Review Reports

Round 1

Reviewer 1 Report

Comments and Suggestions for Authors This paper presents a post-quantum secure messaging protocol for instant messaging applications that uses NIST-standardized lattice-based primitives, ML-KEM and ML-DSA. The work addresses a relevant problem and includes formal verification; however, several areas require improvement before publication.   1. The paper mentions current IM applications WhatsAPP, Signal, Telegram, and post-quantum messaging efforts, but provides no direct comparison. How does these applications compare to the proposed post-quantum variants? 2. What ML-KEM and ML-DSA security levels were used for Table 1, Table 2, and Figure 2 for ML-KEM? 3. The paper's main contribution appears to be a relatively straightforward adaptation of existing secure messaging patterns (Double-KEM and transcript binding) to post-quantum primitives. Highlighting the advantage of the proposed protocol by comparing it with a case study or naive adoption would help demonstrate its novelty.

Author Response

Comment R1-1

The paper mentions current IM applications WhatsApp, Signal, Telegram, and post-quantum messaging efforts, but provides no direct comparison. How does these applications compare to the proposed post-quantum variants?

Response: We thank the reviewer for this valuable suggestion. In the revised manuscript, we have added a comparison with related work. The focus of this comparison is related to key aspects, which help us to clarify how the proposed protocol differs in scope and design objectives from widely deployed messaging systems such as Signal, WhatsApp, Telegram, and the IETF Messaging Layer Security (MLS) framework. Rather than attempting to rank or evaluate these systems, the added comparison highlights differences in architectural focus. While production messaging platforms integrate ratcheting mechanisms, multi-device synchronization, and large-scale deployment features, the present work isolates and formally analyzes a minimal post-quantum end-to-end handshake under an explicit untrusted relay model. This distinction clarifies that our contribution is not a full messaging architecture, but a formally analyzed post-quantum handshake primitive that can serve as a modular building block within broader systems.

Changes in the manuscript: We have added a new subsection, numbered and titled as 2.3 Our Contribution, respectively. This subsection includes a table labeled as Table 1, which summarizes key aspects and distinctions between existing messaging applications from their cryptographic protocol standpoint and our proposed construction.

Comment R1-2

What ML-KEM and ML-DSA security levels were used for Table 1, Table 2, and Figure 2 for ML-KEM?

Response: We thank the reviewer for this missing and important detail. In the revised manuscript, we have added security levels used in our experiments. It was included in Section 7, entitled Performance of Our Post-Quantum End-to-End Secure Protocol.

Changes in the manuscript: In Section 7 we have included a paragraph that provides details about experiments. Specifically speaking, all experiments were conducted using ML-KEM-768 and ML-DSA-3, corresponding to NIST security level 3.

Comment R1-3

Appears straightforward adaptation; highlight advantage over naive adoption.

Response: We appreciate the reviewer’s comment. However, we think that while the proposed construction builds upon standardized post-quantum primitives, its contribution does not lie in primitive replacement alone. As a matter of fact, a naive substitution of classical primitives, as in the example of ECDH/ECDSA, with post-quantum counterparts does not automatically achieve security services, resistance to unknown key-share attacks, or proper binding between identities, roles, and ephemeral keys. In contrast, the present work explicitly formalizes transcript binding, role separation, and double-KEM composition under an untrusted relay model, and verifies these properties through symbolic analysis. To clarify this distinction, we have strengthened the description of the protocol’s design rationale and key aspects in the Introduction. We also add the subsection 2.3 Named Our Contribution. Both emphasize that the contribution consists in the structured formalization and verification of a clean post-quantum handshake primitive rather than an only primitive swap.

Changes in the manuscript: The Introduction and Our Contribution section and subsection, respectively, have been revised to highlight the key aspects that make a difference with related work. Mainly we add the following ideas: ”The protocol design considers the formal structuring of a minimal post-quantum handshake, which is proved by explicit modeling under an unreliable relay by using symbolic verification of injective authentication and key secrecy. We also consider the formalization of transcript binding, the separation of roles, and the evaluation of different verification policies. Finally, we experimentally characterize the computational cost of different verification policies and evaluate the performance of the proposed post-quantum end-to-end secure protocol for Instant Messaging Applications in heterogeneous cloud-based architectures. Rather than claiming superiority over existing applications, our results provide practical insight into the feasibility and cost of deploying post-quantum end-to-end secure protocols within current instant messaging infrastructures.” All of them differentiate this work from naive post-quantum primitive substitution.

