How Trail of Bits helps verify the integrity of Signal chats
Ensuring the Integrity of Signal Conversations: The Role of Trail of Bits
By Tjaden Hess | August 11, 2026
Categories: cryptography, audits, open-source
Every single Signal conversation begins with a request: the client asks the Signal server for the public key linked to a specific phone number.
While this seems straightforward, it introduces a vulnerability. A trustworthy compromised server could potentially deliver a fraudulent public key. If this happens, your messages would be encrypted for an attacker rather than your intended contact.
Historically, the only defense against this was the manual verification of safety numbers via a secondary, trusted channel. However, Signal has introduced a more seamless alternative: Automatic Key Verification (AKV).
Trail of Bits is proud to operate one of the three independent auditors that ensure this system remains honest and transparent.
🛠 How Automatic Key Verification Works
AKV is essentially a "key transparency" mechanism. Its goal is to prevent "mismatch attacks" by ensuring there is a globally consistent record of which public keys belong to which phone numbers.
The Verification Process
The Signal application now conducts periodic self-audits to confirm that every key listed in the global map for your account actually belongs to your authorized devices.
| Feature | Manual Verification | Automatic Key Verification (AKV) |
|---|---|---|
| Method | Comparing safety numbers in person | Global consistency checks via auditors |
| Effort | High (requires direct contact) | Low (automated background process) |
| Detection | Immediate upon comparison | Periodic self-checks |
If the app detects an inconsistency in the log or cannot verify the data, it will notify the user: “Automatic Key Verification is currently unavailable for your device.” (Note: Other technical issues may also trigger this warning).
🔍 The Role of the Trail of Bits Auditor
The security of AKV relies on external auditors. Trail of Bits provides an independent layer of verification to ensure the map between users and public keys is well-formed, consistent, and contains no hidden entries.
Technical Implementation
We maintain a local copy of the public key map using a Merkle tree. In a Merkle tree, the root hash is derived from the hashes of its children:
Where is the cryptographic hash function, and and are the left and right child nodes.
Our workflow is as follows:
- Update: Every time a new entry is added to the map, we update our local Merkle tree.
- Sign: We periodically sign the head (root) of the tree using a private signing key.
- Commit: By signing only one consistent lineage of trees, we guarantee that all clients see the same data.
The "Three-Auditor" Requirement
To prevent a single point of failure, Signal clients require signatures from three distinct auditors:
- Signal
- Cloudflare
- Trail of Bits
The client fetches tree heads from the server and checks if they have been endorsed by all three auditors within the last seven days.
Security Note: Because of this window, a fully malicious server can only maintain a "split view" (showing different keys to different people) for a maximum of one week before the client triggers a warning.
Our auditor was built from the ground up based on the official specification to ensure true independence. The implementation is fully open-source.
Auditor Identity
Our current public signing key is:
7fe5d91de235188486d8fb836a6da37e625e2b10eb6d144185b9364cc83cbbb6
📱 User Guide: Enabling AKV
If you want to secure your chats using this system, follow these steps:
- Navigate to
Settings - Select
PrivacyAdvanced - Toggle Automatic Key Verification to ON
Once enabled, you can verify a contact by:
- Opening the safety number verification screen.
- Clicking the "Verify Automatically" button.
Note: AKV may not be available for conversations initiated by searching for a username. In such cases, please fall back to manual safety number comparison.
💡 Why We Support This
"We believe that free and private communication is a critical public good."
Trail of Bits provides this auditing service free of charge. We are not compensated by Signal; we operate this auditor to support the broader community and the integrity of end-to-end encryption (E2EE).
If your organization is interested in implementing E2EE or key transparency, feel free to reach out to us.
Related Reading:
- A “proof” of Fermat’s Last Theorem that fits the margin
- VMs won't contain cyber-capable agents
- State divergence enables unauthorized access
- Notes on AWS Nitro Enclaves: KMS integration