How Trail of Bits helps verify the integrity of your Signal chats
Signal introduced Automatic Key Verification, a key transparency mechanism that creates a globally consistent, auditable map of phone numbers to public keys. This mitigates man-in-the-middle attacks where a compromised Signal server substitutes a false public key. Trail of Bits operates one of three independent auditors that sign Merkle tree heads, ensuring clients can verify they see the same key set as all other users. A malicious server can sustain a split view for at most seven days before clients raise warnings.
Detection / Hunteropenrouter
What Happened
Signal added a feature called Automatic Key Verification that checks whether the public keys the Signal server gives you for your contacts are genuine. Without this, a compromised server could swap in a fake key and silently intercept your messages. Trail of Bits runs one of three independent auditors that collectively sign off on the integrity of Signal's global key directory. If the server tampers with keys, clients will detect the inconsistency within seven days and warn the user. Users can enable the feature in Signal under Settings > Privacy > Advanced.
Key Takeaways
- Signal launched Automatic Key Verification, a key transparency system that detects server-side public key substitution attacks without requiring manual safety number comparison.
- Trail of Bits operates one of three independent auditors (alongside Signal and Cloudflare) that sign Merkle tree heads to attest to global consistency of the phone-number-to-public-key map.
- A fully malicious Signal server can maintain a split view for at most seven days before client applications display warnings, because clients require auditor signatures within that window.
- Trail of Bits implemented its auditor from scratch based on the specification to provide independent verification; the code is open source.
Affected Systems
- Signal client applications (mobile and desktop) supporting Automatic Key Verification
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Threat Model: A compromised Signal server provides a false public key for a contact's phone number, enabling man-in-the-middle message interception
- Key Transparency: Signal maintains a globally consistent Merkle tree mapping phone numbers to public keys, making split-view attacks detectable
- Auditor Verification: Three independent auditors (Signal, Cloudflare, Trail of Bits) each sign Merkle tree heads to attest to consistency
- Client Check: Signal clients periodically fetch tree heads and require valid signatures from all three auditors within seven days
- User Warning: If auditor signatures are missing or inconsistent, the client displays a warning that Automatic Key Verification is unavailable
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided. The article describes a cryptographic verification architecture, not a detection rule set.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | This article describes a cryptographic protocol-level verification system. EDR products have no visibility into Signal's key transparency layer. |
| Network Visibility | Low | Network monitoring could observe Signal client traffic to key transparency endpoints, but the cryptographic verification happens within the application layer and is not observable from network telemetry alone. |
| Detection Difficulty | Very Hard | Detecting a compromised Signal server performing split-view attacks requires protocol-level auditing infrastructure, not standard security monitoring tools. The article describes a purpose-built auditor system as the detection mechanism. |
Required Log Sources
- Signal client application logs (if available)
- Network proxy logs for Signal key transparency endpoints
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider monitoring for Signal clients displaying Automatic Key Verification warnings, which would indicate a potential key transparency failure or server-side compromise. | Endpoint visibility into Signal application UI state or application logs if exposed | Defense Evasion / Adversary-in-the-Middle | High — warnings can also appear due to client version mismatches, unsupported chat types, or transient network issues |
Control Gaps
- Standard EDR and SIEM tooling cannot detect cryptographic key substitution at the application protocol level
- Network security monitoring cannot inspect Signal's end-to-end encrypted traffic for key integrity
Key Behavioral Indicators
- Signal client displaying 'Automatic Key Verification is currently unavailable for your device' warning
- Signal client unable to fetch valid auditor signatures for Merkle tree heads within seven-day window
False Positive Assessment
High — Automatic Key Verification warnings can be triggered by non-malicious conditions including client version mismatches, unsupported chat types (e.g., username-initiated chats), and transient network issues, as noted in Signal's documentation.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider encouraging users to enable Automatic Key Verification in Signal under Settings > Privacy > Advanced.
- If automatic verification fails, advise users to fall back on manual safety number comparison over a trusted out-of-band channel.
Infrastructure Hardening
- Evaluate whether your organization's mobile device management policies can enforce or recommend Signal Automatic Key Verification for employees handling sensitive communications.
- Consider reviewing Signal's open-source auditor implementation and specification if your organization builds end-to-end encrypted systems.
User Protection
- Consider rolling out guidance to employees using Signal for work communications to enable Automatic Key Verification.
- Advise users that chats initiated by searching for a username may not support automatic verification and should use manual safety number comparison.
Security Awareness
- Consider incorporating Signal safety number verification into existing secure communications training for employees who use encrypted messaging for sensitive discussions.
- Educate users that a compromised server could substitute public keys and that Automatic Key Verification reduces the detection window to seven days.
