3. Cryptographic primitives. Curve25519 / XSalsa20 256 / Poly1305 (downgraded for the absence of PQ encryption). We added PQ encryption in March this year: This is done in the same way as Apple describes as PQ3 here: it provides stronger protection than Signal design where PQ encryption only applies to the initial key exchange.

Replies (1)

4. Directory service could be modified to enable a MITM attack? Yes This is incorrect, as there is no user directory service at all (and no knowledge of even the number of users), and MITM by servers is not possible by design, even without optional security code verification (that exists to mitigate MITM by the channel you used to pass one-time invitation link, e.g. email).