Reviewer 2 Report

Comments and Suggestions for Authors

This paper presents the design of a post-quantum end-to-end secure protocol for instant messaging applications under an untrusted relay model. The proposed construction uses lattice-based primitives standardized by NIST: ML-KEM for key establishment and ML- DSA for authentication, and a Double-KEM pattern combined with explicit context  binding to derive E2E session key known only to the communicating clients, where the server acts  as an authenticated relay with no access to plaintext messages or session keys. The paper then claims  an automated symbolic verification using ProVerif. I can not say that I find anything really new in this paper but rather somehow just combination of known routines. I am in paticular unhappy with the security analysis of just claiming a ProvVerif with any structure analysis or teachnical details on how it is done. I am also not happy that despite its implementatons but nothing is mentioned on comparison. 

Author Response

Comment R2-1

I do not find anything really new.

Response: We thank Reviewer 2 for the candid feedback, and we want to highlight that the present work does not introduce new cryptographic primitives. The novelty of our work resides in the key aspects that, in combination, generate a new cryptographic protocol that focuses on a post-quantum end-to-end handshake in addition to the formal verification of such protocol under an untrusted relay model. Specifically, speaking, the contribution lies in: (i) Isolating a minimal post-quantum handshake construction, (ii) Formally modeling double-KEM composition with transcript binding and role separation, (iii) Verifying injective mutual authentication and session-key secrecy under a Dolev-Yao adversary, and (iv) Characterizing the computational impact of alternative authentication and verification policies.

Changes in the manuscript: To make this positioning clearer, we have revised the Introduction and we have added the new subsection 2.3 named Our Contribution. Both to highlight the scope and intended contribution of our work.

Comment R2-2

I am in particular unhappy with the security analysis of just claiming a ProVerif with any structure analysis or technical details on how it is done.

Response: We thank the reviewer for this important observation. We would like to mention that in the revised manuscript, we have restructured the section 6 titled Formal Security Verification of Our Post-Quantum End-to-End Secure Protocol using ProVerif, specifically speaking we have rewritten the subsection Formally Verified Security Properties. In such a section, we have added the queries that were verified, which formally guarantee: Mutual authentication between the communicating parties, agreement on peer identities and session parameters, agreement on the derived end-to-end session key, resistance to replay attacks (via injectivity) and resistance to unknown key-share (UKS) attacks through explicit transcript and identity binding. Talking about end-to-end confidentiality, the query that was verified guarantees that no execution trace exists in which a session key is marked as successfully established while being learned by the adversary. In other words, in the mentioned subsection, we tried to highlight the abstract protocol model encoded in ProVerif, the Dolev-Yao adversary assumptions, the formal security goals, including injective mutual authentication and session-key secrecy, and the corresponding verification queries and their outcomes. In other words, the restructuration of this subsection clarifies that the ProVerif analysis constitutes a structured symbolic verification of the protocol model rather than a mere invocation of the tool.

Changes in the manuscript: Subsection named Formally Verified Security Properties has been rewritten by adding the queries that were verified, which formally guarantee: Mutual authentication between the communicating parties, agreement on peer identities and session parameters, agreement on the derived end-to-end session key, resistance to replay attacks (via injectivity) and resistance to unknown key-share (UKS) attacks through explicit transcript and identity binding. Talking about end-to-end confidentiality, the query that was verified guarantees that no execution trace exists in which a session key is marked as successfully established while being learned by the adversary. We have also added two tables trying to highlight the protocol security properties formally verified by ProVerif queries and a comparison with the related work in the same aspect.

Comment R2-3

I am also not happy that despite its implementations but nothing is mentioned on comparison.

Response: We appreciate the reviewer’s observation. We want to say, that in the revised manuscript, we have added three tables that try to highlight different comparisons with the related work. It was made to situate our proposed construction regarding widely deployed instant messaging applications and post-quantum messaging efforts. The added discussion in Subsection 2.3 named Our Contribution, clarifies differences in key aspects, design objectives, and modeling assumptions, rather than attempting to provide a feature-by-feature evaluation.

Changes in the manuscript: A new subsection numbered as 2.3 and named Our Contribution has been added. A new table was added in such a subsection. Moreover, two tables were added in Section 6.

