17:35Machine-translated from Azerbaijani by AIRead in Azerbaijani
DeepMind Mathematically Verifies Signal Protocol Rules Using AI
Google DeepMind researchers have mathematically verified the Signal protocol’s core encryption rules. AlphaProof Code, an AI system that takes steps independently as an agent, was used in the analysis. The Signal protocol is used for end-to-end encryption not only in the Signal app, but also in WhatsApp and Google Messages.
Formal verification is a method that tests software’s security promises using mathematical proofs. Conventional tests look for known weaknesses but do not fully guarantee that no other vulnerabilities exist. Formal verification attempts to prove that a protocol works correctly in all predefined scenarios. Google DeepMind used AI to accelerate much of the time-consuming work involved in preparing this proof. The study did not cover the entire Signal mobile app. Only selected parts of the protocol and its core encryption rules were examined. The analysis lasted 4 weeks, and no new security vulnerabilities were found in the portions studied. The system also tested older versions in which vulnerabilities had previously been found and fixed. AlphaProof Code correctly identified those problems and showed that these versions failed formal verification. Although the project was completed quickly, the work did not start from scratch. The researchers drew on the results of formal verifications that the Signal Foundation had previously conducted without AI. Google did not disclose how much computing power or money was spent on the project. It therefore remains unclear whether this method can be applied to large programs and entire codebases at a reasonable cost.
Google DeepMind will publish the technical specification and mathematical proof it developed to help other formal verification projects. At many stages of the process, AI agents can correct their results, while humans conduct checks at critical points. The researchers do not consider it appropriate for the goals and proofs to be prepared solely by the system. They prefer humans and AI to work together in a controlled manner. The results provide additional independent confirmation of the reliability of the encryption system that protects messaging services. In the future, the same method could also be used to examine software used by banks and other critical services. However, the project was conducted free of charge for research purposes. Google has not disclosed whether it is developing a commercial product or service based on this technology. According to the researchers, there is still a long way to go before the technology can be used across all software.
Formal verification is a method that tests software’s security promises using mathematical proofs. Conventional tests look for known weaknesses but do not fully guarantee that no other vulnerabilities exist. Formal verification attempts to prove that a protocol works correctly in all predefined scenarios. Google DeepMind used AI to accelerate much of the time-consuming work involved in preparing this proof. The study did not cover the entire Signal mobile app. Only selected parts of the protocol and its core encryption rules were examined. The analysis lasted 4 weeks, and no new security vulnerabilities were found in the portions studied. The system also tested older versions in which vulnerabilities had previously been found and fixed. AlphaProof Code correctly identified those problems and showed that these versions failed formal verification. Although the project was completed quickly, the work did not start from scratch. The researchers drew on the results of formal verifications that the Signal Foundation had previously conducted without AI. Google did not disclose how much computing power or money was spent on the project. It therefore remains unclear whether this method can be applied to large programs and entire codebases at a reasonable cost. Google DeepMind will publish the technical specification and mathematical proof it developed to help other formal verification projects. At many stages of the process, AI agents can correct their results, while humans conduct checks at critical points. The researchers do not consider it appropriate for the goals and proofs to be prepared solely by the system. They prefer humans and AI to work together in a controlled manner. The results provide additional independent confirmation of the reliability of the encryption system that protects messaging services. In the future, the same method could also be used to examine software used by banks and other critical services. However, the project was conducted free of charge for research purposes. Google has not disclosed whether it is developing a commercial product or service based on this technology. According to the researchers, there is still a long way to go before the technology can be used across all software.