Security,
by design.

X3DH

X3DH establishes a shared secret between two parties who have never met before, using a bundle of pre-published public keys. It's asynchronous — you can send the first message to someone who's offline. This is how the very first message in a new conversation is encrypted.

// Extended Triple Diffie-Hellman
// Four elliptic curve operations produce SK

pub fn x3dh_initiate(
    ika: &IdentityKey,
    bob_bundle: &PreKeyBundle,
) -> Result<SharedSecret> {
    let ek_a = EphemeralKey::generate();
    
    let dh1 = DH(ika, bob_bundle.spk);
    let dh2 = DH(ek_a, bob_bundle.ik);
    let dh3 = DH(ek_a, bob_bundle.spk);
    let dh4 = DH(ek_a, bob_bundle.opk?);
    
    let sk = KDF(dh1 || dh2 || dh3 || dh4);
    Ok(SharedSecret(sk))
}

Double Ratchet

After the initial handshake, every message uses a fresh encryption key derived from a ratcheting chain. If a key is compromised, past messages stay safe (forward secrecy). New messages recover automatically (post-compromise security). This is the same protocol Signal and WhatsApp use.

// Double Ratchet — derive fresh key per message
impl RatchetState {
    pub fn encrypt(&mut self, pt: &[u8]) -> Ciphertext {
        // Symmetric-key ratchet
        let (ck_next, mk) = kdf_ck(self.chain_key);
        self.chain_key = ck_next;
        self.n += 1;
        
        // AEAD encryption with fresh key
        let ct = aes_256_gcm_encrypt(mk, pt, self.ad());
        
        // Burn the message key after use
        drop(mk);
        
        Ciphertext { n: self.n, ct }
    }
}

AES-256-GCM

The actual message bytes are encrypted with AES-256 in Galois/Counter Mode — a widely deployed AEAD (Authenticated Encryption with Associated Data) cipher. It provides both confidentiality and integrity in a single operation. Hardware-accelerated on every modern CPU.

// AES-256-GCM — AEAD cipher
use aes_gcm::{Aes256Gcm, Nonce, KeyInit};

pub fn encrypt(
    key: &[u8; 32],
    nonce: &[u8; 12],
    pt: &[u8],
    ad: &[u8],
) -> Vec<u8> {
    let cipher = Aes256Gcm::new(key.into());
    cipher
        .encrypt(Nonce::from_slice(nonce), Payload {
            msg: pt,
            aad: ad,
        })
        .expect("encryption never fails")
}

ML-KEM-768 (Kyber)

A classical Diffie-Hellman handshake can be broken by a sufficiently powerful quantum computer. ML-KEM-768 (formerly Kyber) is the NIST-standardized post-quantum KEM that we combine with X25519 in a hybrid construction. If quantum computers break ECC tomorrow, your messages stay safe.

// Hybrid KEM — X25519 + ML-KEM-768
use ml_kem::{MlKem768, EncodedSizeUser};

pub fn hybrid_encapsulate(
    recipient: &HybridPublicKey,
) -> (SharedSecret, HybridCiphertext) {
    // Classical part
    let (ss_classic, ct_classic) = 
        x25519_encap(&recipient.x25519);
    
    // Post-quantum part
    let (ss_pq, ct_pq) = 
        MlKem768::encapsulate(&recipient.kyber);
    
    // Combine — safe if EITHER is secure
    let ss = KDF(ss_classic || ss_pq);
    (ss, HybridCiphertext { ct_classic, ct_pq })
}