# Encryption security issues \[PFS, plausible deniability, PQC\] **URL:** \ **Category:** Feature Proposal\ **Tags:** security\ **Created:** [May 20, 2026, 10:54pm UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288 "2026-05-20T22:54:00Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Iago](https://forum.delta.chat/letter_avatar_proxy/v4/letter/i/b9bd4f/32.png) [@Iago](https://forum.delta.chat/u/Iago)\ **Post date:** [May 20, 2026, 10:54pm UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288/1 "2026-05-20T22:54:01Z")
In the comparison with other instant messaging apps in [Comparison of Instant Messengers](https://eylenburg.github.io/im_comparison.htm) , DC appears lacking some security issues such as Forward secrecy and Plausible deniability, which many other satisfy. Could they be solved? Thanks! ![image](https://support.delta.chat/uploads/default/original/2X/1/11d5d5f4d05be2bd361ea8e94be649848f2e0a23.png) ---
**Author:** ![WofWca](https://forum.delta.chat/user_avatar/forum.delta.chat/wofwca/32/1702_2.png) [@WofWca](https://forum.delta.chat/u/WofWca)\ **Post date:** [May 21, 2026, 6:42am UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288/2 "2026-05-21T06:42:18Z")
> [@Iago](#): > > Forward secrecy Soon > **[Does Delta Chat support Perfect Forward Secrecy? - Delta Chat: FAQ](https://delta.chat/en/help#pfs)** > > In a hurry? You can read this help relaxed at anytime within the app, also without internet. | What is Delta Chat? Delta Chat is a reliable, decentralized and secure instant messaging app, available for mobile and desktop platforms. Instant creation... > [@Iago](#): > > Plausible deniability I haven’t heard this talked about much, also interested. ---
**Author:** ![Minim](https://forum.delta.chat/letter_avatar_proxy/v4/letter/m/ccd318/32.png) [@Minim](https://forum.delta.chat/u/Minim)\ **Post date:** [May 23, 2026, 6:37pm UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288/3 "2026-05-23T18:37:51Z")
> [@Iago](#): > > Plausible deniability Fixing the title spello might help others find this discussion. 😄 Sorry, I’d do it for you, but I can’t for some reason. ---
**Author:** ![x2lfrbwxg](https://forum.delta.chat/letter_avatar_proxy/v4/letter/x/bbce88/32.png) [@x2lfrbwxg](https://forum.delta.chat/u/x2lfrbwxg)\ **Post date:** [June 17, 2026, 7:13pm UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288/4 "2026-06-17T19:13:20Z")
IIRC there should no longer be a public key id exposed on the raw PGP message/envelope so anyone getting the raw emails from a relay can’t cryptographically tie it to a key unless they were the intended recipient and can decrypt the message to confirm the sender inside, right? The other option that would help is to more frequently rotate your relay accounts and then that makes it harder to pin a relay account/email address to you as well. ---
**Author:** ![Low](https://forum.delta.chat/letter_avatar_proxy/v4/letter/l/ecae2f/32.png) [@Low](https://forum.delta.chat/u/Low)\ **Post date:** [June 17, 2026, 7:53pm UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288/5 "2026-06-17T19:53:27Z")
> [@x2lfrbwxg](#): > > The other option that would help is to more frequently rotate your relay accounts How do you do that? ---
**Author:** ![ian](https://forum.delta.chat/user_avatar/forum.delta.chat/ian/32/3164_2.png) [@ian](https://forum.delta.chat/u/ian)\ **Post date:** [June 17, 2026, 9:24pm UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288/6 "2026-06-17T21:24:42Z")
Probably meant it as a manual action, but basically: > [@Clone profile for best-effort rotating of your compromised identity](https://support.delta.chat/t/clone-profile-for-best-effort-rotating-of-your-compromised-identity/4736/1): > > Scenario: If you had accidentally joined a public group of untrusted individuals with your private main profile or an untrusted individual distributes your contact card without your consent. If a third party had gained access to your private key (via a backup file, device physical access, malware or by accidentally adding the wrong device as a secondary). Clicking an emergency button in the settings locally (or via the remote wipe mechanism) would accomplish the following: Duplicate and for… ---
**Author:** ![Low](https://forum.delta.chat/letter_avatar_proxy/v4/letter/l/ecae2f/32.png) [@Low](https://forum.delta.chat/u/Low)\ **Post date:** [August 7, 2026, 5:42pm UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288/7 "2026-08-07T17:42:54Z")
As I understand it, there is nothing stopping Chatmail from implementing deniability. If we had deniability, a malicious client that doesn’t respect deletions wouldn’t be nearly as bad. Since we don’t have deniability right now, malicious clients are a serious issue. ---
**Author:** ![Iago](https://forum.delta.chat/letter_avatar_proxy/v4/letter/i/b9bd4f/32.png) [@Iago](https://forum.delta.chat/u/Iago)\ **Post date:** [August 31, 2026, 9:46pm UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288/8 "2026-08-31T21:46:43Z")
A couple of comment/question regarding plausible deniability. The comment: it seems the source of this is [https://dl.acm.org/doi/10.1145/1029179.1029200](https://dl.acm.org/doi/10.1145/1029179.1029200), that is, Off-the-Record communication. And it looks for repudiability. The question: do you think it would worth to raise this question to the Autocrypt v2 RFC draft as an issue in [autocrypt2/autocrypt-v2-cert: Autocrypt v2 Certificate specification (post-quantum confidentiality, reliable deletion) - Codeberg.org](https://codeberg.org/autocrypt2/autocrypt-v2-cert)? ---
**Author:** ![Iago](https://forum.delta.chat/letter_avatar_proxy/v4/letter/i/b9bd4f/32.png) [@Iago](https://forum.delta.chat/u/Iago)\ **Post date:** [October 3, 2026, 8:49pm UTC](https://forum.delta.chat/t/encryption-security-issues-pfs-plausible-deniability-pqc/5288/9 "2026-10-03T20:49:18Z")
I’d like to ask you again about if do you think it would worth to raise plausible deniability/repudiability to the Autocrypt v2 RFC draft as an issue in [autocrypt2/autocrypt-v2-cert: Autocrypt v2 Certificate specification (post-quantum confidentiality, reliable deletion) - Codeberg.org](https://codeberg.org/autocrypt2/autocrypt-v2-cert), so it would be included in standard, not only in app implementation? Thanks!