What changed
Google DeepMind researchers used agentic AI to mathematically prove, or 'formally verify,' a number of the Signal protocol's key cryptographic guarantees. This work, conducted as a proof-of-concept project in four weeks, serves as independent validation of the cryptography protecting communications on platforms like Signal, Google Messages, and WhatsApp. The team used a new AI framework called AlphaProof Code to demonstrate their formal verification capabilities.
What this means in practice
The DeepMind analysis did not find new vulnerabilities in the portions of the Signal protocol it examined. However, when applied to older versions of Signal with known, fixed vulnerabilities, the AI correctly identified them and showed the protocol could not be formally verified. The researchers are releasing their specification and proof to aid future formal verification efforts. This development highlights the potential of AI to significantly reduce the time required for formal verification, though it remains limited in scope and not yet scalable to all software.
Limitations and availability
The DeepMind analysis did not formally verify the entire Signal mobile app, and the researchers emphasize that their findings are a milestone in a larger process. The project was conducted free of charge as a research initiative, and Google has not shared the cost of the analysis. The company also declined to comment on plans for a commercial formal verification product. The researchers highlight the importance of a 'human-AI collaboration process' to ensure accuracy and maintain human oversight throughout the verification process.
