How Trail of Bits Verifies the Integrity of Your Signal Chats

Every conversation in Signal begins the same way: the client asks the server for the public key tied to the recipient's phone number. But how can you be sure the server handed back the right key? A compromised server could slip in someone else's key, and your messages would then be encrypted for an attacker rather than for the person you meant to reach.

Until recently, the only way to catch such a swap was to compare “safety numbers” with the other party in person or over a trusted channel. Now Signal has offered an alternative — Automatic Key Verification. Trail of Bits has built and operates one of the three auditors on which trust in this system rests.

How it works

The mechanism belongs to the family of “key transparency” solutions: it creates a globally consistent picture of every public key bound to each phone number, and in doing so makes covert substitution difficult. The app periodically checks on its own that all the keys stored in the global map for your account really do belong to your devices. If the check fails or extra keys turn up, the user sees a warning that automatic verification is unavailable.

The role of external auditors

The system relies on independent observers. Trail of Bits confirms that the “user ↔ public key” map is globally consistent, well formed, and hides nothing. Every new addition updates a local copy of the map, which is kept as a Merkle tree. Periodically the auditor signs the root of this tree with its own secret key, committing to sign only one non-contradictory sequence of trees — this is how clients get the guarantee that they are seeing the same set of keys as everyone else.

The Signal client requires signatures from all three auditors: one from Signal itself, one from Cloudflare, and one from Trail of Bits, and the signatures must have been issued within the last seven days. If the server cannot present valid signatures, automatic verification ends with a warning. This means that even a fully malicious server can sustain a “split” view of the system for no longer than a week before alarming messages start appearing for users.

The company wrote its auditor from scratch against the specification — precisely for the sake of independent verification; the code is open. Signal also has its own reference implementation.

Why it matters

You can turn the feature on under “Settings → Privacy → Advanced.” In supported chats, the other party's key is verified from the safety-number comparison screen using the “Verify automatically” button. For conversations started by searching for a username, the feature is often unavailable; if automatic verification doesn't work, it's worth falling back to manual safety-number comparison.

Trail of Bits stresses that it receives no money from Signal or anyone else for this work: free and private communication is a public good for the company, and the integrity of public keys is an essential element of any end-to-end encryption system.

Source: Lobsters