Before your first message sends, your device and your contact's device
run Entangled Session v1: two key exchanges side by side —
X25519 and ML-KEM-1024 — both peers
contribute quantum-sourced entropy, and each leg is signed under its
own FIPS 204 context. This guide walks the sequence in plain language;
every step links to the byte-exact specification.
The second before your first message
Tap send on a first message and four things happen before any text leaves your phone: your device fetches your contact's published keys, checks them against the Key Transparency log, runs the handshake below, and only then encrypts. The whole exchange is two messages on the wire — an init and a response.
Two locks, one key
The handshake runs two independent key exchanges and feeds both results into one derivation:
session_secret = HKDF-SHA-512( ML-KEM-1024 secret || X25519 secret, … )
X25519 is the classical exchange a decade of deployment has
hardened. ML-KEM-1024 is the lattice-based exchange
standardized in FIPS 203 at category 5 — built for the adversary who
records your traffic today and waits for a quantum computer. Reading
your session requires breaking both. If one falls to future
cryptanalysis, the other still stands, in either direction.
Both of you roll the dice
Each device contributes 64 bytes of entropy drawn from the certified-QRNG pool, and both contributions are mixed into the session keys. Neither side — and neither side's compromised random-number generator — can unilaterally control the session secret.
Signatures that cannot be reused
Your device signs its handshake leg with ML-DSA-87 under
the context QERYX-ES-INIT-v1; the responder signs under
QERYX-ES-RESP-v1. FIPS 204 context framing means every byte
of the context is inside the signature — a signature captured in one
direction fails verification in the other, deterministically. The
responder also signs an echo of your nonce, so a recorded handshake
cannot be replayed at someone else. Handshakes older than five minutes
are rejected outright.
What happens after
The handshake result seeds the Q-Ratchet, and from that point every message you send uses a fresh key: the classical ratchet steps every message, the post-quantum ratchet every hundred, and fresh quantum entropy folds in every few messages. The handshake keys themselves are retired almost immediately — they exist to be outgrown.
One check remains yours: the handshake authenticates keys, and verifying your safety number confirms those keys belong to the human you think they do.
Read the exact bytes
- The Hybrid Handshake — wire formats, verification rules, and the constant-time details this guide simplifies.
- Cryptographic Primitives — the parameter sets named above.
- NIST FIPS 203, FIPS 204, SP 800-227; RFC 7748.