news.volyx.in

iMessage with PQ3 Cryptographic Protocol (security.apple.com)

557 points by galad87 · 908 days ago · 267 comments on HN

Article summary

Apple has introduced a new post-quantum cryptographic protocol called PQ3 for iMessage, which provides end-to-end encryption and protection against quantum attacks. The protocol uses a hybrid design that combines Elliptic Curve cryptography with post-quantum encryption and includes a periodic rekeying mechanism to self-heal from key compromise. PQ3 is considered to be the first large-scale messaging protocol to reach Level 3 security, providing protocol protections that surpass those in other widely deployed messaging apps. The new protocol will start rolling out with the public releases of iOS 17.4, iPadOS 17.4, macOS 14.4, and watchOS 10.4.

Main themes

  • Post-Quantum Cryptography
  • End-to-End Encryption
  • iMessage Security
  • Quantum Computing Threats
  • Messaging App Security
  • Data Protection

What commenters say

  • The iCloud Backup problem still exists, and the only solution is to turn on Advanced Data Protection, which is not enabled by default.
  • iMessage's end-to-end encryption is not truly secure because the keys are escrowed to Apple, allowing them to access and decrypt messages.
  • Signal's lack of backup feature on iOS and related platforms is a significant drawback for many users who want to retain their message history.
  • Apple's default configuration of iMessage and iCloud is not end-to-end encrypted, and this is a misleading and potentially fraudulent claim.
  • The introduction of PQ3 is a significant upgrade to iMessage's security, but it does not address the existing issue of iCloud Backup vulnerability.
  • The need for backups and data retention is a trade-off between security and convenience, and different users have different priorities.
  • Apple's decision to offer an E2EE iCloud backup option is a step in the right direction, but the default configuration should be changed to prioritize security.
  • The concept of end-to-end encryption is being misapplied to iMessage because it only refers to the transmission of data, not the storage or backup of data.