Google DeepMind researchers used a new AI framework called AlphaProof Code to mathematically verify key security guarantees in the compiled code behind the Signal Protocol.
The proofs cover how the protocol establishes encrypted conversations and protects messages when an attacker temporarily obtains a device’s cryptographic keys.
DeepMind researchers announced the results on November 10, saying the verification took four weeks. Earlier research had already established security properties of the protocol’s design. DeepMind’s team checked whether those guarantees hold in the machine instructions produced when the reference implementation is compiled, where flaws can arise even when the design is sound.
The Signal Protocol underpins end-to-end encryption in Signal and is also used in Google Messages. DeepMind analyzed an executable built for 64-bit Arm processors from version 0.105.4 of libsignal, the protocol’s reference implementation.
What the researchers proved
The analysis covered PQXDH, the handshake that establishes a shared secret at the start of a conversation, and the Triple Ratchet, which updates the keys used to encrypt messages. The researchers proved properties that protect message confidentiality and authenticity, including forward secrecy, which keeps earlier messages protected if an attacker later steals the current session keys. They also showed that protection for future messages can recover once the parties exchange fresh key material under the conditions described in the paper.
The team separately proved handshake secrecy in a model where an attacker can later break the classical Diffie–Hellman exchange, simulating a future quantum threat. The study’s guarantees depend on the researchers’ attacker models and assumptions about the underlying cryptographic operations. Its scope was the core protocol implementation, with side channels and the rest of the messaging app outside the analysis.
How the AI proofs were checked
Researchers worked with AI models to express each security goal as a mathematical specification, which human experts reviewed. Agents powered by Gemini Carbon then generated about 6.5 million lines of proof code in Lean, a language and proof assistant that checks whether each proof establishes the stated result. The team modeled how the compiled Arm instructions run, allowing Lean to check claims about the executable itself.