Reviewer 3 Report

Comments and Suggestions for Authors

This paper proposes a complete, end-to-end encryption protocol for instant messaging (IM), designed to be resistant to attacks using quantum computers. The system model is typical of modern IM systems: clients communicate exclusively through a proxy server, which is considered unduly trustworthy (it can view and modify traffic, but should not access keys or message content). The protocol uses NIST-selected mesh primitives: ML-KEM (formerly Kyber) for key establishment and ML-DSA (formerly Dilithium) for signatures. The handshake structure is based on the "Double-KEM" scheme – both parties perform independent encapsulation, and the resulting session key is a function of two secrets and a hash of the entire transcript. On the security side, the authors model the protocol in ProVerif and demonstrate that the Dolev-Yao model verifiably achieves mutual (injective) authentication and session key confidentiality. They also conduct handshake performance measurements (total time and CPU time) on various ARM/x86 cloud configurations with different server-side verification policies.

2. Strengths
1. Well-defined security model and goals
The article clearly describes the model: three types of entities (client–client–server), with the server as an "authenticated but untrusted relay"—meaning it can verify certain things and control traffic, but is not the cryptographic party of the E2E channel. The adversary has full control over the network and potentially the server (Dolev-Yao model), while clients are assumed to be honest and uncompromised. The security goals are listed: end-to-end confidentiality, mutual authentication, correct key agreement, resistance to replay and unknown keyshares, and server ignorance of the key. This is clear and consistent with what we expect from a modern E2E protocol.
2. Clean, transparent handshake design
◦ Using ML-DSA to sign the "role + context + ephemeral key" binding is a sensible way to avoid common problems with incorrect key assignments (including UKS). ◦ Double-KEM (K₁₂ and K₂₁) combined via KDF with the transcript hash TH(ID1, ID2, n1, n2, ek1, ek2, c12, c21) well captures the idea that both parties contribute to the key and that the key is "tied" to a specific session and participants.
◦ Explicitly described key confirmation (KC-I/KC-R) with role separation and binding to the same transcript further addresses the issues of reflection and role reversal.
3. Symbolic Verification and Sensible Conclusions from ProVerif
The authors go beyond "we believe it's secure" and build a model in ProVerif that reflects key elements: double-KEM, transcript hash, role separation, and MAC key confirmation. ProVerif confirms (in a perfect cryptography model) that injective mutual authentication occurs and that the adversary cannot obtain the session key – assuming the server does not have the clients' private keys. This is not a complete proof in the cryptographic sense, but in the context of IM protocols, it is a step that many works do not perform at all.
4. A reliable, yet pragmatic, performance evaluation
◦ The authors run the protocol in real cloud environments (various ARM/x86 platforms, from "low-resource" to "server-grade") and measure both wall time and CPU time.
◦ The results are stable and very "down-to-earth": handshake time is on the order of 50-60 ms, and the calculated CPU time is 8-14 ms, depending on the platform and verification mode (0-NV, 1-1V, 2-2V). This suggests that in a real-world messaging application, the delay introduced by the PQ component will not be noticeable to the user.

The large number of trials (over 12,000 runs) and the detailed table in the appendix demonstrate that this is not a "benchmark on a single machine in a garage."

5. Deliberately limiting scope – the protocol is intended to be "clean and auditable"
The authors state very clearly that they are consciously abandoning mechanisms such as ratcheting, post-compromise security, deniability, groups, etc., to focus on a "clean" PQ E2E channel under the untrusted relay model. In their conclusion, they emphasize this again and honestly refer to these aspects as future work. This gives us a better understanding of what this protocol is intended to solve and what it consciously fails to solve.

3. Weaknesses and Points to be Improved
1. Lack of a Complex Model (e.g., client compromise, post-compromise)
In this article, clients are assumed to be uncompromised; the protocol does not address classic messaging scenarios such as long-term key leakage, subsequent control recovery, or the need for PFS/PCS in longer conversations. The authors honestly acknowledge this, but in a world where Signal with double ratcheting is the de facto standard, it will be difficult to argue that the proposed protocol is "competitive" for production systems without some form of ratcheting.
2. Symbolic verification is not a complete cryptographic proof
ProVerif in the Dolev-Yao model provides peace of mind regarding the structure.

