A Call to Action: Transitioning Signal's Private Group System to Quantum-Safe
No ratings
Presented at Real World Crypto 2026 by
Today's real-world cryptographic systems face the challenge of transitioning to quantum-safe, both quickly and efficiently. But what if a system's cryptography is so complex that no fully quantum-safe solution exists today, yet the quantum threat of Harvest-Now-Decrypt-Later (HNDL) attacks is already pressing? In this talk, we study such a deployment, Signal's Private Group System, and discuss how a careful design analysis can enable transitioning the most vulnerable components first, while maintaining both efficiency and a pathway to full quantum safety. Signal's so-called Private Group System allows users to manage groups (creation, adding/removing members, etc.) in a privacy-preserving manner, i.e., such that the server never learns the members of the group while simultaneously being able to check the legitimacy of these operations. Signal's current system uses an elaborate combination of classical primitives (zero-knowledge proofs, verifiable encryption, oblivious pseudorandom functions, etc.), combined in complex and non-black-box ways. This makes transitioning to quantum-safe challenging, yet such transition is urgent: social graph information and group membership data is highly privacy-sensitive, making Signal's Private Group System a primary target for HNDL attacks. In this talk, we will present ongoing work on transitioning Signal's Private Group System. We propose to carefully rethink the design of complex cryptographic systems to focus on countering the HNDL threat first, while keeping a pathway to a fully quantum-safe system open. Our approach reduces the need for advanced building blocks as much as possible and avoids non-black-box use of primitives, e.g., by shifting some responsibilities from the server to the clients. At the example of Signal's Private Group System, we will discuss lessons learned and quantum-safe migration strategies that are applicable more broadly to today's real-world cryptographic systems.