From Specs to Apps: Verifying and Monitoring Models of Signal and WhatsApp
This paper bridges the gap between formal protocol specifications and real-world implementations by using the SpecMon runtime monitor to verify that observed executions of WhatsApp Web and Signal Desktop conform to newly developed Tamarin-compatible models, thereby confirming security properties and uncovering undocumented differences between the applications.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the digital age, billions of people rely on messaging apps to share their most private thoughts, secure their financial data, and coordinate their daily lives. Behind the scenes of these applications lies a complex set of rules known as a protocol, which acts as the blueprint for how messages are locked, sent, and unlocked. The most famous of these blueprints is the Signal protocol, a system designed to ensure that even if a hacker intercepts a message, they cannot read it. For years, security experts have used powerful computer tools to prove that this blueprint is mathematically sound. They have shown that if the rules are followed perfectly, the system is unbreakable. However, a blueprint is not the same as a building. Just because a design looks perfect on paper does not mean the construction crew followed every instruction, used the right materials, or avoided accidental mistakes while building the walls. In the world of software, the gap between the theoretical design and the actual code running on a user's phone is where vulnerabilities often hide.
A team of researchers at the CISPA Helmholtz Center for Information Security set out to bridge this gap. They wanted to know if the real-world versions of the Signal protocol, as they run inside the WhatsApp and Signal apps, actually follow the strict rules they were designed to obey. Instead of trying to read the entire codebase of these massive applications—a task made difficult because parts of them are hidden or closed off—the researchers built a specialized watchdog. This watchdog, called SpecMon, watches the application as it runs, listening to every conversation it has with the network and every calculation it performs with its security keys. It compares these live actions against the perfect theoretical model in real-time. If the application tries to take a shortcut, skip a step, or use a different method than the blueprint allows, the watchdog raises an alarm.
The researchers applied this method to two major applications: Signal Desktop, which is open for anyone to inspect, and WhatsApp Web, which is a closed, proprietary system owned by a massive corporation. For the Signal Desktop application, they started with an existing, highly detailed mathematical model of the protocol and added the specific, messy details found in the actual software, such as how it handles new types of encryption designed to resist future quantum computers. For WhatsApp, they had to work backward. Starting with no prior model, they watched the application's behavior, recorded its actions, and built a new, custom blueprint from scratch that matched exactly what the software was doing. This was a significant achievement, as it marked the first time a formal model had been derived directly from the implementation of WhatsApp's version of the protocol.
Once these models were ready, the researchers put them to the test. They ran thousands of simulated conversations, including scenarios where messages were delayed, sent out of order, or where the network connection was interrupted. In every case, the applications behaved exactly as the models predicted, confirming that the core security mechanisms were functioning correctly. The researchers also deliberately injected errors into the software to see if their watchdog would catch them. They made the apps reuse old encryption keys, skip signature checks, or leak secret data in unexpected ways. The system detected every single one of these security faults, proving that the monitoring tool is sensitive enough to spot dangerous deviations from the rules.
However, the monitoring also revealed subtle differences between the two applications that were not immediately obvious. The researchers found that WhatsApp handles "read receipts"—the notifications that tell a sender a message has been viewed—differently than Signal does. In Signal, these receipts are wrapped in the same strong encryption as the messages themselves and participate in the continuous updating of security keys. In WhatsApp, these receipts are sent outside of that encrypted layer, meaning they do not trigger the same security updates. While the researchers did not find a way to break WhatsApp's security based on this difference, they noted that it means the application might take longer to recover its security if a secret key were ever stolen. They also confirmed that WhatsApp does not yet include certain advanced privacy features, such as hiding the sender's identity from the server, which are present in the Signal app.
The study demonstrates that it is possible to watch complex, real-world software in action and verify that it adheres to its security promises without needing to see every line of its source code. The process was efficient, taking only a few weeks to set up and run, and it added very little delay to the speed of the applications. By creating a system where the theoretical model and the live monitoring share the same language, the researchers have provided a way for developers and security experts to continuously check that their applications remain secure as they evolve. This approach offers a new path for building trust in the digital tools we use every day, ensuring that the buildings we live in are as secure as the blueprints they were built from.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.