Apple today revealed a new approach to cryptography for iMessage that focuses on combating future attacks facilitated by quantum computers. The company will begin rolling out the new protocol as part of the iOS 17.4 update, with a full launch planned later this year.
According to Apple, the “groundbreaking” protocol, dubbed PQ3, aims to protect iMessage against “highly sophisticated quantum attacks” that could become a reality once quantum computers become commercialized. The new PQ3 protocol is the first ever to reach the so-called Level 3 security, surpassing all encryption standards currently available in apps like Signal and WhatsApp. Apple researchers further claim that PQ3 is the strongest encryption protocol in the world.
PQ3 represents a preemptive step from Apple against quantum computing which is powerful enough to break traditional mathematically-based encryption protocols in use today including RSA, Elliptic Curve signatures, and more. Even if quantum computers today are still in the experimental stage, hackers can collect encrypted data now in hopes of breaking them in the future in what is known as “Harvest Now, Decrypt Later.” PQ3 aims to eliminate this problem by providing a quantum-resilient encryption protocol for iMessage conversations today.
PQ3 is described as a post-quantum cryptography (PQC) protocol. PQCs are defined as the stepping stone for quantum-resilient protocols that can run on classical computers today without the need for quantum machines. PQCs should theoretically remain secure from future quantum computers once they become available.
Apple says that PQ3 will start rolling out gradually with the public launch of the iOS 17.4, iPadOS 17.4, watchOS 10.4, and macOS 14.4 updates, and is already available on the latest betas. All participating contacts in a single iMessage chat must be running those updates to take advantage of PQ3. Full support for PQ3 on all iMessage conversations will be completed later this year. Apple has not shared any plans for PQ3 adoption on visionOS and Vision Pro.
Apple described PQ3 as being built from the ground up and features a post-quantum Kyber public encryption key generated locally on-device before being transmitted to Apple servers. PQ3 also includes support for periodic rekeying that protects against key compromises and can regenerate new encryption keys that cannot be inferred from previous ones. Apple says that PQ3 is the first large-scale protocol to feature post-quantum rekeying.
More about PQ3 and PQC can be learned from this blog entry provided by the Apple Security Engineering and Architecture team.
