Evaluation of Integrating Post-Quantum Cryptography for Signal Desktop

Quantum computing poses a serious long-term risk to modern cryptographic systems, including the widely used Signal messaging protocol. This research work addresses that risk by integrating ML-KEM-768, a NIST-standardized post-quantum algorithm specified in FIPS 203, as an additional security layer within Signal Desktop. The proposed implementation applies a quantum-resistant wrapping layer to message content before encryption by Signal’s existing Double Ratchet protocol, thereby creating a hybrid cryptographic design that strengthens protection against both classical and quantum adversaries. The system uses ML-KEM-768 key encapsulation from the @noble/post-quantum library together with AES-256-GCM authenticated encryption from @noble/ciphers. This process produces 1088-byte KEM ciphertexts with 32-byte shared secrets and adds about 1104 bytes of overhead per message. Performance evaluation using two live Signal Desktop instances shows that the additional post-quantum layer introduces only modest latency. ML-KEM-768 encapsulation averages 0.67 ms, decapsulation averages 2.27 ms, and total message preparation overhead averages 13.0ms, which remains well below the 100 ms threshold commonly associated with instantaneous user interaction. Additionally, a second set of experiments evaluated image attachment encryption (100 KB, 500 KB, and 2 MB), confirming that ML-KEM-768 encapsulation cost remains constant at approximately 0.4 ms regardless of payload size while AES-256-GCM bulk encryption scales linearly, making the post-quantum overhead negligible for large media. A third stress test evaluated robustness under load, achieving 913 messages per second in burst mode with sub-millisecond wrap latency, and confirming stable performance with no degradation across sustained operation at 10 messages per second over 60 s. Overall, this work demonstrates that post-quantum cryptography can be integrated into a real messaging system in a practical manner, helping address the harvest now, decrypt later threat while preserving usability and strengthening long-term communication security.