Signal Automates Encryption Key Verification to Protect Against Man-in-the-Middle Attacks

Each Signal chat starts the same way: the app requests the public key associated with your contact’s phone number from Signal’s server. But how can you be sure the server has provided the correct key?

Normally, users simply trust the server. However, if it were compromised, for example in a sophisticated cyberattack, attackers could potentially replace the legitimate public key with a fake one. This could allow them to intercept and read messages or even alter their contents before they reach the intended recipient.

Until now, the only way to detect a so-called man-in-the-middle attack was to manually verify your Signal safety number with your contact in person or through another trusted communication channel. This confirms that both participants are using the correct encryption keys.

In practice, however, most users simply did not do this because of the inconvenience involved. Signal has therefore introduced a new security mechanism designed to ensure that no third party is sitting between you and the person you are communicating with: Automatic Key Verification.

“It works through a system of checks performed by you, your Signal contacts, and third-party auditors, which together provide the same assurance as manually verifying safety numbers. Unlike safety numbers, these checks are performed independently and do not require an in-person meeting or a secondary communication channel,” Signal software engineer Katherine Yen explains in a blog post.

Automatic Key Verification is based on the principles of asymmetric cryptography. Such systems use a pair of keys: a public key stored on Signal’s servers and a private key that remains on the user’s device.

When a user registers an account, changes their phone number or username, or recreates their account, Signal records this information in a special log tree, also referred to as a “log book.” To make searching through the log tree more efficient, the system uses prefix trees, or “index books.”

To provide additional independent oversight and help ensure that the system operates correctly, Cloudflare and Trail of Bits serve as independent auditors.

Users can enable Automatic Key Verification in the Signal app by going to Settings > Privacy > Advanced and turning on “Automatic Key Verification.”

Those who do not want to rely on third parties, including Signal and the independent auditors, can disable Automatic Key Verification from the same Settings > Privacy > Advanced menu. They can then continue verifying safety numbers manually.