The adversary QERYX is built against: an active network attacker with full capability on every link, a server operator under legal coercion, compromised relay nodes, and a cryptographically-relevant quantum computer recording today's traffic for tomorrow's cryptanalysis. This paper enumerates twenty-one attack classes with the mitigation and the residual risk for each — including the attacks that remain possible, stated plainly.
The adversary
The in-scope attacker holds, simultaneously:
- full passive capture on every link — every ciphertext, forever;
- active manipulation — drop, reorder, inject, modify;
- legal coercion of the QERYX server operator;
- compromise of one or more relay nodes;
- a cryptographically-relevant quantum computer running Shor's algorithm against RSA, ECDSA, and classical Diffie–Hellman;
- harvest-now-decrypt-later recording against future cryptanalysis.
The endpoint adversary is bounded: a one-time read of a device's full cryptographic state followed by passive observation — the standard post-compromise-security model.
Out of scope, explicitly
- Continuous endpoint compromise. Persistent read/write on an unlocked device sees plaintext as it is typed. No protocol defends this; app-layer mitigations (integrity checks, panic wipe, duress unlock, decoy mode) reduce the window without pretending to close it.
- A compromised mobile OS supply chain. The platform's signed-OS chain and hardware keystore are the root of trust.
- Fully-resourced physical hardware extraction. Multi-source entropy and panic wipe raise the cost; a nation-state lab with the device in hand defeats most countermeasures, and we say so.
- Cross-app side channels — the OS sandbox is assumed intact.
The attack catalog
Twenty-one classes are analyzed in the source chapter. The highest-leverage rows:
| Attack | Mitigation | Residual risk |
|---|---|---|
| Passive eavesdrop + future quantum decryption | ML-KEM-1024 + X25519 hybrid; PQ ratchet every 100 messages |
a simultaneous break of both assumptions |
| Active machine-in-the-middle at handshake | KTS-bound identity keys; signed handshake legs; nonce echo | a user who accepts a key-change prompt without out-of-band verification |
| Replay | nonce echo, 5-minute handshake window, per-message keys, replay bitmaps | — |
| Downgrade | no negotiation variable exists: one KEM, one signature suite, byte-locked combiner version | — |
| Coerced operator | ciphertext-only relay; blinded participant hashes; FSOR erasure | connection-level metadata; live-coercion shadow copies before FSOR wraps (a policy control, named in the FSOR paper) |
| Operator key compromise | TOFU pinning, STH gossip, conflicting-head detection | equivocation window bounded by the slowest gossip cycle |
| One-time endpoint compromise | PQ ratchet recovery ≤100 messages; QRNG injection ≤5 | messages between compromise and the next ratchet step |
| Timing side channels on PQ primitives | audited secret-independent kernels; full implicit-rejection path; constant-time comparisons everywhere | — |
| Traffic analysis | 9-bucket padding ladder, decoy traffic, onion routing, blinded hashes | a global passive adversary correlating timing across all hops; constant-rate padding covers selected transports today |
| Coerced unlock at a border | duress unlock to a decoy account, panic wipe, quorum-gated auto-wipe | app-layer defenses over a deniable-encryption primitive — not absolute |
Defense in depth
Layered pairs, so the failure of any one layer does not fail the system:
| Layer | Primary | Backup |
|---|---|---|
| Confidentiality | ML-KEM-1024 | X25519 |
| Forward secrecy | symmetric chain (every message) | PQ chain (every 100) |
| Post-compromise | PQ ratchet | QRNG injection |
| Authentication | ML-DSA-87 per message and handshake | KTS Merkle log |
| Server blindness | end-to-end ciphertext only | blinded participant hashes |
| At-rest erasure | FSOR envelope epochs | master-key rotation |
| Side channels | constant-time kernels | constant-time comparisons at every call site |
What we cannot promise
These come before the strengths, and without softening. The strengths are worth reading only because these are on the record.
- Zero knowledge of timing. The relay sees when ciphertext arrives and at what rate; statistical analysis can recover social-graph hints. Onion routing and decoy traffic mitigate — they do not eliminate.
- The compromised-instant message. Full state at time t plus all past ciphertext exposes the message at t; recovery begins at the next ratchet step, not before.
- A sustained physical-access attack on the device, or a compromised OS runtime beneath the app.
And the corresponding strengths, which hold by construction:
- The server cannot decrypt anything.
- Operator coercion cannot retroactively decrypt destroyed conversations.
- A quantum adversary recording today's traffic cannot read it later.
- Removed group members cannot read future group traffic.
References
-
QERYX Protocol Specification §12 —
docs/SPEC/10-threat-model.md, snapshot 2026-05-01, with per-attack source citations. - Q-Ratchet, FSOR, and Identity and KTS — the mechanisms this catalog leans on.
- Known Limitations and Open Work — the gaps, enumerated rather than implied.