← Knowledge base

iMessage and PQ3

Apple’s PQ3 design combines post-quantum initial key establishment with ongoing rekeying for iMessage. This is application encryption, separate from TLS to Apple services.

Evidence to collect

1. Review Apple’s supported operating-system releases and rollout conditions for all participants.
2. Confirm the conversation uses iMessage; do not transfer PQ3 claims to SMS, RCS, or another fallback.
3. Separate vendor-documented protocol support from direct proof about one conversation. OS version is inventory, not a captured handshake.
4. Assess device compromise, backups, and account recovery separately. No undocumented log marker is used here as proof.

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

• Apple PQ3 protocol design
• Apple Platform Security

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.