Signal messenger security analysis illustration — Artwork of an isolated but mobile Signal antenna in a field generated using ideogram-v3-turbo in the style of Simon Stålenhag

A Look into Signal's Security

Feb 21, 2022 • Last updated May 30, 2025

Signal has earned a reputation as the gold standard for secure messaging. Journalists rely on it, and even heads of state of a certain western superpower.¹

In this post, we'll examine Signal's underlying security protocols, third-party audits and look into some peer-reviewed research papers to find out the strengths and potential shortcomings.

The Protocol

The Signal protocol is the secure instant messaging protocol that powers not just Signal, but also major platforms like WhatsApp, Skype, and Messages by Google. It combines two cryptographic systems designed to keep malicious eavesdroppers like Mallory from decrypting messages while in transit, and keeps Alice and Bob safe.

The protocol can be split into two of its components:

Extended Triple Diffie-Hellman (X3DH) key agreement
Double Ratchet algorithm

Here's a simplified overview of the protocol. Signal Protocol Overview

Fig. 1: Overview of the Signal protocol

Let's say Alice wants to send a message to Bob. As we can see, there's a paint-mixing process, as part of the X3DH key agreement, and a key management which is Double Ratchet. We will look into both these later.

For now, let us look at the Key derivation function (KDF), it will come in handy later. It provides a chain key 🔑 which is used to propagate Alice and Bob's secrets, the ones used to encrypt their messages, and in the event they keep chatting with each other, generates new chain keys. This simplifies the process by not discussing the presence of a root key etc., but we won't concern ourselves with it in this blog.

Before we delve into the individual components, let us look at something optimistic. The first formal security audit of the Signal protocol, conducted by Cohn-Gordon et al. in 2016, concluded:²

Our analysis proves that several standard security properties are satisfied by the protocol, and we have found no major flaws in its design, which is very encouraging.

However, further research has been conducted since then, we will get into them later when they become relevant.

Shake on it with X3DH

The Extended Triple Diffie-Hellman (X3DH) key agreement extends the classic Diffie-Hellman protocol to create a shared secret key between two parties who then mutually authenticate each other based on their public keys. Let us understand how it works with an analogy.

Think of X3DH like a sophisticated paint-mixing process:

Alice and Bob each have secret pigments (private keys). In our case, Alice picks a and Bob picks b.
They mix their secret pigments with a generator, say white paint (g) to get some colors. Alice gets 🟡 (g^a = A) and Bob gets 🔵 (g^b = B).
They share these colors out into the world (even Mallory can see them).
Each of them adds their secret color to the other's mixture.
Alice's 🟡 into Bob's 🔵 (A^b) and Bob's 🔵 into Alice's 🟡 (B^a).
They end up with the same final color 🟢 - which becomes their shared secret!
🟡 ⊕ 🔵 = 🟢 (A^b = B^a = g^ab)

Even if someone intercepts the mixed colors (🟡 and 🔵), they can't get back the original secret colors or determine the final result.

X3DH key agreement

Fig. 2: X3DH key agreement

But I never mentioned why even if someone intercepts the key, they can't expose the communication chain. To break DH currently, an attacker needs to solve a discrete log problem which was shown - a computational challenge requiring extreme resources costing millions of dollars, something only feasible for government agencies.⁴ Even then, the benefits are limited because the protocol generates new keys with every new message sent. This ensures Forward secrecy is the security feature which states that even if the present encryption key is compromised, it should not expose past communication.

A 2021 Bachelor's thesis by van der Have stated the following for X3DH:³

In this thesis, we have considered X3DH in the Signal protocol, and derived a proof of security. From the proof it follows that X3DH provides secrecy and authentication.

However, the research revealed some limitations. The author only proved DH's integrity against classical (finite computation and time) threats, which was already well-researched.

Additionally, they were unable to test out-of-order decryption scenarios, when messages are received but not yet decrypted due to network unavailability. This may prevent forward secrecy, however, is something handled in the application itself.

In a post-quantum world, one in which access to a Quantum computer is assumed to be ubiquitous, X3DH in its current form would be vulnerable. The challenge to make X3DH robust for this future was addressed in research by Hashimoto et al. (2021)⁵, who aimed to improve forward secrecy and deniability⁶, which a security feature which prevents Mallory from proving the plaintext messages between Alice and Bob even exist. They establish post-quantum integrity with X3DH.

While this research couldn't significantly improve forward secrecy, it achieved substantial security improvements in other areas, potentially making Signal massively more secure against future quantum threats.

Update: In 2024, Signal announced a post-quantum upgrade to its handshake protocol called PQXDH. By 2025, PQXDH has become the new default initial handshake. It still uses DH for authentication but adds a post-quantum Key Encapsulation Mechanism (KEM) alongside the existing DH exchanges. The exact details are outside the scope of this article.

Let it flourish with Double Ratchet

The Double Ratchet algorithm handles the part that perpetuates communication between our two actors, Alice and Bob, using the shared secret key obtained through X3DH.

