Signal Messaging App Formal Audit Results Are Good

The New Acunetix V12 Engine


I’ve recommended Signal Messaging App quite a few times and I do use it myself, I know there are some privacy concerns with the fact it requires Google App Store – but that’s the developers choice.

Signal Messaging App Formal Audit Results Are Good

It’s a pretty solid app, clean, sleek and works well across both Android and iOS and the latest news is, apparently it’s pretty secure too (which is good news).

Encrypted SMS and voice app Signal has passed a security audit with flying colours.

As explained in a paper titled A Formal Security Analysis of the Signal Messaging Protocol (PDF) from the International Association for Cryptologic Research, Signal has no discernible flaws and offers a well-designed and compromise-resistant architecture.

Signal uses a double rachet algorithm that employs ephemeral key exchanges continually during each session, minimising the amount of text that can be decrypted at any point should a key be compromised.

Signal was examined by a team of five researchers from the UK, Australia, and Canada, namely Oxford University information security Professor Cas Cremers and his PhDs Katriel Cohn-Gordon and Luke Garratt, Queensland University of Technology PhD Benjamin Dowling, and McMaster University Assistant Professor Douglas Stebila.

The team examines Signal threat models in the context of a fully adversarially-controlled network to examine how it stands up, proving that the cryptographic core of Signal is secure.


Now this is not 100% complete as it only really looks at the signal code base, not 3rd party libraries or integrations it uses (like Google Play Store).

But it is a good indicator that on a cryptographic level Signal is pretty solid and should at least be safe from nation state attacks.

As the authors write, Signal’s security is such that even testing it is hard:

Providing a security analysis for the Signal protocol is challenging for several reasons. First, Signal employs a novel and unstudied design, involving over ten different types of keys and a complex update process which leads to various chains of related keys. It therefore does not directly fit into existing analysis models. Second, some of its claimed properties have only recently been formalised. Finally, as a more mundane obstacle, the protocol is not substantially documented beyond its source code.

They conclude that it is impossible to say if Signal meets its goals, as there are none stated, but say their analysis proves it satisfies security standards adding “we have found no major flaws in its design, which is very encouraging”.

The team finds some room for improvement which they passed on to the app’s developers, namely that the protocol can be further strengthened with negligible cost by using “constructions in the spirit of the NAXOS (authenticated key exchange) protocol” [PDF]” by or including a static-static Diffie-Hellman shared secret in the key derivation. This would solve the risk of attackers compromising communications should the random number generator become fully predictable.

The paper does, however, cover only a subsection of Signal’s efforts, as it ignores non-Signal library components, plus application and implementation variations. It should therefore be considered a substantial starting point for future analysis, the authors say, rather than the final world on Signal.

You can read the full report here: A Formal Security Analysis of the Signal Messaging Protocol [PDF]

It’s a good app, and this makes it a little more trustworthy – some people do seem to have some issues with the developer, but the users on the whole are happy (high ratings in both app stores).

Source: The Register

Posted in: Countermeasures, Cryptography, Privacy


Latest Posts:


dcipher - Online Hash Cracking Using Rainbow & Lookup Tables dcipher – Online Hash Cracking Using Rainbow & Lookup Tables
dcipher is a JavaScript-based online hash cracking tool to decipher hashes using online rainbow & lookup table attack services.
HTTP Security Considerations - An Introduction To HTTP Basics HTTP Security Considerations – An Introduction To HTTP Basics
HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.
Cangibrina - Admin Dashboard Finder Tool Cangibrina – Admin Dashboard Finder Tool
Cangibrina is a Python-based multi platform admin dashboard finder tool which aims to obtain the location of website dashboards by using brute-force, wordlists etc.
Enumall - Subdomain Discovery Using Recon-ng & AltDNS Enumall – Subdomain Discovery Using Recon-ng & AltDNS
Enumall is a Python-based tool that helps you do subdomain discovery using only one command by combining the abilities of Recon-ng and AltDNS.
RidRelay - SMB Relay Attack For Username Enumeration RidRelay – SMB Relay Attack For Username Enumeration
RidRelay is a Python-based tool to enumerate usernames on a domain where you have no credentials by using a SMB Relay Attack with low privileges.
NetBScanner - NetBIOS Network Scanner NetBScanner – NetBIOS Network Scanner
NetBScanner is a NetBIOS network scanner tool that scans all computers in the IP addresses range you choose, using the NetBIOS protocol.


4 Responses to Signal Messaging App Formal Audit Results Are Good

  1. droopy November 10, 2016 at 6:51 am #

    Example, signal, worst “secure” software used by snowden

    1) Signal capture your real phone number for login.
    With that information i could localte you SS7 tracking or even do a remote injection (google: pegasus nso) attack vector
    2) Signal has a weak implementation of zrtp. They do not add key continuity.
    So, each call is a new fresh key exchange without any cache. I could re-route the new call, and from server force a rtp relay to separate the streams and do a man-in-the-middle
    3) Signal server is not opensource and no federation, so, we could not understand how server works and which info is sent
    4) etc, etc.

    • TK421 November 10, 2016 at 9:52 pm #

      Can you recommend an alternative application that more closely fits your preferences?

    • zer0 November 13, 2016 at 7:16 pm #

      server software are open source, MitM are overall idiot… its know secure… better than all other products, only u compile ure own app, but that can only u use, and MitM can also ;) this is ISP/watergate/NSA Time bitches ;)