Signal's new key verification: trust but verify

Signal, the encrypted messaging app favored by diplomats, activists, and journalists, is rolling out a new security feature designed to catch a sophisticated form of interception that has long been a theoretical weakness in its system. The feature, called Automatic Key Verification (AKV), aims to ensure that the person you're chatting with is actually who they claim to be, by detecting any tampering with the public encryption keys that underpin secure conversations.

At its core, AKV addresses a classic "man in the middle" attack scenario: if an attacker could corrupt Signal's centralized directory of accounts and pose as a contact, they could intercept messages—even though those messages would still be encrypted, they'd be going to the wrong place. The feature, announced on Tuesday, adds a layer of verification that checks whether a contact's public encryption key matches what Signal's key transparency system expects.

How AKV Works from the User's Perspective

For users, the process is straightforward. Tap on a Signal contact's profile, navigate to the "View Safety Number" screen, and tap the "Verify automatically" button. If all is well, a green checkmark appears, confirming that the contact's public encryption key aligns with Signal's key transparency system. This simple action belies a complex backend architecture designed to detect unauthorized changes to public keys.

Signal has long used "safety numbers"—cryptographic fingerprints tied to the keys securing a conversation—which users could manually compare to verify their connection. But manual verification is cumbersome and often skipped, leaving a theoretical gap that AKV aims to close.

The Ledger and the Index

Behind the scenes, Signal has built a new system that functions as a public ledger of keys. Every time a user registers, changes their phone number or username, or re-creates their account, Signal records the change in a log tree ("the ledger") and facilitates searching through it with prefix trees ("the index books"). This ledger lives on an "open-source key transparency server" that Signal created for AKV.

But searching through an index is not something users do manually. Signal automatically combs the index on behalf of its users to verify that the information they retrieve about a contact is the most up-to-date. However, up-to-date doesn't necessarily mean accurate, which is where third-party auditors come in.

Third-Party Auditors: Cloudflare and Trail of Bits

Signal has enlisted Trail of Bits, a security firm, along with Cloudflare, to serve as AKV's third-party auditors. Their role is to verify that Signal's own key transparency server hasn't been compromised. Per the announcement, auditors check the index to ensure entries don't appear to have been altered. If the checks are clean, the auditor signs the response, confirming that the keys being provided are the same for both users, thus eliminating the possibility of a man-in-the-middle attack.

Yet even with auditors, there's a caveat: auditors can guarantee the index and server haven't been tampered with, but they can't verify the accuracy of the data they contain. That's where the final piece of the puzzle comes in: monitoring.

Monitoring: The User's Role

Signal explains that there are two ways for customers to interact with the ledger: looking up someone else's address, and looking up their own. "Monitoring requires Alice and Bob [your usual cryptographic placeholders] to do both of these things on a regular basis, each detecting a different kind of tampering," Signal said. Alice and Bob can each monitor their own ledger entries through the Signal app, which periodically checks automatically, and they can verify their connection's data via the "Verify Automatically" button.

"These two kinds of monitoring, combined with third-party auditing, form a complete detection system: auditing guarantees that Alice and Bob are looking at the same data, and monitoring guarantees that both of them are regularly checking that data for accuracy."

— Signal, in its announcement

The Catch: You Need a Phone Number

While AKV is a significant step forward, it's not a silver bullet. The feature only works if you have your contact's phone number. "Your Signal app automatically verifies your own phone number and username data in the log," the announcement said. "But to verify this for someone else, you need to have their phone number."

In practice, this means that if you don't have a contact's phone number in Signal or in your phone's address book, you can't use AKV to verify the encryption key associated with that contact. For those who prefer not to involve a third party in their identity verification, AKV can be disabled, and Signal recommends relying on old-fashioned safety number or QR code verification instead.

Security Is Never Simple

Even with AKV, Signal users are ultimately still on the hook for their own security. To be truly sure a contact is who they say they are, users will need to hit that verify button every time they want to chat. The feature automates the verification process, but it doesn't eliminate the need for user awareness.

Signal's announcement underscores a persistent reality in cryptographic verification: trust is never fully automated. AKV adds a valuable layer of protection, but it still relies on users to engage with the verification process and to have the necessary contact information.

For a messaging app that has become a standard for secure communication, especially among those in high-stakes roles, this feature could significantly reduce the risk of sophisticated interception. But as Signal itself notes, nothing in the cryptographic verification space is ever easy.

The addition of AKV is a response to a known vulnerability in the protocol, and it's a welcome one. But it also highlights the broader challenge: even with a strong technical solution, the human element remains critical. For now, users must remember to verify, and hope that their contacts' phone numbers are always at hand.

This development comes amid ongoing discussions about Signal's security and trust model, including previous reports about the use of centralized services and phishing attempts. The new feature is a step toward addressing some of those concerns, but it's not a complete solution. The onus remains on users to stay vigilant.