Signal has introduced a new security feature called automatic key verification, designed to provide users with an additional method to confirm the integrity of their encrypted chats. This feature aims to ensure that no unauthorized third party has secretly interfered with an end-to-end encrypted session.
According to Signal engineer Katherine Yen, the system offers a streamlined way to verify that a phone number or username remains consistently associated with its correct encryption key across the Signal network. This guards against scenarios where an attacker might manipulate Signal's key directory to substitute a different key without the account owner's knowledge.
The new feature operates through a system of verifications performed by the user, their Signal connections, and independent third-party auditors. Signal states that this combined approach provides the same level of assurance as manually verifying safety numbers, but without requiring in-person meetings or secondary communication channels.
To use automatic verification, users can access a contact's profile, tap "View Safety Number," and then select "Verify automatically." A successful verification will display a green checkmark along with the message "Encryption verified."
The underlying technology for this feature is a cryptographic system known as key transparency. When a user registers, changes their phone number or username, or re-creates their account, these changes are incorporated into Signal's key-transparency system. Two external organizations, Cloudflare and Trail of Bits, independently audit this system. Their role is to detect any attempts to present inconsistent versions of key records to different users. The information accessible to these auditors is cryptographically protected, meaning they do not receive users' phone numbers or usernames in plaintext.
Key transparency helps confirm that Signal users are viewing a consistent record of which encryption keys belong to which accounts. However, it does not establish the real-world identity of the person controlling an account, nor does it protect against a complete takeover of a legitimate account.
Currently, automatic verification relies on Signal having the contact's phone number. It may not be available for conversations initiated using only a username. In such cases, users can still manually verify Safety Numbers. Users who prefer not to extend trust to Signal and its independent auditors have the option to disable automatic key verification in Signal's Privacy > Advanced settings and continue to rely solely on manual Safety Number verification.
The risk addressed by this feature is the potential for an attacker to gain control of Signal's servers, which act as a directory for public key material. If compromised, an attacker or a malicious insider could swap in a different public key for a target's account, potentially inserting themselves into a conversation undetected. Signal characterizes this as an unlikely scenario, requiring either a breach of major cloud infrastructure or a privileged insider deliberately targeting a specific account.
This new feature follows other recent security enhancements by Signal. In May, the platform implemented additional protections for users after Russian state-sponsored hackers reportedly targeted high-profile accounts with fraudulent Signal Support alerts.
