Changes in 4.0
- New hybrid handshake combining X25519 with ML-KEM-768 (section 4).
- Post-quantum refresh in the ratchet every fifty messages or seven days (section 5).
- Mailbox replication, session resumption, resumable transfers, batched acknowledgements and a smaller routing header (section 8).
- Relays reject non-conforming padding (GL4-M1).
- Clients pin the key transparency log’s signing key (GL4-M3).
- Invitations no longer reveal group size (GL4-L4).
- The downgrade check is specified for both parties (GL4-L5).
- Directory signers use hybrid signatures.
- Relay logging limited to hourly counters with no connection times (GL4-L1).
Version history
| Version | Released | Highlights | Audit |
|---|---|---|---|
| 1.0 | June 14, 2011 | End-to-end encryption, two relays in Chiba | — |
| 2.0 | June 17, 2014 | Mailbox relays and the signed hourly directory | 2014 |
| 2.4 | September 21, 2015 | Probation for new relays, bridges | — |
| 2.8 | May 8, 2017 | Faster directory downloads, a rewritten Android client | 2018 |
| 3.0 | May 10, 2022 | Sealed sender, padding buckets, key transparency, travel mode | 2022 |
| 4.0 | October 14, 2026 | Post-quantum handshake, faster delivery on poor connections | 2026 |
Acknowledgments
The editors thank Pauley & Finn Security, whose auditors have reviewed every major version since 2014 and improved each one; Wystan Frauka, who designed the cover traffic scheme and has spent a decade making messages harder to notice; the directory signers and key transparency witnesses; and the people who tested release candidates of 4.0 on the slowest, least reliable connections they could find, and told us exactly what they thought.
This specification is published under the Creative Commons Attribution 4.0 license. Implementations are welcome and need no permission.