Versions and downgrade protection

Every client publishes, in its signed prekey bundle, the list of protocol versions it supports. Two clients always use the highest version both support.

Downgrade protection

An attacker who could make two 4.0 clients talk using 3.x would deprive them of post-quantum protection. To prevent this, the version lists are included in the handshake’s associated data. If both signed lists include 4 and the handshake used anything else, the recipient MUST abort and MUST warn its user.

An earlier draft of this section did not say clearly whether the check applied to the sender’s list, the recipient’s list or both. It applies to both. This ambiguity was reported in the 2026 audit as GL4-L5 and clarified before release.

Compatibility with 3.x

A 4.0 client talking to someone still on a 3.x client uses the 3.x handshake, and both apps show that the conversation is not yet protected against quantum computers. The conversation upgrades automatically, with no action from either person, once both have 4.0.

Relays running 3.9.4 remain in the directory until April 14, 2027. After that date, 4.0 clients will refuse 3.x handshakes and the directory will list only relays running 4.0 or later.