Signal automates encryption key verification to hinder man-in-the-middle attacks
The new security feature makes it easier to verify whether chats are secure.
Image by Cybernews.
- Signal launched Automatic Key Verification to confirm users are chatting with the intended person, not an impersonator.
- Cloudflare and Trail of Bits act as independent auditors, verifying Signal's key records through a public log system.
- Users can enable or disable Automatic Key Verification anytime under Settings, Privacy, Advanced in the Signal app.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Signal has announced Automatic Key Verification, a new security feature that gives users the means to make sure they’re communicating with the right person.
Every Signal chat starts the same way: the client asks the Signal server for the public key associated with your contact’s phone number. But how can you be sure that the server gave you the right key?
Normally, you trust that the server provided you with the correct key. However, if a server gets compromised, for example, because of a sophisticated attack, it could give you a false public key, allowing an attacker to intercept, eavesdrop, and even change the content of the messages that are meant for the person you’re trying to communicate with.
Until now, the only way to detect a so-called man-in-the-middle attack was to verify Signal’s Safety Number with your contact in person or over a trusted channel. This proves that you’re both using the same encryption keys.
But hardly anyone actually did this because of the hassle. Therefore, Signal has implemented a new security measure to make sure that there’s no third party between you and the one you’re trying to chat with: Automated Key Verification.
“It works through a system of verifications performed by you, your Signal connections, and third-party auditors that together provide the same assurance as manually verifying safety numbers. Unlike safety numbers, these verifications are done independently and do not require an in-person meeting or a secondary communication channel,” Katherine Yen, a software engineer at Signal, explains in a blog.
Automated Key Verification follows the principles of asymmetric cryptography, meaning there’s both a public key, which is stored on Signal’s servers, and a private key that’s been stored on a user’s device.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
When a user registers an account, changes his phone number or username, or re-creates his account, Signal records this in a log tree or “ledger” and facilitates searching through the log tree with prefix trees or “index books.”
To ensure this is done correctly, Cloudflare and Trail of Bits serve as independent auditors.
Users can enable Automatic Key Verification by opening the Signal app, going to Settings > Privacy > Advanced, and toggling on Automatic Key Verification.
Users who prefer not to rely on any third party, including Signal and the auditors, can disable the Automatic Key Verification feature by going to Settings > Privacy > Advanced and switching the Automatic Key Verification toggle. They can then continue to use manual Safety Number Verification.
