Signal Taps Cloudflare to Help Protect the Privacy of Hundreds of Millions of Users Through Key Transparency

Cloudflare, Inc. , the leading connectivity cloud company, announced that it is serving as an independent Key Transparency auditor for Signal, the private messaging app trusted by hundreds of millions of people worldwide. With this partnership, Cloudflare is giving Signal users extra confidence that their conversations are private and secure, without requiring complicated manual verification steps.

Also Read: AiThority Interview with Gou Rao, co-founder and CEO at NeuBird AI

End-to-end encryption keeps messages private by encrypting them so only the sender and recipient can read them. That system is only secure if users receive the right encryption keys from the messaging system. Historically, confirming this required users to manually compare QR codes with one another off-platform – in-person, for example. An alternative solution is “key transparency,” a system where messaging apps publish a tamper-evident log that records when new keys are distributed to users, and where multiple parties perform verifications on that log. External auditors are an important part of this system, ensuring that the same log is shown to everyone. Signal uses key transparency in its new feature called “automatic key verification,” which enables users to verify their keys without leaving the app. Cloudflare now serves as one of the external auditors of this system.

“Signal has set the global standard for private communication, and we’re glad to independently verify that standard is being upheld,” said Dane Knecht, Chief Technology Officer of Cloudflare. “The web moved to encrypted connections by default with HTTPS. Messaging did the same with end-to-end encryption. Independent auditing is the logical next step: not just promising encryption, but making it provable.”

Cloudflare’s auditing system periodically pulls batches of updates from Signal’s Key Transparency log and cryptographically verifies that each update is consistent with everything recorded before it. Once that check passes, Cloudflare signs the update and Signal delivers the signed update to its users who can then verify it and be sure that Signal is showing them a globally consistent view of the log. Users build off of this assurance to then verify that the log contains the proper keys for themselves and their contacts. Cloudflare’s auditor operates only over cryptographic proofs; it does not see users’ phone numbers, usernames, public keys, or message contents.

With Signal now added, Cloudflare strengthens the security of two of the largest private messaging platforms in the world, having been announced as an auditor for WhatsApp in 2024 The aim is for independent auditing to become a standard expectation for encrypted communication — not a rare exception.

Also Read: ​​AI and The Future of Work: Artificial Intelligence Is Expanding Organizational Intelligence Beyond Human Limits

[To share your insights with us, please write to psen@itechseries.com]