Google DeepMind has formally verified the code behind Signal's encryption — a first for any widely deployed cryptographic protocol

Its new framework, AlphaProof Code, uses Gemini Carbon agents to mathematically prove key security properties of the actual compiled code of the Signal protocol (libsignal): the post-quantum PQXDH handshake and the Triple Ratchet. It validates forward secrecy, authentication, post-compromise security and handshake secrecy — the protections behind Signal, Google Messages and WhatsApp.

The agents generated over six million lines of Lean proof in about four weeks, work that historically takes expert teams years. Humans reviewed only around 1% of the codebase; Lean machine-checks the rest. No new vulnerabilities were found in the portions examined.

To prove the system can tell good code from bad, DeepMind reintroduced two real, previously fixed bugs — AlphaProof Code correctly proved the buggy versions insecure.

Scope note: it did not verify the whole Signal mobile app, and the proof assumes perfect cryptography — it does not guarantee computational secrecy of bytes. The verification artifacts are open-sourced and a technical paper is published.