How Safe Is Safety Number? A User Study on SIGNAL’s Fingerprint and Safety Number Methods for Public Key Verification

Kemal Bicakci; Enes Altuncu; Muhammet Sakir Sahkulubey; Hakan Ezgi Kiziloz; Yusuf Uzunay

doi:10.1007/978-3-319-99136-8_5

How Safe Is Safety Number? A User Study on SIGNAL’s Fingerprint and Safety Number Methods for Public Key Verification

Kemal Bicakci^*, Enes Altuncu, Muhammet Sakir Sahkulubey, Hakan Ezgi Kiziloz, Yusuf Uzunay

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

1 Citation (Scopus)

Abstract

Communication security has become an indispensable demand of smartphone users. End-to-end encryption is the key factor for providing communication security, which mainly relies on public key cryptography. The main and unresolved issue for public key cryptography is to correctly match a public key with its owner. Failing to do so could lead to man-in-the-middle attacks. Different public key verification methods have been proposed in the literature. The methods which are based on verification by the users themselves are preferable with respect to cost and deployability than the methods such as digital certificates that involve the use of trusted third parties. One of these methods, fingerprinting was recently replaced by a method called safety number in the open source messaging application, SIGNAL. The developers of SIGNAL claimed this change would bring usability and security advantages however no formal user study was conducted supporting this claim. In this study, we compare the usability and security aspects of these two methods with a user study on 42 participants. The results indicate with significance that the safety number method leads to more successful results in less time for public key verification as compared to the fingerprint method.

Original language	English
Title of host publication	Information Security - 21st International Conference, ISC 2018, Proceedings
Editors	Liqun Chen, Mark Manulis, Steve Schneider
Publisher	Springer Verlag
Pages	85-98
Number of pages	14
ISBN (Print)	9783319991351
DOIs	https://doi.org/10.1007/978-3-319-99136-8_5
Publication status	Published - 2018
Externally published	Yes
Event	21st Information Security Conference, ISC 2018 - Guildford, United Kingdom Duration: 9 Sept 2018 → 12 Sept 2018

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	11060 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	21st Information Security Conference, ISC 2018
Country/Territory	United Kingdom
City	Guildford
Period	9/09/18 → 12/09/18

Bibliographical note

Publisher Copyright:
© 2018, Springer Nature Switzerland AG.

Keywords

Fingerprint
Public key verification
Safety number
SIGNAL
Usability

Access to Document

10.1007/978-3-319-99136-8_5

Cite this

Bicakci, K., Altuncu, E., Sahkulubey, M. S., Kiziloz, H. E., & Uzunay, Y. (2018). How Safe Is Safety Number? A User Study on SIGNAL’s Fingerprint and Safety Number Methods for Public Key Verification. In L. Chen, M. Manulis, & S. Schneider (Eds.), Information Security - 21st International Conference, ISC 2018, Proceedings (pp. 85-98). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11060 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-319-99136-8_5

Bicakci, Kemal ; Altuncu, Enes ; Sahkulubey, Muhammet Sakir et al. / How Safe Is Safety Number? A User Study on SIGNAL’s Fingerprint and Safety Number Methods for Public Key Verification. Information Security - 21st International Conference, ISC 2018, Proceedings. editor / Liqun Chen ; Mark Manulis ; Steve Schneider. Springer Verlag, 2018. pp. 85-98 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{4b0faefbd8b84edcbb8f5fb903c5ba5d,

title = "How Safe Is Safety Number? A User Study on SIGNAL{\textquoteright}s Fingerprint and Safety Number Methods for Public Key Verification",

