--- title: How Trail of Bits helps verify the integrity of your... description: Signal's new Automatic Key Verification feature uses a key transparency system backed by three independent auditors — Signal, Cloudflare, and Trail of Bits —... canonical: https://daily.dev/posts/how-trail-of-bits-helps-verify-the-integrity-of-your-signal-chats-4doqn19ap twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Trail of Bits helps verify the integrity of your Signal chats | daily.dev og:description: Signal's new Automatic Key Verification feature uses a key transparency system backed by three independent auditors — Signal, Cloudflare, and Trail of Bits —... og:url: https://daily.dev/posts/how-trail-of-bits-helps-verify-the-integrity-of-your-signal-chats-4doqn19ap og:image: https://api.daily.dev/og/posts/4DOqn19ap.png og:image:alt: How Trail of Bits helps verify the integrity of your Signal chats og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Trail of Bits helps verify the integrity of your Signal chats **[Trail of Bits Blog](https://daily.dev/sources/trail-of-bits)** · 4 min read · 0 upvotes · 0 comments ## Summary Signal's new Automatic Key Verification feature uses a key transparency system backed by three independent auditors — Signal, Cloudflare, and Trail of Bits — to validate that public keys in chats haven't been tampered with. Trail of Bits built its auditor from scratch based on the published specification, maintaining a local Merkle tree copy of the user-to-public-key map and periodically signing the tree head. Clients require valid signatures from all three auditors within the last seven days, meaning a malicious server can maintain a split view for at most one week before warnings appear. The auditor code is open source. Users can enable the feature via Settings > Privacy > Advanced in Signal. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Signal's Automatic Key Verification work and who are the auditors? Signal's Automatic Key Verification is a key transparency system where clients require valid Merkle tree head signatures from three auditors — Signal, Cloudflare, and Trail of Bits — within the last seven days. Each auditor maintains an independent copy of the user-to-public-key map as a Merkle tree and periodically signs the tree head. A malicious server can maintain a split view for at most one week before client apps display warnings. _Developers building secure messaging systems track key transparency developments like this on daily.dev._ ### How long can a malicious Signal server hide a split-view attack before users are warned? A fully malicious Signal server can maintain a split view of the key transparency system for at most seven days. The Signal client requires auditor signatures on Merkle tree heads from all three registered auditors within the last seven days; if valid signatures are absent, the client raises a warning and Automatic Key Verification fails. _Engineers working on E2E encryption systems keep up with attack surface research like this on daily.dev._ ### How do I enable Automatic Key Verification in Signal? Enable Automatic Key Verification in Signal by going to Settings > Privacy > Advanced and toggling the feature on. In supported chats, you can verify a contact's public key on the safety number verification screen by clicking 'Verify Automatically.' Note that chats started by searching a recipient's username often do not support automatic verification; fall back to manual safety number comparison if automatic verification fails. _Privacy-focused developers following Signal's security feature rollouts find relevant updates on daily.dev._ ## Similar posts on daily.dev - [Key Transparency Comes to Messenger](https://daily.dev/posts/key-transparency-comes-to-messenger-amttyyxjj) · Facebook Engineering · 0 upvotes · 0 comments - [Building a Transparent Keyserver](https://daily.dev/posts/building-a-transparent-keyserver-pv1psypx6) · Filippo Valsorda · 0 upvotes · 0 comments - [Certificate Transparency Monitoring is now generally available](https://daily.dev/posts/certificate-transparency-monitoring-is-now-generally-available-9kxe8x3g2) · Cloudflare · 1 upvotes · 0 comments - [Trust in Protocols, Not Institutions: Transparency Logs for API Authorization](https://daily.dev/posts/trust-in-protocols-not-institutions-transparency-logs-for-api-authorization-om2jhvkww) · API Evangelist · 0 upvotes · 0 comments --- Tags: [#cryptography](https://daily.dev/tags/cryptography), [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/how-trail-of-bits-helps-verify-the-integrity-of-your-signal-chats-4doqn19ap) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Trail of Bits helps verify the integrity of your Signal chats","url":"https://daily.dev/posts/how-trail-of-bits-helps-verify-the-integrity-of-your-signal-chats-4doqn19ap","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-trail-of-bits-helps-verify-the-integrity-of-your-signal-chats-4doqn19ap"},"datePublished":"2026-08-11T17:39:33.405Z","dateModified":"2026-08-13T13:57:25.025Z","description":"Signal's new Automatic Key Verification feature uses a key transparency system backed by three independent auditors — Signal, Cloudflare, and Trail of Bits —...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/72f289c90f2a192f37720c5c8707d75f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/72f289c90f2a192f37720c5c8707d75f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trail of Bits Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trail of Bits Blog","logo":"https://media.daily.dev/image/upload/s--TLbYx4ip--/f_auto,q_auto/v1780213255/logos/trail-of-bits?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trail-of-bits"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-trail-of-bits-helps-verify-the-integrity-of-your-signal-chats-4doqn19ap","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cryptography,encryption","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trail of Bits Blog","item":"https://daily.dev/sources/trail-of-bits"},{"@type":"ListItem","position":3,"name":"How Trail of Bits helps verify the integrity of your Signal chats"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-trail-of-bits-helps-verify-the-integrity-of-your-signal-chats-4doqn19ap#faq","mainEntity":[{"@type":"Question","name":"How does Signal's Automatic Key Verification work and who are the auditors?","acceptedAnswer":{"@type":"Answer","text":"Signal's Automatic Key Verification is a key transparency system where clients require valid Merkle tree head signatures from three auditors — Signal, Cloudflare, and Trail of Bits — within the last seven days. Each auditor maintains an independent copy of the user-to-public-key map as a Merkle tree and periodically signs the tree head. A malicious server can maintain a split view for at most one week before client apps display warnings. Developers building secure messaging systems track key transparency developments like this on daily.dev."}},{"@type":"Question","name":"How long can a malicious Signal server hide a split-view attack before users are warned?","acceptedAnswer":{"@type":"Answer","text":"A fully malicious Signal server can maintain a split view of the key transparency system for at most seven days. The Signal client requires auditor signatures on Merkle tree heads from all three registered auditors within the last seven days; if valid signatures are absent, the client raises a warning and Automatic Key Verification fails. Engineers working on E2E encryption systems keep up with attack surface research like this on daily.dev."}},{"@type":"Question","name":"How do I enable Automatic Key Verification in Signal?","acceptedAnswer":{"@type":"Answer","text":"Enable Automatic Key Verification in Signal by going to Settings > Privacy > Advanced and toggling the feature on. In supported chats, you can verify a contact's public key on the safety number verification screen by clicking 'Verify Automatically.' Note that chats started by searching a recipient's username often do not support automatic verification; fall back to manual safety number comparison if automatic verification fails. Privacy-focused developers following Signal's security feature rollouts find relevant updates on daily.dev."}}]} ```