← Knowledge base

Signal

Signal documents PQXDH for initial session establishment and introduced the Sparse Post Quantum Ratchet (SPQR) in October 2025. Its Triple Ratchet combines that ratchet with the existing Double Ratchet.

Evidence to collect

1. Record the app versions on the participating devices and consult Signal’s rollout documentation.
2. Distinguish initial key agreement, ongoing ratcheting, authentication, group messaging, and backups.
3. Do not infer a particular session’s algorithm from a safety number, chat date, or HTTPS handshake.
4. If the application exposes no reliable per-session evidence, report vendor-documented support and session status unknown. Do not delete chats to force a test.

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

• Signal PQXDH announcement
• Signal SPQR and Triple Ratchet announcement

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.