Signal introduces automatic key verification to combat man-in-the-middle attacks

Signal has introduced a new feature called Automatic Key Verification (AKV) to enhance the security of its encrypted chats, aiming to prevent secret interference with user conversations, with further coverage provided by The Register.

The new AKV feature is designed to combat man-in-the-middle attacks, where an adversary could intercept messages by corrupting Signal's centralized directory and posing as another user. While messages would remain encrypted, they would be sent to the wrong destination. AKV works by creating a ledger of public keys, with each user interaction generating a new iteration. This ledger is accompanied by an index, allowing users to verify that their contact's public encryption key hasn't been tampered with. Signal has enlisted Cloudflare and Trail of Bits as third-party auditors to verify the integrity of its key transparency server.

Users can manually initiate verification by tapping a "Verify automatically" button on a contact's profile, which displays a green checkmark if the encryption key matches Signal's system expectations. However, this feature requires users to have their contact's phone number within Signal or their phone's address book. Users can also disable AKV and rely on traditional safety number or QR code verification if they prefer to avoid third-party involvement.

Source: The Register