Glossia 4.0 starts every new conversation with a hybrid handshake. It combines four elliptic-curve Diffie–Hellman exchanges, as in earlier versions, with a key encapsulation using ML-KEM-768, a post-quantum algorithm standardized in 2024. An attacker must break both to learn the shared secret.
The reason is simple. Messages can be recorded today and stored until someone builds a computer able to break elliptic-curve cryptography. For most people that is a distant worry. For a reporter protecting a source who will still be alive in twenty years, it is not.
Computing the shared secret
Alice starts a conversation with Bob. She fetches Bob’s prekey bundle, verifies it and generates an ephemeral X25519 key pair EK_A. She then computes:
DH1 = X25519(IK_A, SPK_B)
DH2 = X25519(EK_A, IK_B)
DH3 = X25519(EK_A, SPK_B)
DH4 = X25519(EK_A, OPK_B) if Bob has a one-time prekey left
(CT, SS) = ML-KEM-768.Encaps(PQPK_B)
SK = HKDF-SHA-256(
salt = 0x00 * 32,
ikm = 0xFF * 32 || DH1 || DH2 || DH3 || DH4 || SS,
info = "Glossia 4.0 hybrid handshake"
)Alice deletes EK_A’s private key and the individual DH outputs as soon as SK is computed. She sends Bob an initial message containing her identity key, EK_A’s public key, the ciphertext CT, the identifiers of the prekeys she used and her first message, encrypted under a key derived from SK.
Associated data
Both parties bind the handshake to their identities by using AD = encode(IK_A) || encode(IK_B) || versions as associated data for the first message, where versions is the signed list of protocol versions each client supports. Changing any of these makes the first message fail to decrypt.
Completing the handshake
Bob repeats the computation with his private keys, decapsulates CT with his post-quantum prekey, and decrypts the first message. He then deletes the one-time prekey Alice used. If decryption fails, Bob MUST discard the message and MUST NOT tell Alice why.