LibSignal Protocol Engine

X3DH establishes a shared secret key between two parties who mutually authenticate each other using Identity Keys (IK), Signed Prekeys (SPK), and One-Time Prekeys (OPK). PQXDH integrates Kyber-768 Post-Quantum KEM to resist future quantum computer decryption.

Sealed Sender prevents service providers and network observers from discovering who is talking to whom by encrypting sender identity inside an inner envelope authenticated with a Sender Certificate.

ZKGroup allows Signal clients to perform group operations (adding members, checking credentials) anonymously without leaking the user's profile key or group graph to central servers.

Safety numbers are 60-digit fingerprints derived by hashing sorted Identity Keys. Users compare these numbers in person or via QR code to detect Man-in-the-Middle attacks.