM.
  • The handshake work includes an open Signal Protocol library.
  • A post-quantum KEM and PQXDH are part of the shipped cascade, not only demos.

Unsafe sentences we will not use:

  • “Unaudited end-to-end forever against nation states.”
  • “Compatible with the Signal app.”
  • “The entire messenger is open source.”

The user-level story is Signal Protocol and the post-quantum path. The libraries are on Cryptography. You can press the buttons on Try encryption, Signal, and Post-quantum.