How Trail of Bits helps verify the integrity of your Signal chats - The Trail of Bits BlogThe Trail of Bits BlogBlogHow Trail of Bits helps verify the integrity of your Signal chatsTjaden HessAugust 11, 2026cryptography, audits, open-sourcePage contentHow key verification worksWhat our auditor doesHow to use Automatic Key VerificationWhy we’re doing thisEvery Signal chat starts the same way: the client asks the Signal server for the public key associated with your contact’s phone number. But how do you know the server gave you the right key? A compromised server could provide a false public key, allowing the client to encrypt messages to an attacker rather than the intended recipient.Until now, the only way to detect such malfeasance was to verify safety numbers with your contact in person or over a trusted channel. Signal recently launched an alternative: Automatic Key Verification, a feature that helps validate that your chats are secure without requiring direct safety number comparison. Trail of Bits built and operates one of the three auditors that make this system trustworthy. Our auditor, which is an independent implementation written from scratch, continuously checks that the Automatic Key Verification system behaves honestly.How key verification worksAutomatic Key Verification is a form of “key transparency” that makes mismatch attacks harder to hide by creating a globally consistent view of the set of public keys associated with each phone number. The Signal app now performs a periodic self-check to ensure that all keys stored in the global map for your account belong to your devices. If the app is unable to verify the log, or finds that not all keys are expected, the user is presented with a warning that “Automatic Key Verification is currently unavailable for your device.” Automatic Key Verification may also be unavailable for other reasons, as outlined in Signal’s documentation.What our auditor doesAutomatic Key Verification depends on external auditors. Trail of Bits helps this system function by providing external verification that the user ↔ public key map is globally consistent and well formed, and does not hide any entries. Each time a new entry is added, we update our local copy of the map, stored as a Merkle tree. Periodically, we sign the head of the tree using a signing key that only we know. Because we commit to only ever signing one consistent lineage of Merkle trees, clients know that they are seeing the same set of public keys as everyone else in the system. Clients currently require signatures from each of three auditors: one operated by Signal, one operated by Cloudflare, and one operated by Trail of Bits.When Automatic Key Verification is turned on, the Signal client periodically fetches Merkle tree heads from the Signal key transparency server. The client requires that each tree head belong to a lineage endorsed by all registered auditors within the last seven days. If the server does not present valid auditor signatures, the client will raise a warning and Automatic Key Verification will fail. A fully malicious server may therefore maintain a split view of the system for at most one week before client applications start to display warning messages.We chose to implement our auditor from scratch, based on the specification, to provide independent verification; the code is open source. Signal also publishes a reference implementation.We will provide updates to this blog post if we need to make substantive changes to our signing policy, such as resetting the state of our auditor or rotating our signing key. Our current public key is:7fe5d91de235188486d8fb836a6da37e625e2b10eb6d144185b9364cc83cbbb6How to use Automatic Key VerificationYou can enable Automatic Key Verification in Signal by going to “Settings > Privacy > Advanced” and enabling Automatic Key Verification. In supported chats, you can verify the public key of your counterparty by visiting the safety number verification screen and clicking “Verify Automatically.” Automatic Key Verification often does not support chats where you started the conversation by searching for a recipient’s username. See Signal’s help page for more information. If automatic verification fails, users should fall back on safety number comparison.Why we’re doing thisWe believe that free and private communication is a critical public good. We are not paid by Signal or any other party for this service; we operate it in the interest of users and the community broadly.Some form of public key integrity is an important component of any full end-to-end encryption system. If you would like to implement key transparency or end-to-end encryption generally, contact us.If you enjoyed this post, share it:
X
LinkedIn
GitHub
Mastodon
Hacker NewsRelated PostsWe wrote the code, and the code wonAugust 15, 2024Earlier this week, NIST officially announced three standards specifying FIPS-approved algorithms for post-quantum …Shipping post-quantum cryptography to PythonJune 30, 2026We added post-quantum cryptography support to pyca/cryptography, the eleventh most-downloaded Python package on PyPI, …What we learned about TEE security from auditing WhatsApp's Private InferenceApril 7, 2026Our audit of WhatsApp’s new “Private Inference” feature shows that trusted execution environments (TEEs) aren’t a …

SubscribePage contentHow key verification worksWhat our auditor doesHow to use Automatic Key VerificationWhy we’re doing thisRecent PostsA “proof” of Fermat’s Last Theorem that fits the marginVMs won't contain cyber-capable agentsState divergence enables unauthorized accessHow Trail of Bits helps verify the integrity of your Signal chatsA few notes on AWS Nitro Enclaves: KMS integration© 2026 Trail of Bits.
Generated with Hugo and Roadster theme.

The process of verifying the integrity of Signal chats centers on ensuring that the public keys exchanged between users are authentic and consistent, which addresses the vulnerability where a compromised server could supply a false public key, potentially enabling encryption to an attacker instead of the intended recipient. Signal introduced Automatic Key Verification as an alternative mechanism to validate chat security without requiring direct comparison of safety numbers.

Automatic Key Verification functions as a form of key transparency by establishing a globally consistent view of the public keys associated with each phone number. The Signal application performs periodic self-checks to confirm that all keys stored in the global map for a user's account belong to their respective devices. If the application cannot verify the log or finds discrepancies, it alerts the user that Automatic Key Verification is unavailable for their device.

This system relies on external auditing for trustworthiness, and Trail of Bits plays a crucial role by operating one of the three auditors responsible for ensuring this system functions honestly. Trail of Bits implemented their auditor from scratch based on specifications, making the code open source, and they maintain an independent verification of the user to public key map to ensure it is globally consistent and free of hidden entries. To maintain this consistency, Trail of Bits updates their local copy of the map as a Merkle tree, periodically signing the head of this tree using a private signing key known only to them, thereby committing to a single, consistent lineage of key updates.

When Automatic Key Verification is active, the Signal client periodically fetches Merkle tree heads from the Signal key transparency server. The client mandates that each retrieved tree head must possess valid signatures endorsed by all registered auditors—Signal, Cloudflare, and Trail of Bits—within the preceding seven days. If the server fails to present these valid auditor signatures, the client issues a warning and Automatic Key Verification fails. This multi-auditor requirement ensures that a fully malicious server would only be able to maintain a split view of the system for a maximum of one week before clients begin displaying warnings.

Users can enable Automatic Key Verification by navigating to Settings, then Privacy, and selecting Advanced. In supported chats, the verification process can be initiated by visiting the safety number verification screen and clicking "Verify Automatically." This feature generally does not support chats initiated by searching for a recipient's username; failure in automatic verification should be followed by falling back to standard safety number comparison. The motivation behind this system is rooted in the belief that free and private communication is a fundamental public good, emphasizing integrity as a necessary component of end-to-end encryption systems.