Apple has introduced a new security feature, known as “iMessage contact key verification,” aimed at enhancing the security of its popular iMessage service. While iMessage already provides end-to-end encryption for user privacy, concerns about potential vulnerabilities in key directory services have prompted this development.
Furthermore, the key verification mechanism employs key transparency, which utilizes a log-backed map data structure to offer cryptographic proofs of inclusion, allowing users to ensure the consistency of their encryption keys and undergo audits for added security.
This innovation not only safeguards against potential compromises of key directory and transparency services but also allows for changes to the log-backed map while making device keys immediately verifiable. The iMessage contact key verification relies on an account-level elliptic curve digital signature algorithm (ECDSA) signing key generated on the user’s device, stored in the iCloud keychain, and accessible only on trusted devices. Users can manually verify contacts using the Vaudenay SAS protocol, with successful verification resulting in marked secure conversations with those contacts.
The new feature, available in developer previews of iOS 17.2, macOS 14.2, and watchOS 10.2, ensures that the key transparency map includes data presented by the identity directory service, and it alerts users in case of validation errors or inconsistencies.
By comparing key transparency data for identifiers, device records, and opt-in states against records stored in an end-to-end encrypted CloudKit container, user devices add an additional layer of security. This development not only bolsters user privacy but also strengthens the security of the iMessage service.
