Google DeepMind's AlphaProof Code achieves a breakthrough by formally verifying Signal's cryptographic protocol at the machine-code level.

Google DeepMind has achieved a significant milestone in software security by using its novel AlphaProof Code framework to formally verify the cryptographic protocol underlying Signal, a widely used messaging platform. This marks the first time AI has been employed to verify a widely deployed cryptographic protocol at such depth, addressing a long-standing challenge in cybersecurity.

AlphaProof Code is a multi-agent framework that integrates human expertise with AI agents to perform formal verification, the process of mathematically proving that software operates without flaws. The framework was applied to Signal’s cryptographic protocol, generating over six million lines of machine-checked proof in the Lean programming language. This effort validated key security properties, including forward secrecy, authentication, and post-compromise security, down to the machine-code level.

The process began with researchers and AI agents translating Signal’s security goals into formal mathematical specifications. Human experts reviewed these specifications, after which AI agents powered by Gemini Carbon autonomously generated proofs. Lean’s automated checking ensured the accuracy of these proofs, with human experts auditing only one percent of the codebase, significantly reducing manual effort.

Unlike traditional verification methods that focus on protocol design, AlphaProof Code bridges the gap between design and implementation. This is critical because vulnerabilities often arise in the implementation phase. The framework demonstrated its robustness by successfully identifying insecurities in isolated versions of Signal’s code containing reintroduced, previously fixed bugs.

The verification process, which historically could take years, was completed in just four weeks.

Source link