Let us look at another analogy. Think of Double Ratchet as a constantly evolving lock system. Every message sent:

Gets its own unique chain key
Updates the entire key system for future messages
Deletes the old keys permanently
Maintains security even if some messages are lost

This brings us to our final diagram with the full process. Double Ratchet Algorithm

Fig. 3: Bigger picture

Research presented at EUROCRYPT 2019 by Alwen et al. praised Signal's achievement in balancing typically conflicting security requirements of ⁸ Forward Secrecy, Post-Compromise Security (PCS) (Security restoration after a breach has been contained), Immediate Decryption (Messages decrypt instantly upon delivery with no delay) and Message-Loss Resilience (MLR) (Communication remains functional and secure even if messages are lost in transit).

The researchers noted:

As a result, in addition to instantiating our framework in a way resulting in the existing, widely-used Diffie-Hellman based Signal protocol, we can easily get post-quantum security and not rely on random oracles in the analysis.

This research went further to create a generalized double ratchet protocol ensuring post-quantum integrity, similar to Hashimoto et al.'s work on X3DH.

Another paper presented at EIConRusNW by IEEE (2020) by Bobrysheva and Zapechnikov concluded:⁷

The Double Ratchet algorithm is an elegant and straightforward protocol for providing classical security in messaging systems, although we can't use it in post-quantum systems.

Beyond the Protocol hill (and into the meadows?)

While the Signal protocol excels at protecting communications in transit, other aspects reveal some privacy gaps that most users don't know about.

I will find you with Contact Discovery

Signal's contact discovery mechanism, while more privacy-preserving than alternatives, enables large-scale user enumeration attacks. A 2021 research paper by Hagen et al. demonstrated this vulnerability in stark terms:⁹

Our script for Signal uses 100 accounts over 25 days to check all 505 million mobile phone numbers in the US. Our results show that Signal currently has 2.5 million users registered in the US, of which 82.3% have set an encrypted user name, and 47.8% use an encrypted profile picture.

The researchers successfully identified every Signal user in the United States within a month using a relatively simple script. They just created multiple Signal accounts and systematically tested phone numbers to see if they're registered. With this they were able to build a comprehensive database of Signal users.

The authors reached out to Signal, who acknowledged the issue as inherent to contact discovery itself while implementing additional defenses and countermeasures.

Update: Signal has introduced optional usernames (2024) and enhanced phone-number privacy settings to mitigate this vulnerability. Users can now create a unique username to share instead of exposing their phone number, and they can choose to completely block discovery by phone number.

Whoops, my Phone got Stolen

A 2019 paper by Kaczyński highlighted a critical vulnerability when malicious actors gain physical access to devices:¹⁰

The research conducted and presented in this paper indicates the presence of many threats to the Signal users who currently do not have any mechanisms to protect the stored data, except those offered by the operating systems. This situation allows not only for reconstructing the history of conversations but also for impersonating one of the users participating in the communication using the application. Such an attack will not be detected by the other side, because common identifiers will not change.

This vulnerability gained public attention during Signal's confrontation with Cellebrite, a forensic extraction company used by law enforcement. This blog post by Riana Pfefferkorn of Stanford detailed the events.

Signal's creative response involved injecting potential exploits or noise into every local Signal database, based on assumptions from Marlinspike's reveal of the matter. Cellebrite subsequently pushed an update to protect themselves from such 'reverse-hacks'.

I reached out to the author of the 2019 paper and they stated that this vulnerability was still persistent.

Research by Son et al. (2022) provided proof-of-concept confirmation of these persistent vulnerabilities:¹¹

As a result, we could decrypt all encrypted database, multimedia, log, and preferences files of Signal, Wickr, and Threema.

The researchers published their decryption script here, demonstrating that the vulnerabilities affect multiple secure messaging platforms.

Transparency? Opacity?

Signal has faced growing criticism for reducing transparency in recent years, with delayed source code releases and private server code updates. This shift concerns security researchers who rely on public audits to verify security claims.

Key Issues:

Signal-Server code not public since April 22, 2020¹²
Delayed updates and reduced openness¹³
Difficulty conducting independent security verification

The justifications provided by Signal are left for the reader to evaluate.

Get down to brass tacks

The identified vulnerabilities, while serious, require either:

Massive computational resources (government-level capabilities)
Physical access to unlocked devices (law enforcement, theft scenarios)
Sophisticated technical attacks (beyond most users' everyday threats)

For most users' threat models, these scenarios fall outside typical security concerns.

For casual communication requiring strong privacy guarantees, Signal continues to set the industry standard despite its imperfections. The protocol's security ensures that intercepting messages in transit remains practically impossible, even for well-resourced adversaries.

For high-risk communications, like those for whistleblowers, users should be aware of physical access vulnerabilities, implementing additional operational security measures as needed.

Signal remains the best choice for secure messaging among mainstream options, balancing usability with robust cryptography that has withstood years of academic scrutiny and real-world testing.