1. History

2. Properties
     Authentication   Metadata 

3. Usage

4. Influence

5. Implementations

6. See also

7. References

8. Literature

9. External links

The Signal Protocol (formerly known as the TextSecure Protocol) is a non-federated cryptographic protocol that can be used to provide end-to-end encryption for voice calls, video calls,^[3] and instant messaging conversations.^[1] The protocol was developed by Open Whisper Systems in 2013^[1] and was first introduced in the open-source TextSecure app, which later became Signal. Several closed-source applications claim to have implemented the protocol, such as WhatsApp, which is said to encrypt the conversations of "more than a billion people worldwide".^[2] Facebook Messenger also say they offer the protocol for optional "secret conversations", as does Google Allo for its "incognito mode".

The protocol combines the Double Ratchet algorithm, prekeys, and a triple Diffie–Hellman (3-DH) handshake,^[3] and uses Curve25519, AES-256, and HMAC-SHA256 as primitives.^[4]

History

The Signal Protocol's development was started by Trevor Perrin and Moxie Marlinspike (Open Whisper Systems) in 2013. The first version of the protocol, TextSecure v1, was based on Off-the-Record Messaging (OTR).^[9][5]

On 24 February 2014, Open Whisper Systems introduced TextSecure v2,^[6] which migrated to the Axolotl Ratchet.^[9][7] The design of the Axolotl Ratchet is based on the ephemeral key exchange that was introduced by OTR and combines it with a symmetric-key ratchet modeled after the Silent Circle Instant Messaging Protocol (SCIMP).^[8] It brought about support for asynchronous communication ("offline messages") as its major new feature, as well as better resilience with distorted order of messages and simpler support for conversations with multiple participants.^[9] The Axolotl Ratchet was named after the critically endangered aquatic salamander Axolotl, which has extraordinary self-healing capabilities. The developers refer to the algorithm as self-healing because it automatically disables an attacker from accessing the cleartext of later messages after having compromised a session key.^[8]

The third version of the protocol, TextSecure v3, made some changes to the cryptographic primitives and the wire protocol.^[9] In October 2014, researchers from Ruhr University Bochum published an analysis of TextSecure v3.^[4][9] Among other findings, they presented an unknown key-share attack on the protocol, but in general, they found that it was secure.^[10]

In March 2016, the developers renamed the protocol as the Signal Protocol. They also renamed the Axolotl Ratchet as the Double Ratchet algorithm to better differentiate between the ratchet and the full protocol^[21] because some had used the name Axolotl when referring to the full protocol.^[11][12]

Properties

The protocol provides confidentiality, integrity, authentication, participant consistency, destination validation, forward secrecy, post-compromise security (aka future secrecy), causality preservation, message unlinkability, message repudiation, participation repudiation, and asynchronicity.^[29] It does not provide anonymity preservation and requires servers for the relaying of messages and storing of public key material.^[16]

The Signal Protocol also supports end-to-end encrypted group chats. The group chat protocol is a combination of a pairwise double ratchet and multicast encryption.^[16] In addition to the properties provided by the one-to-one protocol, the group chat protocol provides speaker consistency, out-of-order resilience, dropped message resilience, computational equality, trust equality, subgroup messaging, as well as contractible and expandable membership.^[16]

Authentication

For authentication, users can manually compare public key fingerprints through an outside channel.^[17] This makes it possible for users to verify each other's identities and avoid a man-in-the-middle attack.^[17] An implementation can also choose to employ a trust on first use mechanism in order to notify users if a correspondent's key changes.^[17]

Metadata

The Signal Protocol does not prevent a company from retaining information about when and with whom users communicate.^[18][37] There can therefore be differences in how messaging service providers choose to handle this information. Signal's privacy policy states that recipients' identifiers are only kept on the Signal servers as long as necessary in order to transmit each message.^[19] In June 2016, Moxie Marlinspike told The Intercept: "the closest piece of information to metadata that the Signal server stores is the last time each user connected to the server, and the precision of this information is reduced to the day, rather than the hour, minute, and second."^[20]

