Google DeepMind researchers used agentic AI to mathematically prove, or formally verify, several key cryptographic guarantees of the Signal protocol, according to Ars Technica. Completed in just four weeks as a proof-of-concept project, the work validates the cryptography protecting communications on apps like Signal, Google Messages, and WhatsApp while showcasing a new AI framework called AlphaProof Code.
Key takeaways
- Google DeepMind used agentic AI to formally verify parts of the Signal protocol.
- The proof-of-concept project took just four weeks to complete.
- Researchers used a new AI framework named AlphaProof Code.
- The analysis correctly identified known vulnerabilities in older versions of Signal.
How did google DeepMind agentic AI test the Signal protocol?
Ars Technica reports that the team at DeepMind used their new AI framework, AlphaProof Code, to check the cryptographic guarantees of the protocol. Before this project, human experts spent vast amounts of time writing software descriptions, turning them into formulas, and developing proofs by hand. Agentic AI cut down the time needed for the proof phase of the project.
Even with this new technology, the scope of the analysis remained limited. The team did not formally verify the entire mobile app. When researchers tested older versions of Signal containing known and long-fixed vulnerabilities, AlphaProof Code correctly spotted them and showed those versions could not be verified.
What does AlphaProof Code mean for software security?
Proponents of formal verification often call it a holy grail for software security because it uses math to prove code functions properly without critical vulnerabilities. Swarat Chaudhuri, a DeepMind research scientist, told WIRED that researchers are excited by the result but noted there is a long distance to go before scaling this approach to all software in the world. The team did not find any new flaws in the parts of the protocol they examined.
What happens next?
Google DeepMind is releasing the specification and proof developed during the analysis to help other formal verification projects. While the framework shows promise for speeding up security checks, experts point out that questions remain about how practical the method will be for widespread use and how well it can secure massive amounts of code. The researchers view their findings as a single milestone in a much larger ongoing process.
Frequently asked questions
Google DeepMind researchers used agentic AI to mathematically prove, or formally verify, a number of the Signal protocol's key cryptographic guarantees in a four-week proof-of-concept project.
AlphaProof Code is a new AI framework created by Google DeepMind that demonstrates the company's formal verification capabilities by cutting down the time needed to develop mathematical proofs for software.
No, the DeepMind analysis did not find any new vulnerabilities in the portions of the Signal protocol that the researchers looked at during the project.
When researchers used AlphaProof Code on older versions of Signal containing known and long-fixed vulnerabilities, the tool correctly identified them and showed the protocol could not be formally verified.
Google DeepMind researchers are releasing the specification and proof they developed for the Signal protocol analysis to aid other formal verification work.
Based on reporting by Ars Technica. Read the original article
