Tixeo shields video calls from quantum computers, but only if everyone joins from a browser

All it takes is one participant joining the meeting from the app, and the protection is gone. In Tixeo version 18.2, released on October 21, the defense against future quantum computers applies only if every participant is connected from a browser running version 18.2. Otherwise, the session falls back to classic key exchange, which is still end-to-end encrypted.

This Montpellier-based secure video conferencing vendor has earned the first-level security certification (CSPN) from ANSSI, France's national cybersecurity agency, four times since 2017. It announced the new feature on its website, and LeMagIT detailed it on November 3. The chosen mechanism, ML-KEM-768, is the key exchange algorithm standardized by the U.S. National Institute of Standards and Technology (NIST) in FIPS 203.

Why protect against a machine that doesn't exist yet

No quantum computer can break the encryption of an online meeting today. The risk lies elsewhere: an adversary can record encrypted streams now and wait until they have a machine able to recover the keys. For leadership, defense or health meetings, which stay sensitive for years, this “harvest now, decrypt later” scenario justifies acting before the threat arrives.

Tixeo chose a hybrid approach: the meeting key is established both by a classic mechanism and by ML-KEM-768. The vendor sums up the principle this way: the key “remains secret as long as one of the two holds.” If a weakness emerged in the new algorithm, the classic protection would still hold. If a quantum computer broke the old one, ML-KEM would take over. This is also the approach ANSSI favors during the transition, as we explained in our article on its recommendations.

According to Tixeo, the protection covers audio, video, screen sharing and meeting chat, as well as its shared workspaces (Workspaces), with their chat and file transfers. According to LeMagIT, it is enabled by default.

What the new feature does not cover yet

• Mobile and installed software: the mobile app, then the native client, will receive the protection “in the coming months,” with no specific date.
• Mixed meetings: a single participant on the app, or on an earlier version, sends the session back to classic encryption.
• Authentication: Tixeo only talks about key exchange. Nothing indicates that signatures, which prove participants' identities, are already post-quantum. This part is less urgent: a signature cannot be forged after the fact for a meeting that has already ended.
• Certification: Tixeo's latest CSPN, announced on October 5, covers version 17.2. Nothing indicates that it evaluates the new feature.

The 2027 deadline looms

The vendor says it wants to get ahead of ANSSI's timeline. According to Tixeo, some types of security products will have to include quantum-resistant mechanisms to be certified starting in 2027. LeMagIT cites VPNs, hardware security modules (HSMs) and firewalls, and adds that the requirement would extend in 2030 to all certified or qualified products. These are conditions for obtaining a security visa from the agency, not a blanket ban on products that have not migrated.

What to do if you use Tixeo

For the most sensitive meetings, the rule is simple: ask all participants to connect from a browser, and check that your platform has moved to 18.2. For your other video conferencing tools, ask the vendors the same question: is the key exchange already hybrid, and on which software? For Tixeo, the next step to watch is the arrival of ML-KEM on the mobile app, which is widely used on the move.