The adversary QERYX is built against: an active network attacker with full capability on every link, a server operator under legal coercion, compromised relay nodes, and a cryptographically-relevant quantum computer recording today's traffic for tomorrow's cryptanalysis. This paper enumerates twenty-one attack classes with the mitigation and the residual risk for each — including the attacks that remain possible, stated plainly.
The adversary
The in-scope attacker holds, simultaneously:
- full passive capture on every link — every ciphertext, forever;
- active manipulation — drop, reorder, inject, modify;
- legal coercion of the QERYX server operator;
- compromise of one or more relay nodes;
- a cryptographically-relevant quantum computer running Shor's algorithm against RSA, ECDSA, and classical Diffie–Hellman;
- harvest-now-decrypt-later recording against future cryptanalysis.
The endpoint adversary is bounded: a one-time read of a device's full cryptographic state followed by passive observation — the standard post-compromise-security model.
Out of scope, explicitly
- Continuous endpoint compromise. Persistent read/write on an unlocked device sees plaintext as it is typed. No protocol defends this; app-layer mitigations (integrity checks, panic wipe, duress unlock, decoy mode) reduce the window without pretending to close it.
- A compromised mobile OS supply chain. The platform's signed-OS chain and hardware keystore are the root of trust.
- Fully-resourced physical hardware extraction. A conditioned multi-source pool on the group plane and panic wipe raise the cost; a nation-state lab with the device in hand defeats most countermeasures, and we say so.
- Cross-app side channels — the OS sandbox is assumed intact.
The attack catalog
Twenty-one classes are analyzed in the source chapter. The highest-leverage rows:
| Attack | Mitigation | Residual risk |
|---|---|---|
| Passive eavesdrop + future quantum decryption | ML-KEM-1024 + X25519 hybrid at establishment; in-session PQ rekey in revision 2 |
a simultaneous break of both assumptions |
| Active machine-in-the-middle at handshake | KTS-bound identity keys; signed handshake legs; nonce echo | a user who accepts a key-change prompt without out-of-band verification |
| Replay | nonce echo, 5-minute handshake window, per-message keys, replay bitmaps | — |
| Downgrade | no negotiation variable exists: one KEM, one signature suite, byte-locked combiner version | — |
| Coerced operator | ciphertext-only content; FSOR envelope erasure on the REST ingress rows | the routing surface, including the conversation roster the relay authorizes against; connection-level metadata; live-coercion shadow copies before FSOR wraps — a policy-and-audit control, named in the FSOR paper |
| Operator key compromise | compile-time SHA-384 operator-key anchor, per-peer sequence-rewind refusal, gossiped root comparison | consistency proofs are not yet served, so a fork below the last root a device accepted is bounded only by the gossip cycle |
| One-time endpoint compromise | per-message symmetric hygiene in revision 1; PQ epoch recovery arrives in revision 2 | messages between compromise and the next ratchet step |
| Timing side channels on PQ primitives | audited secret-independent kernels; full implicit-rejection path; constant-time comparisons everywhere | — |
| Traffic analysis | nine-step payload padding ladder; device-side cover frames; onion routing when QLEAP arrives | a global passive adversary correlating timing across all hops; constant-rate cover for bulk transports is future work, and per-frame timing on a single connection is the residual |
| Coerced unlock at a border | duress unlock to a decoy scope, panic wipe | app-layer defenses over a deniable-encryption primitive — not absolute |
Defense in depth
Layered pairs, so the failure of any one layer does not fail the system:
| Layer | Primary | Backup |
|---|---|---|
| Confidentiality | ML-KEM-1024 | X25519 |
| Forward secrecy | symmetric chain (every message) | PQ chain (revision 2) |
| Post-compromise | session re-establishment (PQ epoch in revision 2) | entropy re-injection (revision 2) |
| Authentication | ML-DSA-87 on the handshake, the prekey bundle and every sender-key distribution; per-message integrity by the ratchet AEAD tag | KTS Merkle log |
| Content blindness | end-to-end ciphertext only | FSOR envelope wrap on REST-ingress rows |
| At-rest erasure | FSOR envelope epochs | master-key rotation |
| Side channels | constant-time kernels | constant-time comparisons at every call site |
What we cannot promise
These come before the strengths, and without softening. The strengths are worth reading only because these are on the record.
- Zero knowledge of timing. The relay sees when ciphertext arrives and at what rate; statistical analysis can recover social-graph hints. Decoy traffic mitigates — it does not eliminate; onion routing will add to it with QLEAP.
- The compromised-instant message. Full state at time t plus all past ciphertext exposes the message at t; recovery begins at the next ratchet step, not before.
- A sustained physical-access attack on the device, or a compromised OS runtime beneath the app.
And the corresponding strengths, which hold by construction:
- The server cannot decrypt anything.
- Operator coercion cannot retroactively decrypt destroyed conversations.
- A quantum adversary recording today's traffic cannot read it later.
- Removed group members cannot read future group traffic.
References
-
QERYX Protocol Specification §12 —
docs/SPEC/10-threat-model.md, snapshot 2026-05-01, with per-attack source citations. - Q-Ratchet, FSOR, and Identity and KTS — the mechanisms this catalog leans on.
- Known Limitations and Open Work — the gaps, enumerated rather than implied.