| Communication protocol | |
 Signal Protocol full double ratchet step | |
| Purpose | End-to-end encrypted communications |
|---|---|
| Developer(s) | Signal Foundation |
| Based on | OTR,SCIMP[1] |
| Influenced | OMEMO,Matrix[2] |
| OSI layer | Application layer |
| Website | signal |
TheSignal Protocol (formerly known as theTextSecure Protocol) is a non-federatedcryptographic protocol that providesend-to-end encryption for voice andinstant messaging conversations.[2] The protocol was developed byOpen Whisper Systems in 2013[2] and was introduced in theopen-sourceTextSecure app, which later becameSignal. Severalclosed-source applications have implemented the protocol, such asWhatsApp, which is said to encrypt the conversations of "more than a billion people worldwide"[3] orGoogle who provides end-to-end encryption by default to allRCS-based conversations between users of theirGoogle Messages app for one-to-one conversations.[4]Facebook Messenger also say they offer the protocol for optional "Secret Conversations", as didSkype for its "Private Conversations".
The protocol combines theDouble Ratchet Algorithm, prekeys (i.e., one-time ephemeral public keys that have been uploaded in advance to a central server), and a tripleelliptic-curve Diffie–Hellman (3-DH) handshake,[5] and usesCurve25519,AES-256, andHMAC-SHA256 asprimitives.[6]
The development of the Signal Protocol was started by Trevor Perrin andMoxie Marlinspike (Open Whisper Systems) in 2013. The first version of the protocol, TextSecure v1, was based onOff-the-record messaging (OTR).[7][8]
On 24 February 2014, Open Whisper Systems introduced TextSecure v2,[9] which migrated to the Axolotl Ratchet.[7][10] The design of the Axolotl Ratchet is based on the ephemeral key exchange that was introduced by OTR and combines it with a symmetric-key ratchet modeled after theSilent Circle Instant Message Protocol (SCIMP).[1] It brought about support forasynchronous communication ("offline messages") as its major new feature, as well as better resilience with distorted order of messages and simpler support for conversations with multiple participants.[11] The Axolotl Ratchet was named after the critically endangered aquatic salamanderAxolotl, which has extraordinary self-healing capabilities. The developers refer to the algorithm as self-healing because it automatically disables an attacker from accessing thecleartext of later messages after having compromised asession key.[1]
The third version of the protocol, TextSecure v3, made some changes to the cryptographic primitives and the wire protocol.[7] In October 2014, researchers fromRuhr University Bochum published an analysis of TextSecure v3.[6][7] Among other findings, they presented anunknown key-share attack on the protocol, but in general, they found that it was secure.[12]
In March 2016, the developers renamed the protocol to Signal Protocol. They also renamed the Axolotl Ratchet to the Double Ratchet algorithm to better differentiate between the ratchet and the full protocol[13] because some had used the name Axolotl when referring to the full protocol.[14][13]
As of October 2016[update], the Signal Protocol is based on TextSecure v3, but with additional cryptographic changes.[7] In October 2016, researchers from the UK'sUniversity of Oxford, Australia'sQueensland University of Technology, and Canada'sMcMaster University published a formal analysis of the protocol, concluding that the protocol was cryptographically sound.[15][16]
Another audit of the protocol was published in 2017.[17]
The protocol provides confidentiality, integrity,authentication, participant consistency, destination validation,forward secrecy, post-compromise security (aka future secrecy), causality preservation, message unlinkability,message repudiation, participation repudiation, and asynchronicity.[18] It does not provide anonymity preservation and requires servers for the relaying of messages and storing of public key material.[18]
The Signal Protocol also supports end-to-end encrypted group chats. The group chat protocol is a combination of a pairwisedouble ratchet andmulticast encryption.[18] In addition to the properties provided by the one-to-one protocol, the group chat protocol provides speaker consistency, out-of-order resilience, dropped message resilience, computational equality, trust equality, subgroup messaging, as well as contractible and expandable membership.[18]
For authentication, users can manually comparepublic key fingerprints through an outside channel.[19] This makes it possible for users to verify each other's identities and avoid aman-in-the-middle attack.[19] An implementation can also choose to employ atrust on first use mechanism in order to notify users if a correspondent's key changes.[19]
The Signal Protocol does not prevent a company from retaining information about when and with whom users communicate.[20][21] There can therefore be differences in how messaging service providers choose to handle this information. Signal'sprivacy policy states that recipients' identifiers are only kept on the Signal servers as long as necessary in order to transmit each message.[22] In June 2016, Moxie Marlinspike toldThe Intercept: "the closest piece of information to metadata that the Signal server stores is the last time each user connected to the server, and the precision of this information is reduced to the day, rather than the hour, minute, and second."[21]
In October 2018, Signal Messenger announced that they had implemented a "sealed sender" feature into Signal, which reduces the amount of metadata that the Signal servers have access to by concealing the sender's identifier.[23][24] The sender's identity is conveyed to the recipient in each message, but is encrypted with a key that the server does not have.[24] This is done automatically if the sender is in the recipient's contacts or has access to their Signal Profile.[24] Users can also enable an option to receive "sealed sender" messages from non-contacts and people who do not have access to their Signal Profile.[24] A contemporaneous wiretap of the user's device and/or the Signal servers may still reveal that the device's IP address accessed a Signal server to send or receive messages at certain times.[23]
Open Whisper Systems first introduced the protocol in applicationTextSecure. They later merged an encrypted voice call application namedRedPhone into TextSecure and renamed itSignal.
