Researchers from the University of Wuppertal have published a paper analysing TutaCrypt, a post-quantum protocol deployed by Tuta Email and currently securing more than ten million accounts worldwide against future quantum decryption.
The researchers examined how TutaCrypt combines traditional encryption with post-quantum cryptography and proved the security guarantees it provides against both today’s computers and future quantum computers.
TutaCrypt
TutaCrypt was designed to defend against “store now, decrypt later” attacks. In these attacks, someone collects encrypted emails today and waits until quantum computers become powerful enough to break older encryption methods. To address this, the protocol combines classical Diffie-Hellman cryptography with the post-quantum standard ML-KEM, formerly known as Kyber.
Instead of relying on a single encryption method, TutaCrypt generates three shared secrets when you send an encrypted email. These include a long-term secret shared between you and the recipient, a temporary secret created for that message, and a post-quantum secret generated using ML-KEM. Together, they produce a single session key that encrypts the email, while the recipient independently derives the same key to decrypt it.
The analysis found that this hybrid approach provides strong protection against active attacks using today’s computers, meaning the protocol can continue protecting an email exchange even if an attacker attempts to interfere with it.
The paper also compares TutaCrypt with Signal’s PQXDH protocol. Unlike Signal, TutaCrypt does not use recipient-generated randomness during key creation. This means previously encrypted emails have fewer protections if long-term encryption keys are ever exposed, although the researchers say this affects only certain forward-security properties.
A PDF of the full research paper is available here if you would like to explore more about the protocol.
