Signal smuggled 2,272-byte post-quantum keys through chat using erasure-coded chunks

According to Ars Technica, Signal Messenger published an October 2025 write-up on a further quantum-resistance update to the Signal Protocol, following the 2023 PQXDH handshake change. The handshake was safe against quantum attack, but the ephemeral keys in the ping-pong Diffie-Hellman ratchet were not. Signal chose to keep that battle-tested ratchet and add a third ratchet built on ML-KEM-768 instead of removing it.

The obstacle was size: an X25519 key is about 32 bytes, but the ML-KEM key plus ciphertext totals 2,272 bytes, a 71x increase, in a protocol that must work asynchronously over unreliable or hostile networks. Sending a key only every 50th message or weekly fails if messages are lost, or if an attacker drops the larger messages. Sending 71 chunks fails if an adversary keeps dropping one chunk.

Signal's answer was erasure codes: the key is broken into pieces so that only a sufficient subset of pieces is needed to rebuild it, tolerating packet loss. The KEM computation was also split into smaller steps so parts of the public key and ciphertext can be sent in parallel.

Split the big key into erasure-coded chunks sent across ordinary messages, so any large enough subset rebuilds it even if some are dropped.

Keeping the existing ratchets preserves battle-tested code and protection against today's classical attackers.

Erasure coding means any enough chunks rebuild the key, so dropped messages do not stall the exchange.

An attacker cannot block key renewal by dropping one specific packet, because no single chunk is required.

Splitting the KEM computations lets work run in parallel, limiting the performance cost.

When a new requirement is too big for one packet, split it so loss tolerance is built into the encoding, rather than hoping the stream stays intact.

A former Microsoft post-quantum lead called the design a solid, thoughtful improvement and noted optimisations that minimise network performance impact. The Ars piece frames Signal as an exception: only 18 percent of Fortune 500 networks and under half of TLS connections inside Cloudflare supported quantum-resistant TLS at the time. The excerpt does not give measured performance numbers.