PARITY: post-quantum is shipped on both clients #90

2026-09-05T00:29:03Z

paulhitt commented

2026-09-05 00:29:03 +00:00

(Migrated from gitlab.com)

Both rows said /and the note under them said "neither client does
post-quantum anything today". That was wrong in the understating
direction — the same direction relay#45 warns about, and the same one that
had the comparison page scoring Signal unfairly in our favour.

Android uses BouncyCastle's ML-KEM (FIPS 203), shipped in the engine.
The old note's "no ML-KEM at any API level" was about the PLATFORM, which
is true and is why the engine carries its own — not a reason it has none.
iOS uses CryptoKit MLKEM768, unconditional since project.yml moved
the deployment target to 26.0. The runtime gate that made those files
inert is gone, and PQKEM.swift says so at the top.

Corrected by a run rather than by reading the source, which is the rule
this file keeps to. test/interop-swift-kotlin.mjs establishes it end to
end in both directions: "Android picks v3 for an iPhone peer", "the first
Android envelope carries a PQ ratchet step", "the iPhone agrees the session
is v3", "a v3 session survives being archived and restored
mid-conversation".

The honest limit is unchanged and kept: it counts only once BOTH ends
have it, so today that means two Android phones — or an Android phone and
an iPhone running a build that has not shipped.

Found while correcting relay#11, where I went in expecting to find our own
cells overstated and found the opposite.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Both rows said /and the note under them said "neither client does post-quantum anything today". That was wrong in the understating direction — the same direction relay#45 warns about, and the same one that had the comparison page scoring Signal unfairly in our favour. - **Android** uses BouncyCastle's ML-KEM (FIPS 203), shipped in the engine. The old note's "no ML-KEM at any API level" was about the PLATFORM, which is true and is why the engine carries its own — not a reason it has none. - **iOS** uses CryptoKit `MLKEM768`, unconditional since `project.yml` moved the deployment target to 26.0. The runtime gate that made those files inert is gone, and `PQKEM.swift` says so at the top. Corrected by a run rather than by reading the source, which is the rule this file keeps to. `test/interop-swift-kotlin.mjs` establishes it end to end in both directions: "Android picks v3 for an iPhone peer", "the first Android envelope carries a PQ ratchet step", "the iPhone agrees the session is v3", "a v3 session survives being archived and restored mid-conversation". The honest limit is unchanged and kept: it counts only once BOTH ends have it, so today that means two Android phones — or an Android phone and an iPhone running a build that has not shipped. Found while correcting relay#11, where I went in expecting to find our own cells overstated and found the opposite. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

paulhitt commented

2026-09-05 00:29:03 +00:00

(Migrated from gitlab.com)

assigned to @paulhitt

paulhitt (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed 2026-09-05 00:29:13 +00:00

paulhitt commented

2026-09-05 00:30:07 +00:00

(Migrated from gitlab.com)

mentioned in commit 17dbb186a8

mentioned in commit 17dbb186a8e99cb063a4ad94f58bbd3c7ab4823c

paulhitt (Migrated from gitlab.com) merged commit 17dbb186a8 into main

2026-09-05 00:30:07 +00:00

paulhitt commented

2026-09-09 19:01:19 +00:00

(Migrated from gitlab.com)

changed the description

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-messenger-android#90