How Trail of Bits helps verify the integrity of your Signal chats

Signal chats begin with a client asking the Signal server for the public key linked to a contact's phone number. Ensuring this public key is genuine is crucial, as a compromised server could provide a false key. Previously, detecting such malpractice required verifying safety numbers in-person or through a trusted channel. Now, Signal provides Automatic Key Verification, an alternative to manual safety number comparison.

Trail of Bits, one of three auditors, contributes to this system's trustworthiness. The auditor, a separate, independently developed implementation, continuously checks the Automatic Key Verification system's honesty. Automatic Key Verification creates a globally consistent public key view for each phone number, making it harder to hide mismatches.

The Signal app periodically checks this system, warning users if inconsistencies arise. Automatic Key Verification's functionality depends on external auditors, of which Trail of Bits is one. We verify the user ↔ public key map is globally consistent and well-formed. Each new entry we add updates our local map, stored as a Merkle tree, and we sign the tree's head with a private signing key.

By consistently signing one lineage of Merkle trees, clients can verify that they see the same public keys as everyone else. Clients require signatures from three auditors: Signal, Cloudflare, and Trail of Bits. When Automatic Key Verification is enabled, the client fetches Merkle tree heads from the key transparency server, ensuring each head belongs to a lineage endorsed by all auditors within the past week.

A malicious server could hold a fragmented view of the system for up to a week before warning messages appear. Trail of Bits built its auditor from scratch for independent verification, with the code available open source. Clients can enable Automatic Key Verification in Signal’s Settings → Privacy → Advanced, and verify a counterparty’s public key in supported chats via the safety number verification screen.

Automatic Key Verification may not support chats started by searching for a recipient's username. If verification fails, users should revert to safety number comparison. Trail of Bits operates this service without financial compensation, driven by the importance of free and private communication.