INVITE ONLY
OBSERVATORY

Guides

tutorial

Understand the Handshake

Version
v1.0
Category
tutorial
Published
Last updated
Authors
QERYX Research
Primitives X25519 ML-KEM-1024 ML-DSA-87 HKDF-SHA-512
What changed v1.0
  1. v1.0 First publication.
Contents
  1. §1 The second before your first message
  2. §2 Two locks, one key
  3. §3 Both of you roll the dice
  4. §4 Signatures that cannot be reused
  5. §5 What happens after
  6. §6 Read the exact bytes

Before your first message sends, your device and your contact's device run Entangled Session v1: two key exchanges side by side — X25519 and ML-KEM-1024 — both peers contribute quantum-sourced entropy, and each leg is signed under its own FIPS 204 context. This guide walks the sequence in plain language; every step links to the byte-exact specification.

The second before your first message

Tap send on a first message and four things happen before any text leaves your phone: your device fetches your contact's published keys, checks them against the Key Transparency log, runs the handshake below, and only then encrypts. The whole exchange is two messages on the wire — an init and a response.

Two locks, one key

The handshake runs two independent key exchanges and feeds both results into one derivation:

session_secret = HKDF-SHA-512( ML-KEM-1024 secret || X25519 secret, … )

X25519 is the classical exchange a decade of deployment has hardened. ML-KEM-1024 is the lattice-based exchange standardized in FIPS 203 at category 5 — built for the adversary who records your traffic today and waits for a quantum computer. Reading your session requires breaking both. If one falls to future cryptanalysis, the other still stands, in either direction.

Both of you roll the dice

Each device contributes 64 bytes of entropy drawn from the certified-QRNG pool, and both contributions are mixed into the session keys. Neither side — and neither side's compromised random-number generator — can unilaterally control the session secret.

Signatures that cannot be reused

Your device signs its handshake leg with ML-DSA-87 under the context QERYX-ES-INIT-v1; the responder signs under QERYX-ES-RESP-v1. FIPS 204 context framing means every byte of the context is inside the signature — a signature captured in one direction fails verification in the other, deterministically. The responder also signs an echo of your nonce, so a recorded handshake cannot be replayed at someone else. Handshakes older than five minutes are rejected outright.

What happens after

The handshake result seeds the Q-Ratchet, and from that point every message you send uses a fresh key: the classical ratchet steps every message, the post-quantum ratchet every hundred, and fresh quantum entropy folds in every few messages. The handshake keys themselves are retired almost immediately — they exist to be outgrown.

One check remains yours: the handshake authenticates keys, and verifying your safety number confirms those keys belong to the human you think they do.

Read the exact bytes

  1. The Hybrid Handshake — wire formats, verification rules, and the constant-time details this guide simplifies.
  2. Cryptographic Primitives — the parameter sets named above.
  3. NIST FIPS 203, FIPS 204, SP 800-227; RFC 7748.