Google DeepMind uses AI to verify parts of Signal protocol

Verification of Signal protocol

Google DeepMind researchers used agentic AI to mathematically prove, or formally verify, a number of the Signal protocol's key cryptographic guarantees in a four-week proof-of-concept project. The work used a new AI framework called AlphaProof Code.

The verification covered machine-code level properties for the PQXDH handshake and the Triple Ratchet protocol. The team verified roughly 140,000 machine instructions in a compiled binary built from libsignal-protocol version 0.105.4 and SPQR version 1.6.0. The AI generated about 6.5 million lines of proof code in Lean, while human experts reviewed the specifications before the agents produced proofs.

DeepMind's analysis did not find any new vulnerabilities in the portions of the Signal protocol it looked at. When the researchers used AlphaProof Code on older versions of Signal that contain known and long-fixed vulnerabilities, it correctly identified them and showed that the protocol could not be formally verified.

Scope and limits

The verification did not cover the entire Signal mobile app. The researchers emphasized that their findings are just one milestone in a larger process.

"We are very excited by this result, but there is a long distance to go before we are able to scale this to all the software of the world, and we want to do that," Swarat Chaudhuri, a DeepMind research scientist, said.

The researchers said some of their crucial advancements are in developing a human-AI collaboration process that allows agents to contribute and self-correct at almost every phase of the process while still seeking human input and review at key junctures.

"We don't want this sort of vibe world where AI is generating the goals and AI is generating the proofs and basically taking tests that are self-written," Chaudhuri said. "There's a middle ground."

DeepMind conducted the Signal analysis free of charge as a research project, and Google declined to share the cost of the analysis. The company also declined to comment on whether it has plans to release a commercial formal verification product or service.

Why it matters

The work serves as independent validation of the cryptography that protects communications on platforms like the Signal app, Google Messages, and WhatsApp. It also demonstrates Google DeepMind's formal verification capabilities using AlphaProof Code. DeepMind is releasing the specification and proof it developed for the Signal protocol analysis to aid other formal verification work.

Sources

• arstechnica.com: Google DeepMind just mathematically verified key parts of Signal
• newscord.org: Google DeepMind Formally Verifies Key Signal Protocol Security With AlphaProof Code: 23 outlets compared | NewsCord
• ua.news: Google DeepMind verifies part of Signal protocol — Ars Technica | UA.NEWS
• mezha.net: Google DeepMind uses AI to verify parts of Signal’s protocol
• gigazine.net: Google DeepMind has successfully formally verified the security of the Signal protocol using 'AlphaProof Code,' an AI-powered code verification tool. - GIGAZINE
• xenospectrum.com: Google DeepMind's AlphaProof Code Mathematically Verifies Signal Protocol Machine Code in 4 Weeks | XenoSpectrum

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.