Post-Quantum Encryption in Messaging, Explained

Post-quantum encrypted messaging is a way of protecting your conversations so that a future quantum computer cannot decrypt the messages you send today. It matters now — not in some distant sci-fi future — because the encrypted traffic you send this afternoon can be recorded and stored, then broken years later once the hardware catches up.

This post explains that threat in plain language: what "harvest now, decrypt later" means, why today's key exchange is the weak point, what ML-KEM and hybrid encryption actually do, and how Graphite fits in.

The threat isn't your ciphertext — it's your key exchange

When two people message with end-to-end encryption, the hard part isn't scrambling the message. Symmetric ciphers like AES or the stream ciphers inside NaCl are already believed to be resistant to quantum attacks (a quantum computer roughly halves their strength, which you fix by using a large enough key). If you want a refresher on the fundamentals, see what is end-to-end encryption.

The fragile part is how the two devices agree on a shared secret key in the first place. Almost every messenger does this with public-key cryptography — typically an elliptic-curve key exchange such as X25519. That handshake relies on a math problem (the elliptic-curve discrete logarithm) that classical computers can't solve in any reasonable time.

A large, fault-tolerant quantum computer changes that. Peter Shor's algorithm, published in 1994, can solve exactly the problems that RSA and elliptic-curve cryptography depend on. If such a machine is ever built at scale, the key-exchange step that protects most of today's encrypted messaging would no longer hold. The message body is safe; the key that unlocks it is not.

"Harvest now, decrypt later"

Here's the uncomfortable part. An attacker does not need a quantum computer today to threaten a conversation you have today. They only need to be patient.

The strategy — often called harvest now, decrypt later (HNDL) — works like this:

1. Capture. A well-resourced adversary records encrypted traffic as it crosses the network and stores it. They can't read it yet, but storage is cheap.
2. Wait. They hold that ciphertext for as long as it takes.
3. Decrypt. Once a capable quantum computer exists, they replay the recorded handshake, recover the key, and read everything.

That means the real question about any message you send is not "can it be read today?" but "will it still need to be secret in ten or fifteen years?" Medical history, legal matters, journalism, financial records, and personal relationships often have a very long shelf life. For those, HNDL is a genuine, present-tense reason to care — even though the quantum computer that would complete the attack doesn't exist yet.

What ML-KEM is, and why "hybrid" is the smart move

The cryptography community has spent years designing replacement algorithms whose security does not rest on problems Shor's algorithm can solve. In 2024, the U.S. National Institute of Standards and Technology (NIST) finalized the first standards. The headline key-exchange standard is ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), standardized as FIPS 203 and derived from the CRYSTALS-Kyber submission.

A key-encapsulation mechanism is just a modern way to establish a shared secret: one side generates a secret and "encapsulates" it against the other side's public key, and only the holder of the matching private key can recover it. ML-KEM's security rests on the hardness of lattice problems, which — as far as anyone currently knows — are hard for both classical and quantum computers. The suffix in ML-KEM-768 refers to its parameter set, a middle security level that balances strength against key and message size.

But newer does not automatically mean safer, and this is where hybrid matters. Post-quantum algorithms are younger and less battle-tested than the elliptic-curve cryptography we've relied on for decades. So the prudent design is to run both at once and combine their outputs:

• A classical exchange (X25519) — decades of scrutiny, trusted against today's computers.
• A post-quantum exchange (ML-KEM-768) — resistant to a future quantum computer.

The two shared secrets are mixed together so that an attacker must break both to recover the key. If a weakness is ever found in the new lattice scheme, the classical layer still protects you; if a quantum computer arrives, the post-quantum layer still protects you. You only lose if both fail — which is exactly the belt-and-suspenders property you want for something meant to stay private for decades.

Classical vs. post-quantum vs. hybrid, at a glance

Property	Classical (X25519 only)	Post-quantum only (ML-KEM)	Hybrid (X25519 + ML-KEM)
Safe against today's computers	Yes	Yes	Yes
Safe against a future quantum computer	No	Yes (as currently understood)	Yes
Decades of real-world scrutiny	Yes	Not yet	Yes (via the classical layer)
Resists "harvest now, decrypt later"	No	Yes	Yes
Fails only if...	ECC is broken	the new scheme is broken	both are broken

Why this protects the message you send today

The subtle, important point is timing. Post-quantum protection is not something you can bolt on later, after quantum computers arrive. By then, any conversation an adversary already captured is captured. The handshake has to be quantum-resistant at the moment the message is sent, because that recorded handshake is the thing a future machine would attack.

Adding a post-quantum layer today is what neutralizes harvest-now-decrypt-later. It closes the window on traffic being collected right now for a payoff years down the line.

Two things make this genuinely durable rather than a checkbox:

• Hybrid key exchange removes the single point of failure, as described above.
• Forward secrecy limits the blast radius even further. With a Signal-style double ratchet, the keys protecting your messages change constantly, so compromising one key doesn't unravel your entire history. We cover this in forward secrecy explained — it's the natural companion to post-quantum key exchange.

How Graphite applies this

Graphite is an end-to-end-encrypted messenger built by PrivacyPortal, and post-quantum protection is part of its core design rather than an add-on.

• Hybrid post-quantum key exchange. Graphite's encryption uses NaCl/libsodium X25519 sealed boxes with a hybrid post-quantum layer based on ML-KEM-768 layered on top — the belt-and-suspenders approach described above.
• Forward secrecy by default. A Signal-style double ratchet rotates keys continuously, so a single compromised key can't expose your conversation history.
• No account, no identifiers. There's no phone number and no email. Your identity is a 12-word recovery phrase generated on your device, and there's no account sitting on a server to target.
• A relay that never sees plaintext. Graphite's no-logs relay stores only sealed ciphertext with a 7-day maximum time-to-live, deletes it after delivery, and never sees your plaintext, your keys, or your recovery phrase.
• Network-level privacy. Traffic runs over Tor by default (fail-closed, to a bundled hidden service), which hides your IP and network path for signaling and messages. For live voice and video, call media is peer-to-peer over DTLS-SRTP, and on mobile calls are routed so the other person doesn't see your IP.

If you want the bigger picture of how these pieces fit together, our guide to the encrypted messenger walks through the whole model.

A fair note on the wider landscape: Signal is a genuinely private, well-respected app, and it has been rolling out its own post-quantum work — the industry is moving in this direction together. The honest framing isn't "everyone else is unsafe," it's that post-quantum key exchange is becoming the baseline expectation for anything meant to stay confidential for the long haul. (Different apps make different tradeoffs elsewhere — for example, Signal requires a phone number to register, whereas Graphite uses no phone number or email at all.)

The takeaway

Quantum computers capable of breaking today's key exchange don't exist yet. That's precisely why the time to protect a message is before it's sent. Hybrid post-quantum encryption — a trusted classical exchange combined with ML-KEM — is how you keep today's conversations private against tomorrow's hardware, while forward secrecy keeps any single failure contained.

Graphite is free and in public beta (v1.13.25), running on Windows (a portable .exe with bundled Tor), Android (a sideloaded APK that works on GrapheneOS and de-Googled phones with no Google Play Services), and the web. No phone number, no email, no logs.

Try it at graphite.chat and start sending messages that are built to stay private — this year and the ones after.