Apple iMessage to get post-quantum cryptography security upgrade against cyber threats

Apple iPhone 15 Plus.

DH Photo/KVN Rohit

When iMesage app made its debut on 2011, it was one of the first to offer end-to-end encryption by default, giving users the most secured messaging platform to share personal messages without any scope of getting pried on.

To establish secure end-to-end encrypted connections between devices, Apple's iMessage relies on key cryptography protocols such as RSA (Rivest–Shamir–Adleman) public-key cryptosystem, Elliptic Curve signatures, and Diffie-Hellman key exchange.

Though these protocols are really tough to crack for even the most learned hacker with an top-end computer, but things particularly in the age of Artificial Intelligenc and quantum computing are always fast-evolving.

Cyber criminals are now capable of developing ingenious quantum computational methods to breach security of phones, decrypt sensitive details shared on messenger apps used by high-value targets such as opposition politician, top government official, celebrities, investigative journalists and human rights activists, and others.

Now, to tackle such emerging cyber threats, Apple will soon be bringing Post-quantum cryptography protocol PQ3 to iMessage.

PQ3 is touted to have the strongest security attributes of any at-scale messaging protocol in the world. With this upgrade, iMessage will be most secured messaging platform globally.

The iMessage PQ3 protocol is a well-designed cryptographic protocol for secure messaging that uses state-of-the-art techniques for end-to-end encrypted communication. In my analysis using the reductionist security methodology, I confirmed that the PQ3 protocol provides post-quantum confidentiality, which can give users confidence in the privacy of their communication even in the face of potential improvements in quantum computing technology

Douglas Stebila, Professor of cryptography at Department of Combinatorics & Optimization, University of Waterloo

Every message on the iMessage will be individually signed with ECDSA (Elliptic Curve Digital Signature Algorithm) using the elliptic curve P-256 device authentication key protected by the Secure Enclave (on Apple device). The receiving device will be able to verify the mapping between the sender’s identifier (email address or phone number) and the public key used for signature verification. If both users have enabled Contact Key Verification and verified each other’s account key, the device verifies that the device authentication keys are present in the Key Transparency log and that the corresponding account key matches the account key stored in the user’s iCloud Keychain. This protocol ensures that the message never gets intercepted at any point when exchanged between two devices.

Quantum-Security Cryptography in Messaging Apps.

Photo Credit: Apple

"Building on its pioneering legacy as the first widely available messaging app to provide end-to-end encryption by default, iMessage has continued to deliver advanced protections that surpass existing systems. iMessage Contact Key Verification is the most sophisticated key transparency system for messaging deployed at scale, and is the current global state of the art for automatic key verification. And the new PQ3 cryptographic protocol for iMessage combines post-quantum initial key establishment with three ongoing ratchets for self-healing against key compromise, defining the global state of the art for protecting messages against Harvest Now, Decrypt Later attacks and future quantum computers," the company said.

The new PQ3 upgrade is coming to the iMessage with the iOS 17.4, iPadOS 17.4, macOS 14.4, and watchOS10.4 updates, which are most likely to release in March.

Once updated, iMessage will have compromise-resilient encryption and extensive defences against any highly sophisticated quantum attacks in future.

Get the latest news on new launches, gadget reviews, apps, cybersecurity, and more on personal technology only on DH Tech