Trail of Bits explains its role auditing Signal's new Automatic Key Verification

The trust gap at the start of every chat

When a Signal conversation begins, the app asks Signal's server for the public key registered to the other person's phone number. As Trail of Bits explains in a blog post that reached the Hacker News front page, that lookup has always rested on an assumption: that the server hands back the correct key. A compromised server could return a key it controls instead, tricking the client into encrypting messages to an attacker rather than the intended recipient.

End-to-end encryption does not, by itself, protect against this. Until now the only way to detect it was to compare safety numbers with your contact in person or over a channel you already trust. Signal recently shipped an alternative, Automatic Key Verification, and Trail of Bits, which built and operates one of the components that make it trustworthy, has published a detailed walkthrough of how the system works.

What Automatic Key Verification actually does

The feature is a form of key transparency. Rather than trusting a single server response, it creates one globally consistent record of which public keys belong to each phone number. The Signal app periodically runs a self-check confirming that every key stored under your account in that global map belongs to one of your devices. If the app cannot verify the record, or finds keys it does not expect, it shows a warning stating that Automatic Key Verification is unavailable for the device. According to Trail of Bits, the feature can also be unavailable for unrelated reasons documented by Signal.

Three auditors, three signatures

The design relies on outside parties to keep the key map honest. Three auditors take part: one operated by Signal, one by Cloudflare and one by Trail of Bits. Each time a new entry is added to the map, which is stored as a Merkle tree, the Trail of Bits auditor updates its own copy and periodically signs the tree's head with a signing key only it holds. Because the firm has committed to endorsing a single, consistent lineage of trees, clients can confirm they are seeing the same set of public keys as everyone else in the system.

On the client side, the app fetches tree heads from Signal's key transparency server and requires that each one belongs to a lineage endorsed by all registered auditors within the past seven days. Missing or invalid signatures trigger a warning and cause verification to fail. The upshot is that even a fully malicious server could keep two conflicting versions of the key map alive for no more than a week before client apps begin alerting users.

Trail of Bits wrote its auditor from scratch, working from the specification rather than Signal's reference implementation, specifically to keep its verification independent, and the code is open source. The firm has published the auditor's public key in the post and says it will announce any substantive change to its signing policy, such as a state reset or key rotation, there as well. It also notes that neither Signal nor any other party pays it for the service, which it describes as operating in the interest of users and the wider community.

What users should do

Automatic Key Verification is enabled in Settings, under Privacy and then Advanced. In supported chats, the other party's key can be checked from the safety number screen using the Verify Automatically option. There are limits: chats started by searching for a recipient's username often cannot be verified this way, and Trail of Bits advises falling back to manual safety number comparison whenever automatic verification fails or is unavailable.

Why it matters

The server-supplied key lookup is the weakest link in most end-to-end encrypted messengers, and key transparency is the emerging answer to it. Signal's implementation is notable not just for the cryptography but for its governance: no single party, including Signal itself, can vouch for the key map alone, and an attempted attack is bounded to a detectable window rather than being silently exploitable forever. For users, the practical takeaways are simple. Turn the feature on, and keep knowing how to compare safety numbers for the cases it cannot cover.