Signal’s famous encryption may have been cracked

A security firm has gone public with claims that it cracked the encryption used by messaging app Signal, which is famed for the level of privacy afforded to its users.

According to a blog post published by Israeli company Cellebrite, “decrypting messages and attachments sent with Signal has been all but impossible...until now”.

The firm goes on to set out the method by which it was allegedly able to decrypt messages sent using the Signal app for Android. No mention was made of the iOS version.

• Here's our list of the best encrypted messaging apps around
• We've built a list of the best privacy apps available
• Check out our list of the best anonymous browsers out there

Was Signal really cracked?

The blog post offers up a long-winded and technical explanation but, in short, Cellebrite says it was able to get hold of the decryption key by “reading a value from the shared preferences file”.

The firm then used information found in Signal’s open source code to establish how the key could be used to decrypt a database containing messages and attachments.

Since first publication, however, the blog post has been altered significantly, with the description of the method removed entirely. Signal was also quick to dismiss the claims, which the company has suggested are reductive to the point of being misleading.

“This was an article about ‘advanced techniques’ Cellebrite uses to decode a Signal message db...on an *unlocked* Android device! They could have also just opened the app to look at the messages,” said Moxie Marlinspike, Signal creator.

“The whole article read like amateur hour, which is I assume why they removed it,” he added.

The suggestion is that cracking Signal encryption on a locked Android device is another question entirely and conducting the test using an unlocked phone defeats the object, because messages would be accessible anyway.

If Cellebrite’s claims hold water, though, it is possible the firm removed the meat of the post for another reason entirely, according to an expert in computer science. 

“I suspect someone in authority told them to [alter the post], or they realised they may have provided enough detail to allow others - who don’t just supply to law enforcement agencies - to achieve the same result,” said Alan Woodward, University of Surrey.

• Here's our rundown of the best VPN services on the market

Via BBC