Post-quantum encryption for messaging
SANKET (Sanket.Chat) by Tosh Defence protects messaging with hybrid post-quantum cryptography at both stages of every conversation: PQXDH session establishment with a post-quantum Kyber prekey, and Signal's Sparse Post-Quantum Ratchet (SPQR) mixing ML-KEM secrets into the ongoing Double Ratchet. Transport adds hybrid X25519MLKEM768 key exchange, offered first at the edge, so recorded traffic is protected against harvest now, decrypt later attacks.
An adversary can record encrypted traffic today and try to decrypt it once a capable quantum computer exists. Information that must stay confidential for years needs post-quantum protection now, and SANKET delivers it through Signal's audited libsignal.
Post-quantum from the first message
Every SANKET session starts with PQXDH, the post-quantum extension of X3DH. The initiator combines three or four X25519 agreements with a Kyber encapsulation to one of the recipient device's one-time Kyber prekeys, and derives the session secret from all of them. Someone who records the handshake today and later obtains a quantum computer cannot recover the session key from it.
The installation verifies every Kyber prekey signature with libsignal before storing it, and every prekey bundle must carry a Kyber last-resort prekey, so a session never starts without its post-quantum component.
Post-quantum for the whole conversation: SPQR
SANKET's libsignal release runs Signal's Sparse Post-Quantum Ratchet alongside the Double Ratchet for all sessions, mixing ML-KEM-derived secrets into message keys. Signal calls the combination the Triple Ratchet. To recover message keys an attacker must break both the elliptic-curve and the post-quantum components, for the life of the conversation.
Hybrid post-quantum TLS
In TLS 1.3 the edge offers the hybrid group X25519MLKEM768 first. Its shared secret combines X25519 with ML-KEM-768, so a recorded session stays confidential unless both are broken. Any client whose TLS stack offers the group negotiates it, and the installation's own outbound connections offer it too.
Cipher suites remain AES-256-GCM only, and symmetric encryption uses 256-bit keys throughout, a key size considered adequate against known quantum attacks.
- X25519MLKEM768 offered first
- AES-256-GCM cipher suites only
- Negotiated group measured without logging who connected
- Handshake transcript authenticated end to end
Ready for what comes next
SANKET is crypto-agile by design. libsignal is versioned, so new primitives arrive with a library upgrade, as PQXDH and SPQR did. Transport groups are edge configuration, call encryption is a numbered profile the server enforces, and all application AES-GCM passes through one strict helper. Hybrid Ed25519 and ML-DSA signatures for releases and licences are designed and on the roadmap, to be enabled once an independently audited ML-DSA implementation is available.
Technical proof
Read the detail in the SANKET whitepaper
Every statement on this page is set out in full in the public SANKET Technical Security and Architecture Whitepaper, free to read without registration.
Is SANKET post-quantum secure messaging?
SANKET messaging uses hybrid post-quantum cryptography for both session establishment (PQXDH with Kyber-1024) and the ongoing ratchet (SPQR), through Signal's official libsignal. An attacker must break both the classical and the post-quantum components.
What is PQXDH?
PQXDH is Signal's post-quantum extension of the X3DH key agreement. It adds a Kyber key encapsulation to the X25519 agreements, so a recorded handshake cannot be decrypted later with a quantum computer. It has been formally analysed.
What is SPQR, the Triple Ratchet?
SPQR is Signal's Sparse Post-Quantum Ratchet. It runs alongside the Double Ratchet and mixes ML-KEM-derived secrets into message keys, extending post-quantum protection from session start to the whole conversation.
Does SANKET use post-quantum TLS?
Yes. The edge offers the hybrid X25519MLKEM768 key exchange first in TLS 1.3, and the installation offers it on its outbound connections. Clients whose TLS stack supports it negotiate it automatically.
What is harvest now, decrypt later?
It is the practice of recording encrypted traffic today in order to decrypt it once a capable quantum computer exists. Hybrid post-quantum key agreement, as used by SANKET, protects recorded traffic against it.
Is AES-256 quantum resistant?
AES-256 is considered adequate against known quantum attacks at its 256-bit key size, which is why SANKET uses 256-bit symmetric keys throughout.
Protect today's communications against tomorrow's computers
Talk to Tosh Defence about SANKET's post-quantum design and crypto-agility for long-lived sensitive information.