Reasoning about Authentication and Secrecy in the Signal Protocol

Increasing concern about security and privacy in instant messaging applications has led many users to question whether their messages are really properly encrypted. Signal is emerging as one of the more popular instant messaging applications that promises to protect messages by providing authentication between users, and protection from an adversary learning previous and future keys if it happens upon one key. Studies of the Signal application use traditional cryptographic proof techniques and show that it is secure. In contrast, little work has been down to analyse security of Signal in the setting of ‘who knows what’. We present a security analysis of the Signal protocol using epistemic logic to express security properties and analyse its behaviour. We find the protocol is indeed secure. By focusing on expressing security properties before implementation, this work contributes to the development of standards for security-by-design rather than security as an afterthought.