Hybrid encryption, and where it is used
You will be able to explain why encryption here combines a classical and a post-quantum algorithm instead of replacing one with the other.
Two problems, one envelope
X25519 and ML-KEM-768, combined so that either alone would still hold.
Where the wallet encrypts something that leaves the device — a recovery envelope, a device-sync payload — it derives the key from both a classical X25519 exchange and an ML-KEM-768 encapsulation, and mixes the two. Opening the envelope requires breaking both: the classical half defends against a flaw in the newer scheme, the post-quantum half defends against the machine that does not exist yet.
Illustration to come
Real photograph of one door or case fitted with two clearly different locks — an old mechanical one and a modern one. Both must be visibly engaged.
Why not simply replace
New cryptography is where new mistakes live.
ML-KEM is standardised and well studied, and it is also younger than the curve it sits beside. Hybrid construction is the conservative answer the whole industry converged on for exactly this transition: post-quantum protection without betting everything on the newest primitive, at a cost measured in microseconds and a few hundred bytes.
Illustration to come
Real photograph, waist level and quietly humorous: a person wearing both a belt and braces. The idiom is the concept, and it reads visually across languages.
What is not encrypted
The chain is public, and that is the point.
Transactions, balances and proofs are visible to everyone — that visibility is what makes independent verification possible at all. Encryption in this system protects what travels off-chain and what sits on your device: the vault, the recovery envelope, the sync payload. Anyone promising a ledger that is both publicly verifiable and privately unreadable is describing two different products.
Illustration to come
Real photograph of a glass-walled space where most is transparent and one part is deliberately screened. The visible/hidden boundary must be obvious at a glance.
The peer link
Nodes authenticate each other; the transport is not confidential.
Peer sessions use post-quantum identities to prove which node is which, and the current transport is authenticated rather than encrypted. The security page states that as a known limitation rather than dressing it up: what travels is public chain data, and the Tor route exists for operators who need the network path itself to be private.
Illustration to come
Real photograph of amateur-radio equipment with a paper logbook — authenticated but open transmission. Warm, human, analogue.
In short
- Off-device encryption is hybrid: X25519 combined with ML-KEM-768, and both must fall.
- Hybrid is the conservative choice during a transition, not a lack of confidence in the standard.
- Chain data is public by design; encryption protects the vault, envelopes and sync payloads.
- Peer sessions are authenticated, not confidential, and the site says so plainly.