Signal rolls out Automatic Key Verification to help detect impersonation attacks

Signal has introduced Automatic Key Verification (AKV), a feature designed to help users detect attempts to redirect encrypted conversations to an impostor. The update strengthens the app’s existing safety-number system, which lets contacts compare cryptographic fingerprints associated with their conversation keys.

End-to-end encryption protects messages while they are being transmitted, but it does not by itself prove that a user is communicating with the intended person. An attacker who manipulated a service’s account directory could potentially substitute another public key and receive messages without breaking the encryption.

How automatic verification works

Users can open a contact’s profile, select View Safety Number, and choose Verify automatically. Signal then checks whether the contact’s public key matches information recorded in its key-transparency system. A green checkmark indicates that the verification was successful.

Signal says its transparency infrastructure records account changes, such as a new phone number, username update, or account recreation, in a tamper-evident log tree. Index structures allow the app to locate and compare relevant entries for users and their contacts.

The system also uses independent oversight. Cloudflare and Trail of Bits are identified as third-party auditors that examine the transparency data for signs of unauthorized modification. Their checks are intended to show that users are receiving the same information from the service, helping expose certain man-in-the-middle scenarios.

Users still have a role

Auditing can identify changes to the records, but it cannot establish that every record is correct. Signal therefore combines auditing with monitoring: the app periodically checks a user’s own entries, while contact verification allows users to compare the information associated with another person.

There is an important limitation. Automatic verification for another contact requires that user’s phone number, either through Signal or a matching entry in the device’s address book. People who do not have that information cannot use AKV for the contact.

Users may disable automatic verification and continue checking safety numbers or QR codes manually. The feature adds another detection mechanism, but users must still review verification results and confirm a contact’s identity through a trusted channel when the stakes are high.