Re:AlphaProof Code
by jchook on Tuesday November 10, 2026 @08:56AM
(#50440421)
It sounds like the Google team took a priori that Signal had a secure "cryptography core" and then published a result that validated that bias.
The proof shows that certain pre-determined properties hold, not that vulnerabilities do not exist. The approach cannot rule out attacks that the researchers did not anticipate.
For instance, the server software was merely simulated. Also it doesn't appear they evaluated the key generation portion of the system. Poorly generated keys or IVs can compromise a seemingly secure E2E system.
The proof shows that certain pre-determined properties hold, not that vulnerabilities do not exist. The approach cannot rule out attacks that the researchers did not anticipate.
For instance, the server software was merely simulated. Also it doesn't appear they evaluated the key generation portion of the system. Poorly generated keys or IVs can compromise a seemingly secure E2E system.