Home›Products›QS3 Ratchet
LIVE — PROTOCOL · CRYPTO ENGINE

QS3™ Ratchet

FORWARD-SECRET POST-QUANTUM PROTOCOL

QuantaShield's KEM double ratchet gives every message its own single-use key. Compromise a device and past messages stay sealed; keep listening and the session locks you out after one round trip. Hybrid classical + post-quantum, end to end.

X25519 + ML-KEM-768Forward secrecySelf-healingML-DSA-65 signed
PROTOCOL SNAPSHOT
Handshake — X25519 + ML-KEM-768 → HKDF
↓ root key established
Turn — fresh ML-KEM-768 encapsulation
↓ chains advance one-way per message
Message — single-use key · AES-256-GCM
Key exchangeX25519 + ML-KEM-768 (hybrid)
Per-message keysHKDF-SHA-256 chains, single-use
AEADAES-256-GCM, header bound as AAD
AuthenticationML-DSA-65 (NIST FIPS 204)
Healing timeOne round trip after compromise
One protocol, every product — QS3 lives in the shared crypto engine
pqc-core Engine
SHIPPED
QS3 ships in the shared cryptographic engine that powers every QuantaShield product
Browser Lab
LIVE
Full protocol running live in your browser with a state-theft experiment
QVault Sharing
ROADMAP
Device-to-device file sharing upgraded from one-shot envelopes to ratchet sessions
Mobile & Desktop
ROADMAP
Session-based sync and messaging across enrolled devices
Security Properties

Built for the day your device is compromised

One Key Per Message
Message keys come off a one-way HKDF-SHA-256 chain and are erased immediately after use. A leaked key opens exactly one message — never a conversation.
Hybrid Post-Quantum Ratchet
Every conversation turn runs a fresh ML-KEM-768 (FIPS 203) encapsulation on top of a hybrid X25519 + ML-KEM-768 handshake. Breaking a session requires beating both classical and post-quantum cryptography.
Self-Healing Sessions
Steal a device's complete secret state — root key, chain keys, ratchet private key — and the protocol locks the thief out again after one round trip. Fresh KEM entropy every turn is the cure.
Forward Secrecy
Key chains only run forward. Traffic recorded today and state stolen tomorrow still cannot decrypt yesterday's messages — the "harvest now, decrypt later" attack comes up empty.
ML-DSA-65 Authentication
Every packet can be signed with ML-DSA-65 (FIPS 204), binding messages to a registered device identity. Tampered headers fail AEAD; forged signatures are rejected before any state changes.
Engineered for Real Networks
Out-of-order delivery, replay rejection, bounded skipped-key caching, and transactional decryption — a malformed or forged packet can never poison session state.
How it works

The ratchet in 4 steps

01
Hybrid handshake
The initiator dual-encapsulates to the responder's long-term QS2 key: ML-KEM-768 + ephemeral X25519, combined through HKDF-SHA-256 into the session root key. The first message rides inside the INIT packet.
02
Ratchet every turn
Each time a party replies, it mints a brand-new ML-KEM-768 key pair and encapsulates to the peer's newest ratchet key, evolving the root key with fresh post-quantum entropy.
03
Chain every message
Within a turn, message keys advance down a one-way HKDF chain — derived, used once for AES-256-GCM, and destroyed. Out-of-order messages use banked single-use keys.
04
Heal after compromise
A thief holding a full state snapshot reads at most the current chain. One round trip later, the ratchet has moved through key material the thief never saw — permanently locked out.

Watch it survive a state theft — live

A real Alice↔Bob ratchet running in your browser. Hand an eavesdropper a device's complete secret state and watch the session heal.

QS3™, QS2™ and QuantaShield™ are trademarks of QuantaShield. The QS3 protocol composes NIST-standardized primitives (FIPS 203, FIPS 204) with RFC 7748 and RFC 5869; the underlying algorithms are public standards.