In November 2014, Open Whisper Systems announced a partnership withWhatsApp to provide end-to-end encryption by incorporating the Signal Protocol into each WhatsApp client platform.[25] Open Whisper Systems said that they had already incorporated the protocol into the latest WhatsApp client forAndroid and that support for other clients, group/media messages, and key verification would be coming soon after.[26] On April 5, 2016, WhatsApp and Open Whisper Systems announced that they had finished adding end-to-end encryption to "every form of communication" on WhatsApp, and that users could now verify each other's keys.[27][28] In February 2017, WhatsApp announced a new feature, WhatsApp Status, which uses the Signal Protocol to secure its contents.[29] In October 2016, WhatsApp's parent companyFacebook also deployed an optional mode called Secret Conversations inFacebook Messenger which provides end-to-end encryption using an implementation of the Signal Protocol.[30][31][32][33]
In September 2015,G Data Software launched a new messaging app called Secure Chat which used the Signal Protocol.[34][35] G Data discontinued the service in May 2018.[36]
In September 2016,Google launched a new messaging app calledAllo, which featured an optional "incognito mode" that used the Signal Protocol for end-to-end encryption.[37][38] In March 2019, Google discontinued Allo in favor of theirGoogle Messages app on Android.[39][40] In November 2020, Google announced that they would be using the Signal Protocol to provide end-to-end encryption by default to allRCS-based conversations between users of theirGoogle Messages app, starting with one-to-one conversations.[4][41]
In January 2018, Open Whisper Systems andMicrosoft announced the addition of Signal Protocol support to an optionalSkype mode called Private Conversations.[42][43]
The Signal Protocol has had an influence on other cryptographic protocols. In May 2016,Viber said that their encryption protocol is a custom implementation that "uses the same concepts" as the Signal Protocol.[44][45] Forsta's developers have said that their app uses a custom implementation of the Signal Protocol.[46][47][independent source needed]
TheDouble Ratchet Algorithm that was introduced as part of the Signal Protocol has also been adopted by other protocols.OMEMO is an XMPP Extension Protocol (XEP) that was introduced in theConversations messaging app and approved by theXMPP Standards Foundation (XSF) in December 2016 as XEP-0384.[48][2]Matrix is an open communications protocol that includes Olm, a library that provides optional end-to-end encryption on a room-by-room basis via a Double Ratchet Algorithm implementation.[2] The developers ofWire have said that their app uses a custom implementation of the Double Ratchet Algorithm.[49][50][51]
Messaging Layer Security, anIETF proposal, usesAsynchronous ratcheting trees to efficiently improve upon security guarantees over Signal'sDouble Ratchet.[52]
Signal Messenger maintains areference implementation of the Signal Protocollibrary written inRust under theAGPLv3 license onGitHub. There are bindings to Swift, Java, TypeScript, C, and other languages that use the reference Rust implementation.
Signal previously maintained the following deprecated libraries:
There are also alternative libraries written by third-parties in other languages, such asTypeScript.[53]
| Email clients | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Secure communication |
| ||||||||||||||
| Disk encryption (Comparison) | |||||||||||||||
| Anonymity | |||||||||||||||
| File systems(List) | |||||||||||||||
| Security-focused operating system | |||||||||||||||
| Service providers | |||||||||||||||
| Educational | |||||||||||||||
| Anti–computer forensics | |||||||||||||||
| Related topics | |||||||||||||||
