After the handshake, each message is encrypted with its own key, derived from a ratchet that moves forward with every message and every reply. Old keys are deleted as soon as they have been used, so stealing a device today does not reveal yesterday’s messages.
The double ratchet
Glossia uses a double ratchet. A symmetric chain derives a new message key for every message sent; a Diffie–Hellman ratchet mixes fresh X25519 key material into the conversation every time the direction of conversation changes. Once an attacker who briefly stole a device’s keys loses access, the next exchange of replies locks them out again.
Post-quantum refresh
New in 4.0, the ratchet also refreshes its post-quantum protection. Every fifty messages, or every seven days, whichever comes first, the sending client encapsulates a fresh ML-KEM-768 secret to the recipient’s current ratchet key and mixes it into the root key. This keeps long conversations protected even if a quantum adversary someday recovers the classical key material.
root_key, chain_key = HKDF-SHA-256(
salt = root_key,
ikm = DH_output || KEM_secret, KEM_secret is empty between refreshes
info = "Glossia 4.0 ratchet"
)Out-of-order messages
Messages often arrive out of order on poor connections. A client MAY keep the keys for skipped messages so that late arrivals can still be read, but MUST discard them after fourteen days or once 1,000 have accumulated, whichever comes first.
Disappearing messages
Either party may set a timer, from thirty seconds to four weeks, after which both clients delete a message. The timer is part of the encrypted message and is enforced by the clients; relays cannot see it. A recipient can always copy a message before it disappears, and the specification does not pretend otherwise.