Signal introduces automatic key verification via Key Transparency

Signal has introduced automatic key verification through a new system called Key Transparency. This update aims to mitigate “man-in-the-middle” attacks by ensuring that the public keys used for end-to-end encryption are authentic without requiring users to manually compare security numbers or QR codes.

Technically, Key Transparency utilizes a log tree that functions like an immutable ledger, recording all registrations and key changes in a permanent, verifiable sequence. To prevent the service provider from showing different versions of the truth to different users, the system is monitored by independent auditors, specifically Cloudflare and Trail of Bits. These auditors verify that Signal maintains a single, consistent ledger.

While the feature is being rolled out, it currently runs in the background for a portion of Signal accounts. This move follows similar implementations by WhatsApp in 2023 and Apple in December 2023, shifting the security model from one based purely on trusting the service provider to one based on verifiable transparency.