False claims in a specification catastrophically fail review. This chapter enumerates every gap between the specification and the shipping snapshot: audit items not yet in code, items that require user action, cadence trade-offs, optional features off by default, and the open production symptoms. Where a discrepancy exists, code is canonical and the spec is the divergence to be fixed.
Why this paper exists
An evaluator reads limitation sections first: a document that admits nothing is hiding something. Publishing this chapter unedited is itself conformance evidence — the gaps below are the same ones an external review would find, already found.
Audit items not yet in code (at the v1.0 snapshot)
| Item | Status | Detail |
|---|---|---|
| Server-contributed transcript binding for relayed handshakes | OPEN — v1.1 | the hybrid combiner already binds every transcript key and ciphertext into HKDF info; the open item is a relay-side ephemeral contribution, defense-in-depth against a precomputing relay |
| Argon2id at the RFC 9106 minimum | CLOSED 2026-05-01 | the one-shot path shipped the reweighting to m=512 MiB, t=2, p=4 — a 5.3× work-factor increase; the 2 GiB desktop profile remains a named constant |
| Legacy infallible signing wrapper | OPEN — v1.1 |
the deprecated sign() path returns an all-zero
signature on its rare error branch. A zero signature verifies
with probability ~2⁻²⁵⁶ — safe by accident, still a footgun.
Production callers route through the fallible API; removal of
the infallible variant is scheduled
|
| FIPS module gate on internal HKDF utility paths | OPEN — v1.1 | every public crypto entry point passes the operational gate; a few ratchet-internal derivations skip the redundant re-check. Uniform plumbing costs one atomic load per derivation |
Single normative label dump (labels.rs) |
OPEN — v1.1 | the HKDF-label and signature-context catalogs live in the primitives chapter and the Reviewer FAQ until the normative source file lands |
Items requiring user action
- Operator-key re-pinning is deliberately manual. A legitimate operator rotation requires each client's explicit "Reset Operator Trust" action — so an adversary cannot induce silent re-pinning.
- Safety-number verification is out-of-band by design. A user who accepts a key-change prompt without verifying can be machine-in-the-middled; the UI makes that hard, and the human remains the trust anchor. The procedure is its own guide.
- Server master-key rotation is a runbook item — recommended monthly; the FSOR guarantee for newly written rows resumes at each rotation.
- Identity-key rotation is never forced. High-threat operators are advised to rotate quarterly through the explicit Settings flow.
Cadence trade-offs
Defaults tune for typical messaging: PQ ratchet every 100 messages, QRNG injection every 5 (text) / 250 (voice). An every-message PQ ratchet is supported by configuration but multiplies per-message bandwidth roughly 70× (a ~3,198-byte header versus ~46 bytes) — supported, measured, and not recommended for typical use.
Off by default
- Triple-classical combiner (adds X448): ~10% CPU overhead, wire-format prepared, Cargo-feature gated.
- Fourth-KEM fallback (code-based hardness, NIST IR 8545 class): ~22 KiB handshake overhead, reserved for high-assurance deployments.
- CSfC dual-layer AEAD: mandatory for QVault item encryption, opt-in for the messenger.
- The FIPS-validated boundary feature: on for NSS-targeted builds, off for the public build — the runtime status surface reports which honestly.
Seven production-log symptoms were open at the snapshot — from a stale KTS leaf-hash cache rejecting calls to caches surviving panic-wipe. They are listed item-by-item in the source chapter and tracked as active work, not footnotes.
The v1.1 roadmap
- Land the normative label dump and the relay transcript-binding module.
- Remove the infallible signing wrapper; fallible API only.
- Plumb the FIPS operational gate uniformly through every derivation path.
- Wire the constant-rate padder for messenger transports.
- Begin formal verification: a ProVerif model of the handshake and a Tamarin model of the Q-Ratchet post-compromise claims.
Disclosure
QERYX welcomes coordinated disclosure of anything this spec missed:
security@qeryx.com. The classes most likely to surface in
review — a timing path we missed, a buffer we forgot to zeroize, a
domain-separation label we did not think of — are named in the source
chapter, because pretending otherwise would fail the review this
document exists to pass. We respond to security mail within 24 hours.
References
-
QERYX Protocol Specification §16 —
docs/SPEC/13-known-limitations.md, snapshot 2026-05-01. - Cryptographic Primitives — the Argon2id close-out record.
- The Hybrid Handshake — the open transcript-binding item in context.