Session says it has implemented the core cryptography for its Protocol v2 upgrade, moving the decentralized messenger closer to perfect forward secrecy, post-quantum encryption, and stronger controls over linked devices.
Session said it has published the protocol specification and implemented encryption for one-to-one messages and verified device linking in libsession, the shared cryptographic library used across its clients.
Session is a messaging service whose decentralized infrastructure presents different challenges from systems that use central servers to distribute encryption keys and coordinate devices. Protocol v2 introduces rotating account and device keys to provide forward secrecy within that architecture.
Forward secrecy and quantum-resistant encryption
Forward secrecy limits the exposure of past communications if encryption keys are later compromised. Under the proposed design, account and device keys will rotate approximately every 12 hours, with randomized timing intended to reduce conflicting updates and obscure how many devices an account uses.
Old keys will be deleted after 16 days, covering the network’s 14-day message storage period plus a buffer for offline devices. Once those keys are erased, a later compromise should not allow an attacker to decrypt previously captured messages protected by them.
Linked devices will exchange private keys through encrypted device group data, rather than through the permanent account key. Consequently, obtaining that long-term key alone would not reveal past message keys.
For quantum resistance, Session has confirmed a hybrid approach that combines ML-KEM-768 and X25519 through the X-Wing construction. Each message will use a secret derived from both mechanisms, aiming to preserve confidentiality even if one is broken.
The protection targets “harvest now, decrypt later” attacks, where adversaries collect encrypted communications for future decryption using more capable quantum computers.
Device verification and gradual rollout
Device linking will also change substantially. Users will need to confirm matching emoji sequences on both screens before a new device joins an account. Devices will have separate identities and descriptions, allowing users to inspect which endpoints have access.
Removing a device will rotate account keys and prevent it from reading new messages. Session says competing devices using the same identity will either lose access during rotation or trigger a visible warning.
The rollout will be gradual. Recent releases (iOS 2.15.5, Android 1.33.6, and Desktop 1.18.2) already recognize v2 messages, retaining them behind an update prompt instead of discarding them.
Once enabled, clients will automatically use v2 when a contact publishes compatible keys. The plan includes at least six months of v1 compatibility, with the interface indicating weaker encryption. A separate fallback for long-inactive accounts means the strongest protections will not apply to every message.
An account can migrate only when all linked devices support v2. Developers are considering an invite-only alpha before broader beta testing, but have not announced a release date.
Leave a Reply