In October 2018, the Signal Foundation announced that it had implemented a "sealed sender" protocol feature, which if enabled in the clients' Settings, prevents the Signal servers from learning the identity of the sender of each message.^[21] The sender's identity is conveyed to the recipient in each message, but is encrypted with a key that the server does not have. However, contemporaneous wiretaps of the user's device and/or the Signal servers can reveal that the device's IP address accessed a Signal server to send or receive messages at certain times.^[21]

Usage

Open Whisper Systems first introduced the protocol in their TextSecure app. They later merged an encrypted voice calling application called RedPhone into the TextSecure app and renamed it as Signal. RedPhone used ZRTP to encrypt its calls. In March 2017, Signal transitioned to a new WebRTC-based^[3] calling system that also introduced the ability to make video calls.^[22] Signal's new calling system uses the Signal Protocol for end-to-end encryption.^[23]

In November 2014, Open Whisper Systems announced a partnership with WhatsApp to provide end-to-end encryption by incorporating the Signal Protocol into each WhatsApp client platform.^[24] Open Whisper Systems said that they had already incorporated the protocol into the latest WhatsApp client for Android and that support for other clients, group/media messages, and key verification would be coming soon after.^[25] On April 5, 2016, WhatsApp and Open Whisper Systems announced that they had finished adding end-to-end encryption to "every form of communication" on WhatsApp, and that users could now verify each other's keys.^[26][27] In February 2017, WhatsApp announced a new feature, WhatsApp Status, which uses the Signal Protocol to secure its contents.^[28]

In September 2015, G Data Software launched a new messaging app called Secure Chat which uses the Signal Protocol.^[29][30]

In September 2016, Google launched a new messaging app called Allo, which features an optional Incognito Mode that uses the Signal Protocol for end-to-end encryption.^[31][32]

In October 2016, Facebook deployed an optional mode called Secret Conversations in Facebook Messenger which provides end-to-end encryption using an implementation of the Signal Protocol.^{[33][34][35][36]}

In January 2018, Open Whisper Systems and Microsoft announced the addition of Signal Protocol support to an optional Skype mode called Private Conversations.^[37][38]

Influence

The Signal Protocol has had an influence on other cryptographic protocols. In May 2016, Viber said that their encryption protocol is a custom implementation that "uses the same concepts" as the Signal Protocol.^[39][40] Forsta's developers have said that their app uses a custom implementation of the Signal Protocol.^[41][42]{{third-party inline|date=February 2019}}

The Double Ratchet algorithm that was introduced as part of the Signal Protocol has also been adopted by other protocols. OMEMO is an XMPP Extension Protocol (XEP) that was introduced in the Conversations messaging app and approved by the XMPP Standards Foundation (XSF) in December 2016 as XEP-0384.^[43][1] Matrix is an open communications protocol that includes Olm, a library that provides for optional end-to-end encryption on a room-by-room basis via a Double Ratchet algorithm implementation.^[1] The developers of Wire have said that their app uses a custom implementation of the Double Ratchet algorithm.^[44][45][46]

Implementations

Open Whisper Systems maintains the following Signal Protocol libraries on GitHub:

• [https://github.com/whispersystems/libsignal-protocol-c libsignal-protocol-c]: A library written in C and published under the GPLv3 license with additional permissions for Apple's App Store.
• [https://github.com/whispersystems/libsignal-protocol-java libsignal-protocol-java]: A library written in Java and published under the GPLv3 license.
• [https://github.com/whispersystems/libsignal-protocol-javascript libsignal-protocol-javascript]: A library written in JavaScript and published under the GPLv3 license.

