iMessage with PQ3 Cryptographic Protocol

Original Article ↗ Hacker News Discussion ↗

Apple’s rollout of a post‑quantum “PQ3” cryptographic protocol for iMessage is welcomed as meaningful future‑proofing against “harvest now, decrypt later” attacks, but many commenters argue it doesn’t fix core privacy issues around iCloud backups and insecure defaults. A central concern is that, unless users enable Advanced Data Protection (and all chat participants do the same), Apple can still access message content via escrowed keys or non‑E2EE backups, undermining practical end‑to‑end encryption. The thread also contrasts Apple’s approach with Signal and RCS, highlighting trade‑offs between security, usability, cross‑platform support, and the realities of mass adoption.

iCloud backups, key escrow, and “real” E2EE

  • Multiple comments stress that iMessage content is only strongly protected if:
    • iCloud Backup is disabled or Advanced Data Protection (ADP) is enabled, and
    • either Messages in iCloud is off, or its keys are not exposed via non‑E2EE backups.
  • By default, iCloud device backups are encrypted by Apple-held keys (escrow in HSMs). This allows account recovery and lawful access.
  • Messages in iCloud is technically E2EE, but if iCloud Backup is on without ADP, the Messages-in-iCloud keys are included in the backup, so Apple can still decrypt.
  • Some argue this means iMessage is “not really E2EE” in practice and Apple’s marketing is misleading; others insist E2EE properly refers to data in transit, and what endpoints/backups do is a separate layer.

Threat model, PQ3, and timing

  • PQ3 is seen as mainly addressing “harvest now, decrypt later”: adversaries stockpile ciphertext today and wait for future quantum capabilities.
  • Some participants think post‑quantum deployment is premature given current quantum hardware limits; others reply that:
    • Quantum algorithms (e.g., Shor’s) already exist.
    • Quantum progress by state actors may be hidden.
    • Switching sooner limits how much old traffic is vulnerable later.

Post‑quantum crypto design and complexity

  • Both Apple and Signal use CRYSTALS‑Kyber (LWE/lattice‑based) in hybrid mode with classical crypto.
  • Several comments note:
    • LWE/lattice math looks complex and “surface‑area heavy,” raising fear of hidden flaws.
    • But RSA/ECC in real, secure deployments is also quite subtle and historically had many pitfalls.
    • Hybrid PQC+ECC is now standard practice to hedge against breaks in either.

Signal, usability, and cross‑platform issues

  • PQ3 is viewed as good PR for Signal, which already has a post‑quantum hybrid protocol and is open source, cross‑platform.
  • Many see Signal as the practical secure choice for mixed iOS/Android groups; disappearing messages and high‑quality media are praised.
  • Major usability complaints:
    • No backups on Apple platforms; users regularly lose all history on device loss/upgrade.
    • Removal of SMS integration on Android made onboarding and retention harder for non‑enthusiasts.
  • By contrast, Apple prioritizes seamless backups/recovery for the mass market, at the cost of default server‑side access.

RCS, SMS, and interoperability

  • iMessage falls back to legacy SMS/MMS for non‑Apple devices, which is widely criticized as a huge security downgrade.
  • Apple has announced RCS support (likely unencrypted initially, as the standard lacks mandatory E2EE).
  • Google’s current E2EE for RCS is a proprietary extension and not a true open standard; some see this as a blocker for Apple adopting it.

Privacy vs law enforcement and abuse

  • One thread raises that ubiquitous strong crypto will also protect serious criminals and hostile states.
  • Others counter that:
    • Crimes predate strong crypto; evidence usually exists outside messages.
    • We don’t abolish private homes or locks because criminals use them; digital privacy should be analogous.
    • European case law has explicitly pushed back on weakening end‑to‑end encryption.

Attack surface and mitigations

  • iMessage is criticized as a major exploit vector (e.g., Pegasus). Some users:
    • Disable iMessage, FaceTime, and syncing where possible.
    • Use Lockdown Mode or configuration profiles to reduce attack surface.
  • There is brief discussion of Apple’s new key‑verification UI and key transparency for MITM resistance, but details of PQ3’s mitigation of active post‑quantum MITM remain partly unclear.