Google DeepMind melds humans and AI agents to vet Signal's secure messaging techniques
Post-quantum handshake and Triple Ratchet get a formal security check
Google DeepMind researchers have successfully verified the security of Signal's messaging system using AI, marking the first time AI has helped create a proof linking protocol-level security guarantees to cryptographic implementations. They utilized AlphaProof Code, a multi-agent framework that combines human-guided agents with machine learning.
AlphaProof Code validated Signal's post-quantum PQXDH handshake and Triple Ratchet, ensuring the design of libsignal's forward secrecy, authentication, post-compromise security, and handshake secrecy. The team, including Swarat Chaudhuri, Andrew Ferraiuolo, and others, worked on transforming Signal's security goals into a mathematical specification reviewed by humans.
The researchers generated 6.5 million lines of Lean code using Gemini Carbon agents, which required human review for bits that needed attention. While the verification is theoretical and doesn't guarantee computational secrecy, it represents a meaningful assertion of correctness. The process highlights the importance of human-AI collaboration in formal methods and aims to scale up verification to large codebases, emphasizing the need for better specification and design processes in software development.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