The protocol, but does not cover, for example, subtleties such as side-channels, implementation errors in KEM/DSA, or issues such as cross-protocol attacks if this handshake were to be combined with other schemes. The authors partially address this, but it could be more clearly articulated that ProVerif checks the model, not a specific instance, with all NIST parameters.
3. Few details about integration with real IM infrastructure
The handshaking protocol itself is described in detail, but less space is devoted to how it would fit in practice with existing messaging logic:
◦ identity management and TOFU in multi-device scenarios,
◦ migration from classic ECDH to PQ in an existing messaging application,
◦ compromises regarding key and message size (Kyber/Dilithium are heavier than ECDH/ECDSA). One might assume it can be pieced together, but the reader is left to fill in the blanks.
4. The somewhat "academic" nature of the performance section
The results are solid, but limited to handshakes in a cloud environment; for example, there are no tests on real phones, high-jitter networks, or with a large number of simultaneous sessions. This isn't a critical omission in a cryptography journal, but at least a brief discussion of how the authors see these results impacting, for example, lower-end mobile devices would be useful.
5. Minor editorial issues
There are some minor linguistic slips (e.g., "Section 6 verify the security properties..."), repetitions, and very long sentences that could be shortened without losing meaning. For a cryptography article, it's not bad, but some light editing would improve readability, especially in section 6.

4. Constructive Suggestions
1. More explicitly address protocols like Signal/MLS
A brief comparison (even at the table level) with existing PQ projects for Signal or with the MLS roadmap (in the context of PQ and E2E) would help frame the work's contribution: where exactly is the "niche" in which the proposed protocol makes sense. 1633537_svjour3-Latex-package.pdf+1
2. Expand the section on integration with practical systems
It's worth adding a subsection called "Deployment Considerations," which will address:
◦ how to manage long-term keys (TOFU vs. CA vs. key transparency),
◦ how the protocol behaves in multi-device environments,
◦ what are the effects of implementing ML-KEM/ML-DSA on message sizes? handshake.
3. Slightly expand the section on the limitations of the ProVerif model.
The authors already emphasize that the model is symbolic and does not include side channels, etc., but one or two sentences clearly stating "what this means practically"—for example, that implementation audits and interoperability tests are still needed—would be very helpful.
4. If space allows—outlining the path to PQ ratcheting.
It's not necessary to design a full double PQ ratchet, but even a section on "Future work: towards post-quantum ratcheting" with a discussion of the challenges (memory cost, key sizes, PFS loss with a simple approach) would demonstrate that the authors are thinking about further development and not stopping at a one-time handshake.

In summary, the work provides a clear, well-reasoned design for a quantum-resistant E2E protocol, using NIST standards (ML-KEM, ML-DSA), in a realistic "untrusted relay" model appropriate for modern messaging applications. The design is supported by symbolic verification in ProVerif and practical performance measurements, providing a credible picture of the cost-effectiveness of such a protocol.

Author Response

Comment R3-1

Lack of a Complex Model (e.g., client compromise, post-compromise).

Response: We thank Reviewer 3 for the comprehensive and constructive feedback. We agree that the present work does not model advanced messaging scenarios such as dynamic client compromise, post-compromise security, or long-term ratcheting mechanisms. The protocol is intentionally designed to focus on the establishment of a clean and auditable post-quantum end-to-end handshake under an untrusted relay model. To clarify this scope explicitly, we have introduced a new subsection numbered as 2.3 and named Our Contribution. In such subsection we have added the Limitations of our work by highlighting our scope, the scope of the protocol design, where we state that mechanisms such as ratcheting, post-compromise security, multi-device synchronization, and group messaging are outside the current design objectives and remain natural extensions for future work.

Changes in the manuscript: We have introduced a new subsection numbered as 2.3 and named Our Contribution. In such subsection we have added the Limitations, which delineates the design scope of the protocol and clarifies that advanced features such as post-compromise security and ratcheting are not included in the present construction. Specifically speaking, we have introduced the following ideas: ” This work focuses on the design and verification of a post-quantum end-to-end handshake protocol under an untrusted relay model. In other words, the proposed protocol deliberately concentrates on establishing a post-quantum secure end-to-end construction. It does not incorporate ratcheting mechanisms, post-compromise security, multi-device synchronization, or group messaging functionality. These aspects are orthogonal extensions that can be layered on top of the core handshake construction and are left for future work. However, to maintain a clean and auditable core construction, we delimit the scope of the analysis in the sense that the formal verification is conducted in the Dolev-Yao adversary model using ProVerif. As is customary in symbolic verification, the analysis assumes perfect cryptography and validates the protocol at the abstract model level. It does not constitute a computational security proof, nor does it include a reduction to standard hardness assumptions. Moreover, the symbolic model does not account for implementation-level aspects such as side-channel leakage, concrete parameter instantiations, cross protocol interactions, or denial-of-service considerations. The verification focuses on structural properties of the handshake, namely injective mutual authentication and session-key secrecy. From the performance evaluation perspective, we characterize the computational cost of the handshake in controlled cloud-based environments. The experiments do not include measurements on mobile hardware, high-jitter network conditions, large-scale concurrent sessions, or energy and memory consumption. The objective of the evaluation is to provide a clear baseline for the cryptographic cost of the proposed construction.”

