Why Receipt Notifications Increase Security In Signal

This blog post is aimed to express and explain my surprise about Signal being more secure than I thought (due to receipt acknowledgments). I hope you find it interesting, too.

Signal, and especially its state update protocol, the Double Ratchet algorithm, are widely known for significantly increasing security for instant messaging. While most users first see the end-to-end security induced by employing Signal in messaging apps, the properties achieved due to ratcheting go far beyond protecting communication against (active) attackers on the wire. Due to updating the local device secrets via the Double Ratchet algorithm, the protocol ensures that attackers, who temporarily obtain a device's local storage (on which Signal runs), only compromise confidentiality of parts of the communications with this device. Thus, the leakage of local secrets from a device only affects security of a short frame of communication. The exact duration of compromise depends on the messaging pattern among the communicating parties (i.e., who sends and receives when), as the state update is conducted during the sending and receiving of payload messages.

The Double Ratchet

The Double Ratchet algorithm consists of two different update mechanisms: the symmetric ratchet and the asymmetric ratchet. The former updates symmetric key material by hashing and then overwriting it with the hash output (i.e.,  k:=H(k)). Thus, an attacker, obtaining key material can only predict future versions of the state but, due to the one-wayness of the hash function, cannot recover past states. The asymmetric ratchet consists of Diffie-Hellman key exchanges (DHKE). If, during the communication, party A receives a new DH share g^b as part of a message from the communication partner B, then A samples a new DH exponent a and responds with the respective DH share g^a in the next sent message. On receipt of this DH share, B will again sample a new DH exponent b' and attach the DH share g^b' to the next message to A. With every new DH share, a new DHKE g^ab is computed among A and B and mixed into the key material (i.e., k:=H(k,g^ab)). For clarity, I leave out a lot of details and accuracy. As new DH shares g^a and g^b are generated from randomly sampled DH exponents a and b, and the computation of g^ab is hard if neither a nor b are known, the key material recovers from an exposure of the local secrets to an attacker after a new value g^ab was freshly established and mixed into it. Summing up this mechanism, if an attacker obtains the local state of a Signal client, then this attacker cannot recover any previously received message (if the message itself was not contained in the local state), nor can it read messages that are sent after a new g^ab was established and mixed into the state. The latter case happens with every full round-trip among A and B (i.e., A receives from B, A sends to B, and A receives again from B).

Conceptual depiction of Double Ratchet in Signal two years ago (acknowledgments were only protected between client and server). The asymmetric ratchet fully updates the local secrets after one round-trip of payload messages.

Research on Ratcheting

During the last two years, the Signal protocol inspired the academic research community: First, a formal security proof of Signal was conducted [1] and then ratcheting was formalized as a generic primitive (independent of Signal) [2,3,4]. This formalization includes security definitions that are derived via 1. defining an attacker, 2. requiring security unless it is obvious that security cannot be reached. Protocols, meeting this optimal notion of security, were less performant than the Double Ratchet algorithm [3,4]. However, it became evident that the Double Ratchet algorithm is not as secure as it could be (e.g., recovery from exposure could be achieved quicker than after a full round-trip; see, e.g., Appendix G of our paper [3]). Afterwards, protocols (for slightly weakened security notions) were proposed that are similarly performant as Signal but also a bit more secure [5,6,7].

Protecting Acknowledgments ...

In our analysis of instant messaging group chats [8] two years ago (blog posts: [9,10]), we found out that none of the group chat protocols (Signal, WhatsApp, Threema) actually achieves real recovery from an exposure (thus the asymmetric ratchet is not really effective in groups; a good motivation for the MLS project) and that receipt acknowledgments were not integrity protected in Signal nor WhatsApp. The latter issue allowed an attacker to drop payload messages in transmission and forge receipt acknowledgments to the sender such that the sender falsely thinks the message was received. Signal quickly reacted on our report by treating acknowledgments as normal payload messages: they are now authenticated(-encrypted) using the Double Ratchet algorithm.

