Messaging applications use so-called end-to-end cryptographic systems that prevent anyone other than the sender or receiver from intercepting a communication. Until now, cryptographic keys have been very effective in preventing attacks because computers have not had enough computing power to decrypt messages. But on the horizon looms the threat of future quantum computers, which one day will be able to unravel these keys. Apple’s security team says it has remedied that possibility before it becomes a reality. The system is called PQ3 and will work on the iOS17.4 update that Apple will release in March.
Apple’s security team assures that, although until now computers have not been able to solve the complex mathematical problems of encrypted systems, “the rise of quantum computing threatens to change the equation.” A quantum computer with enough power could find a way to crack the protections “fast enough to threaten the security of end-to-end encrypted communications.”
This is not a problem yet, because quantum computers have not been built yet. Most of the projects underway depend on large companies, such as IBM or Google, or institutions, such as the Barcelona Supercomputing Center (BSC), but Apple believes that “attackers with many resources can already prepare for their possible arrival by taking advantage of the strong “declining modern data storage costs.”
One of the techniques of malicious attackers who cannot overcome a security system is to store data waiting for technology, over time, to help them overcome these barriers. “Even if they can’t decrypt any of this data today,” Apple says, “they can keep it until they acquire a quantum computer that can decrypt it in the future, an attack scenario known as Harvest Now, Decrypt Later.”
Between apps without cryptographic security and those that use (or will use in the future) an uncrackable system, no standard rating has been established, so Apple has created its own scale. Level 0 is for apps without encryption, at level 1, with extreme encryption but without quantum security, most applications would be found today, including iMessage. At level 2, which already establishes post-quantum security in the initial establishment of keys, would be Signal, the most advanced in protection.
Unlike Signal, Apple claims iMessage is at level 3 because its keys change continuously. The apple company explains that its system is capable of “quickly and automatically restoring the cryptographic security of a conversation, even if a certain key is compromised”, a feature that Signal does not have at the moment. That protection is called PQ3, and its authors consider it “the greatest protection against quantum attacks.” iMessage support for PQ3 will begin rolling out in March with public versions of iOS 17.4, iPadOS 17.4, macOS 14.4, and watchOS 10.4.
“Rather than simply replacing an existing algorithm with a new one, we have rebuilt the iMessage cryptographic protocol from the ground up to advance the state of the art of end-to-end encryption,” says Apple’s security team, explaining that they have met all a series of requirements that will make your application a system that not even a quantum computer will be able to break.