See also

• Comparison of instant messaging protocols
• Comparison of cryptography libraries

References

Literature

• {{cite journal|last1=Cohn-Gordon|first1=Katriel|last2=Cremers|first2=Cas|last3=Dowling|first3=Benjamin|last4=Garratt|first4=Luke|last5=Stebila|first5=Douglas|title=A Formal Security Analysis of the Signal Messaging Protocol |url=https://eprint.iacr.org/2016/1013.pdf |website=Cryptology ePrint Archive |publisher=International Association for Cryptologic Research (IACR) |date=25 October 2016 |ref={{harvid|Cohn-Gordon|Cremers|Dowling|Garratt|2016}} }}
• {{cite conference|last1=Ermoshina|first1=Ksenia|last2=Musiani|first2=Francesca|last3=Halpin|first3=Harry|editor=Bagnoli, Franco |display-editors=etal |pages=244–254|title=End-to-End Encrypted Messaging Protocols: An Overview|book-title=Internet Science |publisher=Springer |location=Florence, Italy |conference=INSCI 2016 |doi=10.1007/978-3-319-45982-0_22 |isbn=978-3-319-45982-0 |date=September 2016 |ref={{harvid|Ermoshina|Musiani|Halpin|2016}} }}
• {{Cite conference|last1=Frosch |first1=Tilman |last2=Mainka |first2=Christian |last3=Bader |first3=Christoph |last4=Bergsma |first4=Florian |last5=Schwenk |first5=Jörg |last6=Holz |first6=Thorsten |title=How Secure is TextSecure? |conference=2016 IEEE European Symposium on Security and Privacy (EuroS&P) |publisher= IEEE |url=http://ieeexplore.ieee.org/document/7467371/ |format= |location=Saarbrücken, Germany |date=March 2016 |pages=457–472 |doi= 10.1109/EuroSP.2016.41 |isbn= 978-1-5090-1752-2 |ref={{harvid|Frosch|Mainka|Bader|Bergsma|2016}} |accessdate=28 September 2016 }}
• {{Cite conference|last1=Rottermanner|first1=Christoph|last2=Kieseberg|first2=Peter|last3=Huber|first3=Markus|last4=Schmiedecker|first4=Martin|last5=Schrittwieser|first5=Sebastian|title=Privacy and Data Protection in Smartphone Messengers|url=https://www.sba-research.org/wp-content/uploads/publications/paper_drafthp.pdf|format=PDF|conference=Proceedings of the 17th International Conference on Information Integration and Web-based Applications & Services (iiWAS2015)|publisher=ACM International Conference Proceedings Series|isbn=978-1-4503-3491-4|date=December 2015 |ref={{harvid|Rottermanner|Kieseberg|Huber|Schmiedecker|2015}} |accessdate=25 September 2016}}
• {{cite conference |first1 = Nik |last1=Unger |first2=Sergej |last2=Dechand |first3=Joseph |last3=Bonneau |first4=Sascha |last4=Fahl |first5= Henning |last5=Perl |first6=Ian Avrum |last6=Goldberg |first7= Matthew |last7= Smith |title = SoK: Secure Messaging |publisher = IEEE Computer Society's Technical Committee on Security and Privacy |conference = Proceedings of the 2015 IEEE Symposium on Security and Privacy |year = 2015 |pages = 232–249 |isbn = |doi=10.1109/SP.2015.22 |url = http://ieee-security.org/TC/SP2015/papers-archived/6949a232.pdf|format=PDF |ref={{harvid|Unger|Dechand|Bonneau|Fahl|2015}} }}

External links

• {{Official|https://signal.org/docs}}
• [https://www.youtube.com/watch?v=7WnwSovjYMs "TextSecure Protocol: Present and Future"], talk by Trevor Perrin at NorthSec 2015 (video)

• Vilhjalmur Vilhjálmsson
• Vilhjálmur Hjálmarsson
• Vilhjálmur Vilhjálmsson
• Vilhjálmur Vilhjálmsson (singer)
• Vilhjálmur Þ. Vilhjálmsson
• Vilho Hietakari
• Vilho Kivioja
• Vilho Lehokas
• Vilho Suosalo
• Vilho Tervasmäki
• Vilho Turunen
• Viliame
• Viliame Gavoka
• Viliame Iongi
• Viliame Kikau
• Viliami Maʻafu
• Viliami Ta'u Tangi
• Viliami Tolutaʻu
• Viliami Tungi Mailefihi
• Viliami Vaitaki
• Viliami Veasi'i Veikune
• Viliam Konig
• Viliam König
• Viliam Loviška
• Viliamu