Paper 2026/2296

iX3DH: Post-Quantum Subversion-Resilient X3DH Key-Exchange from Isogenies

Abstract

Secure messaging runs on commodity devices that can be subverted by malware or supply-chain attacks. Reverse firewalls address this threat by interposing a user-side device that mediates the communication of a potentially compromised end-point. Recently, Dodis et, al. (CRYPTO 2025) proposed a reverse firewall design for protecting Signal, including its Diffie-Hellman based X3DH handshake, against subversion. With Signal and other platforms now migrating to post-quantum cryptography, however, extending this protection to post-quantum, Signal-conforming authenticated key exchanges (AKE) remains a challenge. We present iX3DH, a post-quantum X3DH-style protocol from commutative group-action Diffie-Hellman. Its public group-action values can be re-randomized by a reverse firewall, removing subliminal information from these values. We prove AKE security of iX3DH in the QROM against quantum polynomial-time adversaries, relying on the quantum-accessible group-action gap-CDH assumption, PRF security, and EU-CMA security of a PQ unique signature scheme. We then prove that the reverse firewalls are exfiltration-resistant and preserve security against subversions that maintain functionality and are explainable. To prevent subliminal channels within the signature transcript, we construct IBIS, the first candidate post-quantum unique signature scheme. By integrating IBIS with our firewall-friendly handshake, iX3DH achieves post-quantum AKE security under subversion attacks.