Umbera messenger developer has published the full cryptographic core and a set of reproducible Rust tests that let anyone verify the hybrid post-quantum message sealing mechanism used in the application.
The scheme derives the message encryption key from two independent shared secrets: a classical X25519 Diffie-Hellman exchange and a post-quantum ML-KEM-1024 encapsulation. An ephemeral X25519 key pair is generated for every message, combined with the recipient’s long-term X25519 key, while an ML-KEM-1024 encapsulation is performed against the recipient’s Kyber public key. The two shared secrets are concatenated and passed through HKDF-SHA256 with a domain label; the first 32 bytes become the AES-256-GCM key.
Because the final key depends on both secrets, compromise of either algorithm alone does not expose the plaintext. The design therefore provides a hedge against both future cryptanalytic breaks in ML-KEM and the arrival of cryptographically relevant quantum computers capable of solving the discrete-log problem.
Inside the sealed envelope the sender identity is encrypted together with the message (sealed sender), so the relay never sees who is communicating with whom. Only a box identifier and an opaque ciphertext blob are stored; weekly rotating addresses are computed from the shared secret known exclusively to the two correspondents.
Voice and video calls are protected by DTLS-SRTP negotiated end-to-end. The TURN relay observes only encrypted datagrams and cannot extract fingerprints or metadata that would allow call correlation.
Seven Rust tests exercise the exact construction used in production (function createSealedSenderHybridPQ). A simple packet capture is sufficient to confirm that media traffic remains encrypted under the negotiated SRTP keys. All tests and the reference implementation are publicly available so that independent researchers can reproduce the security claims with a single command.