... Supports Asymmetric Ratchet

Two years after our analysis, I recently looked into the Signal code again. For a training on ratcheting I wanted to create an exercise for which the lines in the code should be found that execute the symmetric and the asymmetric ratchet respectively. Somehow I observed that the pure symmetric ratchet (only updates via hash functions) was nearly never executed (especially not when I expected it) when lively debugging the app but almost always new DH shares were sent or received. I realized that, due to encrypting the receipt acknowledgments now, the app always conducts full round-trips with every payload message. In order to observe the symmetric ratchet, I needed to temporarily turn on the flight mode on my phone such that acknowledgments are not immediately returned.

Conceptual depiction of Double Ratchet in Signal now (acknowledgments encrypted). The asymmetric ratchet fully updates the local secrets after an acknowledgment for a message is received.

Consequently, Signal conducts a full DHKE on every sent payload message (in case the receiving device is not offline) and mixes the result into the state. However, a new DH exponent is always already sampled on the previous receipt (see sketch of protocol above). Thus, the exponent for computing a DHKE maybe remained in the local device state for a while. In order to fully update the state's key material, two round-trips must be initiated by sending two payload messages and receiving the resulting two acknowledgments. Please note that not only the mandatory receipt acknowledgments are encrypted but also notifications on typing and reading a message.

If you didn't understand exactly what that means, here a tl;dr: If an attacker obtains your local device state, then with Signal all previous messages stay secure and (if the attacker does not immediately use these secrets to actively manipulate future conversations) all future messages are secure after you wrote two messages (and received receipt acknowledgments) in all of your conversations. Even though this is very (in practice certainly sufficiently) secure, recent protocols provide stronger security (as mentioned above) and it remains an interesting research goal to increase their performance.

[1] https://eprint.iacr.org/2016/1013.pdf
[2] https://eprint.iacr.org/2016/1028.pdf
[3] https://eprint.iacr.org/2018/296.pdf
[4] https://eprint.iacr.org/2018/553.pdf
[5] https://eprint.iacr.org/2018/889.pdf
[6] https://eprint.iacr.org/2018/954.pdf
[7] https://eprint.iacr.org/2018/1037.pdf
[8] https://eprint.iacr.org/2017/713.pdf
[9] https://web-in-security.blogspot.com/2017/07/insecurities-of-whatsapps-signals-and.html
[10] https://web-in-security.blogspot.com/2018/01/group-instant-messaging-why-baming.html

