I've found the main part of the PQ3 protocol used in iMessage introduced in Apple's blog https://security.apple.com/blog/imessage-pq3/ is like combining the Signal protocol with a post-quantum KEM algorithm. But the PQ3 uses explicit authentication rather then the implicit authentication used in the Signal, and that means the PQ3 can't provide deniablity as the Signal do. Why is such choice made?

I understand an adversary who compromises the root key and the ratchet keys but not the authentication key can impersonate the user in Signal but can only decrypt the messages when using explicit authentication. But I think the scenario is quite limited. And the paper cited by the blog https://security.apple.com/assets/files/Security_analysis_of_the_iMessage_PQ3_protocol_Stebila.pdf says because of the intended application scenario for the PQ3 protocol, deniability is not an aim. What feature of the application scenario leads to that? And except that is there cryptographic reasons for doing so? Such as maybe an implict authentication is not safe enough when using KEM in the protocol.


1 Answer 1


Different services have different design goals. Signal has chosen to go with plausible deniability which makes it impossible to prove for certain that a message was sent by a specific user. iMessage has instead chosen to go with non-repudiability meaning that it is possible to prove for certain that a message was sent by a specific user.

This makes Signal the better choice for sending messages that could get you in trouble if they wound up in the wrong hands. Scenarios could include whistle-blowing and communication in regions of dictatorship.

iMessage would be the better choice for conversations where you might want to keep the message as proof of what someone has said. Could be useful when discussing a contract or if you end up in court and need to prove what you and the other person have previously said.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.