Comment R3-2

Symbolic verification is not a complete cryptographic proof.

Response: We agree with the reviewer that symbolic verification in the Dolev-Yao model does not constitute a full computational cryptographic proof. Our ProVerif verification validates the structural correctness of the protocol under the assumption of perfect cryptography, but it does not capture implementation-level subtleties such as side-channel leakage, concrete parameter instantiations, cross-protocol interactions, or denial-of-service considerations.

Changes in the manuscript: To clarify the scope of the verification, we have added a new subsection numbered as 2.3 and named Our Contribution. In such subsection we have added the Limitations of our work by highlighting the Limitations and Scope, Limitations of the Symbolic Model, which delineates the boundaries of the symbolic model and distinguishes it from computational security proofs.

Comment R3-3

Few details about integration with real IM infrastructure.

Response: We agree that clarifying the integration path with practical instant messaging infrastructures improves the overall completeness of the manuscript. In the revised version, we expand the architectural discussion to describe how our proposed post-quantum cryptographic protocol fits within a conventional client-server messaging stack. In particular, we clarify that the protocol is designed to operate over existing server-mediated infrastructures without requiring the server to act as a cryptographic endpoint. The server remains responsible for identity distribution, message relaying, and optional verification policies, while all end-to-end key derivation and message confidentiality are handled exclusively by the communicating clients. We also outline how the established session key can serve as a drop-in replacement for the initial key-establishment component in existing E2E messaging systems, with higher-level features (e.g., ratcheting or multi-device support) layered above the core handshake.

Changes in the manuscript: The discussion on practical integration has been expanded in Subsection 5.5 named Deployment Considerations, where system-level integration aspects are described in a dedicated and structured manner.

Comment R3-4

The somewhat ”academic” nature of the performance section.

Response: We acknowledge the reviewer’s observation. We want to highlight that the objective of the performance evaluation is to characterize the computational cost of our proposed post-quantum cryptographic protocol in controlled and reproducible environments, rather than to provide a full deployment-level benchmarking study.

Changes in the manuscript: To clarify the intended scope of the experimental evaluation, we have added a new subsection numbered as 2.3 and named Our Contribution. In such subsection, we have added the Limitations of our work by highlighting the Experimental Scope aspect, where we state that the experiments were conducted in cloud-based environments and do not include measurements on mobile hardware, high-jitter network conditions, large-scale concurrent sessions, or energy and memory consumption.

Comment R3-5

There are some minor linguistic slips (e.g., ”Section 6 verify the security properties...”), repetitions, and very long sentences that could be shortened without losing meaning.

Response: We thank the reviewer for this observation. The manuscript has been carefully revised to correct minor linguistic slips, eliminate repetitions, and improve readability by shortening overly long sentences where appropriate. Changes in the manuscript: Minor grammatical corrections and stylistic improvements have been implemented throughout the manuscript, particularly in Sections 5 and 6.

Comment R3-6

More explicitly address protocols like Signal/MLS.

Response: We thank the reviewer for this helpful suggestion. In the revised manuscript, we now explicitly discuss widely deployed messaging protocols included in instant messaging applications such as Signal, WhatsApp, Telegram, and the IETF Messaging Layer Security (MLS) framework within the Related Work section. Rather than providing a competitive evaluation, the added discussion clarifies architectural distinctions in scope and design objectives. In particular, it highlights that the proposed construction isolates and formally analyzes a post-quantum handshake under an explicit untrusted relay model, whereas production messaging systems integrate ratcheting, device management, and group communication mechanisms within broader protocol stacks.

Changes in the manuscript: Subsection 2.3 named Our Contribution has been added to the Related Work section. This subsection includes Table 1, which situates our proposed construction regarding Signal, Telegram, and MLS.

Comment R3-7

Expand the section on integration with practical systems. Add a subsection called ”Deployment Considerations.”

