Google DeepMind says AI verified key parts of the Signal protocol
🎧 Listen to this story
Google DeepMind researchers say they used AI agents and AlphaProof Code to formally verify important cryptographic guarantees in the Signal protocol’s implementation. The protocol protects conversations on Signal and Google Messages and underpins WhatsApp’s encryption. According to Xataka, the agents generated more than six million lines in Lean, while human experts reviewed the specifications and about 1% of the code flagged for further analysis; the work took four weeks.
The analysis found no new vulnerabilities in the portions examined. When the team reintroduced two real, previously fixed flaws into an isolated version of the code, the system identified that the vulnerable versions were not secure, Google DeepMind says. The project did not verify the entire Signal mobile app, and whether the approach can be scaled at a workable cost remains an open question. The Signal Foundation had already carried out earlier verification work on smaller portions of the code, according to Wired and Xataka.
Why it matters · editorial interpretation
The work suggests that AI agents may expand formal verification of cryptographic software, but human review remained necessary and whether the method can scale at a practical cost is still an open question. Because the analysis covered only parts of the code, it is not equivalent to fully verifying the Signal app.
Sources
ResearchSecurityCode