Trail of Bits作为独立审计方，帮助Signal维护自动密钥验证系统以确保聊天的端到端加密完整性。1该系统通过创建公钥的全局一致视图来防止服务器进行中间人攻击，确保恶意服务器无法向客户端提供虚假密钥。1Trail of Bits维护独立实现的Merkle树审计器，定期签署树头以保证客户端看到一致的公钥集合。1
该验证机制依赖三个外部审计方——Signal、Cloudflare和Trail of Bits的配合。1客户端要求在过去七天内获得所有三个注册审计方的有效签名。1若服务器无法提供有效的审计方签名，客户端将显示警告并导致自动密钥验证失败。1这一设计限制了恶意服务器最多只能维持分割视图一周，之后客户端应用将开始显示警告。1
Trail of Bits从零开始实现了这套审计器，基于规范进行开发，相关代码已开源。1该公司表示不被Signal或任何其他方支付费用，在用户和社区利益的基础上运营该服务。1
Trail of Bits operates as one of three external auditors helping to verify the integrity of Signal's encrypted communications through an automatic key verification system 1. This system creates a globally consistent view of public keys to prevent servers from conducting man-in-the-middle attacks by distributing fraudulent cryptographic credentials 1.
The verification mechanism requires client applications to obtain valid signatures from all three registered auditors—Signal, Cloudflare, and Trail of Bits—dated within the past seven days 1. Should a server fail to provide valid signatures from these auditors, the client application displays a warning and the automatic key verification process fails 1. This design constrains malicious servers to maintain a fragmented view of the key database for at most one week before client applications begin showing warnings 1.
Trail of Bits developed its auditor implementation independently from scratch, based on the system specification, with the code released openly 1. The organization stated it receives no payment from Signal or any other party for operating this service, and maintains it in the interests of users and the broader community 1. The auditor maintains an independently implemented Merkle tree audit log, periodically signing tree roots to ensure that clients observe a consistent set of public keys 1.
评论
还没有评论，欢迎留下第一条。