Response: We have added a dedicated subsection entitled ”Deployment Considerations” to clarify how our proposed post-quantum cryptographic protocol can be integrated into practical instant messaging infrastructures. The new subsection discusses identity bootstrapping assumptions, operation within a server-mediated architecture where the server acts as an authenticated but untrusted relay, migration considerations toward post-quantum deployments, and the possibility of layering higher-level messaging features (e.g., ratcheting or multi-device synchronization) on top of the established session key.

Changes in the manuscript: A new subsection titled ”Deployment Considerations” was added in Section 5, where system-level integration aspects are described in a dedicated and structured manner.

Comment R3-8

Slightly expand the section on the limitations of the ProVerif model.

Response: We thank the reviewer for this suggestion, and to make the scope of the formal analysis explicit, we have introduced a Limitation paragraph in Subsection 2.3. In such a paragraph, we clearly state the assumptions of the Dolev-Yao framework and delineate the boundaries of the ProVerif-based verification. This paragraph clarifies that the symbolic analysis assumes perfect cryptography, does not constitute a computational proof, and does not model implementation-level aspects such as side-channel leakage, cross-protocol interactions, or denial-of-service considerations.

Changes in the manuscript: We have introduced a Limitation paragraph in Subsection 2.3. It expands and formalizes the discussion of the limitations of the ProVerif model.

Comment R3-9

If space allows—outlining the path to PQ ratcheting.

Response: We appreciate this constructive suggestion. The present work intentionally focuses on the design and verification of a clean post-quantum end-to-end handshake under an untrusted relay model. As such, ratcheting mechanisms and post-compromise security are not included in the current construction. To clarify this design scope, we have introduced a Limitation paragraph in Subsection 2.3, where we state that advanced messaging features such as post-quantum ratcheting are natural extensions that can be layered on top of the core handshake protocol.

Changes in the manuscript: We have introduced a Limitation paragraph in Subsection 2.3, where we clarify that ratcheting and post-compromise security are outside the present scope. A brief forward-looking statement has been added in the Conclusions to state post-quantum ratcheting as future work.

Round 2

Reviewer 2 Report

Comments and Suggestions for Authors

I  think the paper is much improved and more or less ready. But however I am not happy with the just table of comparison of various schemes like Signal, Telegram ect. I would like to authors to add a paragraph to compare exact the pros and cons of each scheme both from practical side and theory side so that users may have a good idea which one indeed good for their own purposes, in particular, in terms of quantum resistant security perspective. 

Author Response

Response:

We thank the reviewer for this helpful suggestion. We agree that Table 1 benefits from

an explicit explanatory discussion clarifying the practical and theoretical trade-offs among

the considered schemes. Accordingly, we have revised the manuscript by adding a concise

comparative discussion immediately after Table 1 in Subsection 2.3 (“Our Contribution”).

The new text contrasts Signal, Telegram, MLS, and our proposal from both a practical

deployment perspective (e.g., ratcheting, production maturity, architectural scope) and a

theoretical and post-quantum security perspective (e.g., classical vs. hybrid vs. native

PQ constructions, formal verification scope, and explicit modeling of the untrusted relay

assumption). We believe this addition provides clearer guidance to readers regarding the

respective strengths, limitations, and quantum-resilience positioning of each application.

Changes in the manuscript:

From a practical deployment perspective, widely adopted messaging applications such as

Signal and WhatsApp emphasize mature production features, including ratcheting, post-

compromise security, multi-device synchronization, and large-scale usability. Telegram fol-

lows a distinct architectural model with selective end-to-end encryption, while MLS targets

scalable group key management. This kind of solution embeds key establishments within

broader, feature-rich protocol ecosystems, resulting in increased architectural complexity. In

contrast, the present work deliberately isolates a minimal post-quantum end-to-end hand-

shake under an explicit untrusted relay model, trading advanced messaging functionality

for modularity and formal analyzability. From a theoretical and quantum-resilience per-

spective, most deployed protocols rely on classical or hybrid constructions with incremental

post-quantum integration. Our proposal instead adopts a natively post-quantum design

based exclusively on NIST-standardized lattice primitives (ML-KEM and ML-DSA), for-

mally verified using ProVerif with explicit transcript binding, role separation, and Double-

KEM composition. It is complemented by an empirical characterization of handshake cost

under different verification policies. The resulting construction serves as a formally struc-

tured and quantum-resistant handshake building block that may be integrated into broader

messaging architectures according to deployment needs.