Related word

1. Pentest Tools For Windows
2. Hacker Tools Hardware
3. Hacking Tools
4. Hacker Tools
5. Hacks And Tools
6. Hacker Tools Free
7. Pentest Automation Tools
8. Hacker Tools 2020
9. Hacker Tools 2020
10. Hacker Tools For Mac
11. Game Hacking
12. Hacking Tools Hardware
13. Best Hacking Tools 2019
14. Hack Tools For Mac
15. What Is Hacking Tools
16. Hacker Tools List
17. World No 1 Hacker Software
18. Pentest Tools Download
19. Hacking Tools Software
20. Hack Tools For Games
21. Hacking Tools 2019
22. Hacking Tools
23. Pentest Tools Kali Linux
24. Hacker Hardware Tools
25. Hacker Tools Free
26. Pentest Tools Review
27. Hacking Tools For Mac
28. Pentest Tools Subdomain
29. Hacking Tools Usb
30. Wifi Hacker Tools For Windows
31. Hacker Tools
32. Pentest Tools Tcp Port Scanner
33. Hack Website Online Tool
34. Hackers Toolbox
35. Pentest Tools Bluekeep
36. Tools Used For Hacking
37. Tools For Hacker
38. Hacking Tools For Kali Linux
39. Hacker
40. Hacker Tools Online
41. Hacking Tools Download
42. Hacking Tools For Windows
43. Hackrf Tools
44. Pentest Reporting Tools
45. What Is Hacking Tools
46. Kik Hack Tools
47. Wifi Hacker Tools For Windows
48. Hacker Tools For Windows
49. Hacking Tools For Windows Free Download
50. Hacker Tools Software
51. Nsa Hack Tools Download
52. Hacking Tools For Pc
53. Hacking Tools For Windows 7
54. Hacking Tools For Windows Free Download
55. Usb Pentest Tools
56. Pentest Tools Download
57. Hacking Tools For Games
58. Hacking Tools Download
59. Hacker Tools For Mac
60. Beginner Hacker Tools
61. Hacker Tools
62. Computer Hacker
63. Hacker Tools Linux
64. How To Make Hacking Tools
65. Hacker Tools Software
66. Hack Apps
67. Hacking Tools For Kali Linux
68. Hack Tools For Mac
69. Hacking Tools Windows
70. Hacker Tools For Pc
71. Usb Pentest Tools
72. Hacking Tools Windows
73. Hacking Tools Online
74. Top Pentest Tools
75. Hacking Tools Free Download
76. Pentest Tools Windows
77. Pentest Reporting Tools
78. Pentest Tools Download
79. Hak5 Tools
80. Blackhat Hacker Tools
81. Hacking Tools Github
82. Hacker Tools Mac
83. Hacker Tools Linux
84. Hack Tools 2019
85. Hacker Tools Free Download
86. What Is Hacking Tools
87. Hacking Tools For Kali Linux
88. Tools 4 Hack
89. Pentest Tools
90. Pentest Tools Linux
91. Hacking Tools Pc
92. Tools For Hacker
93. Hacker Tools List
94. Hacker Tools Apk Download
95. Pentest Tools Url Fuzzer
96. Hacker Tools List
97. Hacker Tools Github
98. Game Hacking
99. Hacker Tools List
100. Hacker Tools 2020
101. Hack App
102. Hack Tools 2019
103. Pentest Tools List
104. Growth Hacker Tools
105. Hacker Tools Github
106. Hack Tools 2019
107. Hacker Tools Mac
108. Hack Rom Tools
109. Hack Tools Mac
110. Free Pentest Tools For Windows
111. Hacking Tools And Software
112. Hacking Tools For Beginners
113. Tools 4 Hack
114. Tools 4 Hack
115. Hacker Tools Linux
116. Growth Hacker Tools
117. Hackrf Tools
118. Hacking Tools For Beginners
119. Hacker Tools Software
120. Hacking Tools For Mac
121. Hacker Tools List
122. Pentest Tools Website Vulnerability
123. Hacker Security Tools
124. New Hack Tools
125. Hacking Tools Download
126. Hack Tools Mac
127. Pentest Tools For Android
128. Black Hat Hacker Tools
129. Hacking Tools Hardware
130. Pentest Tools
131. Pentest Tools Url Fuzzer
132. Growth Hacker Tools
133. Hack Tools
134. Pentest Tools Free
135. New Hacker Tools
136. Hack Tools 2019
137. Hacker Tools Windows
138. Hacker Search Tools
139. Pentest Tools List
140. Pentest Reporting Tools
141. Hackers Toolbox
142. Hacker Tools Apk Download
143. Easy Hack Tools
144. Hackers Toolbox
145. Easy Hack Tools
146. Pentest Tools Windows
147. Hacking Tools Github
148. Hacker Tools Software
149. Hacker Tools For Ios
150. Hacker Tools Github
151. Hacking Tools For Beginners
152. Hacker Security Tools
153. Pentest Tools Free
154. Pentest Reporting Tools
155. Black Hat Hacker Tools
156. Free Pentest Tools For Windows
157. Hacking Tools For Pc
158. Android Hack Tools Github
159. Pentest Tools Open Source
160. Hack Tools
161. Hacking Tools And Software