abstract = "Communication security has become an indispensable demand of smartphone users. End-to-end encryption is the key factor for providing communication security, which mainly relies on public key cryptography. The main and unresolved issue for public key cryptography is to correctly match a public key with its owner. Failing to do so could lead to man-in-the-middle attacks. Different public key verification methods have been proposed in the literature. The methods which are based on verification by the users themselves are preferable with respect to cost and deployability than the methods such as digital certificates that involve the use of trusted third parties. One of these methods, fingerprinting was recently replaced by a method called safety number in the open source messaging application, SIGNAL. The developers of SIGNAL claimed this change would bring usability and security advantages however no formal user study was conducted supporting this claim. In this study, we compare the usability and security aspects of these two methods with a user study on 42 participants. The results indicate with significance that the safety number method leads to more successful results in less time for public key verification as compared to the fingerprint method.",

keywords = "Fingerprint, Public key verification, Safety number, SIGNAL, Usability",

author = "Kemal Bicakci and Enes Altuncu and Sahkulubey, {Muhammet Sakir} and Kiziloz, {Hakan Ezgi} and Yusuf Uzunay",

note = "Publisher Copyright: {\textcopyright} 2018, Springer Nature Switzerland AG.; 21st Information Security Conference, ISC 2018 ; Conference date: 09-09-2018 Through 12-09-2018",

year = "2018",

doi = "10.1007/978-3-319-99136-8_5",

language = "English",

isbn = "9783319991351",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "85--98",

editor = "Liqun Chen and Mark Manulis and Steve Schneider",

booktitle = "Information Security - 21st International Conference, ISC 2018, Proceedings",

address = "Germany",

}

Bicakci, K, Altuncu, E, Sahkulubey, MS, Kiziloz, HE & Uzunay, Y 2018, How Safe Is Safety Number? A User Study on SIGNAL’s Fingerprint and Safety Number Methods for Public Key Verification. in L Chen, M Manulis & S Schneider (eds), Information Security - 21st International Conference, ISC 2018, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11060 LNCS, Springer Verlag, pp. 85-98, 21st Information Security Conference, ISC 2018, Guildford, United Kingdom, 9/09/18. https://doi.org/10.1007/978-3-319-99136-8_5

How Safe Is Safety Number? A User Study on SIGNAL’s Fingerprint and Safety Number Methods for Public Key Verification. / Bicakci, Kemal; Altuncu, Enes; Sahkulubey, Muhammet Sakir et al.
Information Security - 21st International Conference, ISC 2018, Proceedings. ed. / Liqun Chen; Mark Manulis; Steve Schneider. Springer Verlag, 2018. p. 85-98 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11060 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - How Safe Is Safety Number? A User Study on SIGNAL’s Fingerprint and Safety Number Methods for Public Key Verification

AU - Bicakci, Kemal

AU - Altuncu, Enes

AU - Sahkulubey, Muhammet Sakir

AU - Kiziloz, Hakan Ezgi

AU - Uzunay, Yusuf

PY - 2018

Y1 - 2018

N2 - Communication security has become an indispensable demand of smartphone users. End-to-end encryption is the key factor for providing communication security, which mainly relies on public key cryptography. The main and unresolved issue for public key cryptography is to correctly match a public key with its owner. Failing to do so could lead to man-in-the-middle attacks. Different public key verification methods have been proposed in the literature. The methods which are based on verification by the users themselves are preferable with respect to cost and deployability than the methods such as digital certificates that involve the use of trusted third parties. One of these methods, fingerprinting was recently replaced by a method called safety number in the open source messaging application, SIGNAL. The developers of SIGNAL claimed this change would bring usability and security advantages however no formal user study was conducted supporting this claim. In this study, we compare the usability and security aspects of these two methods with a user study on 42 participants. The results indicate with significance that the safety number method leads to more successful results in less time for public key verification as compared to the fingerprint method.

AB - Communication security has become an indispensable demand of smartphone users. End-to-end encryption is the key factor for providing communication security, which mainly relies on public key cryptography. The main and unresolved issue for public key cryptography is to correctly match a public key with its owner. Failing to do so could lead to man-in-the-middle attacks. Different public key verification methods have been proposed in the literature. The methods which are based on verification by the users themselves are preferable with respect to cost and deployability than the methods such as digital certificates that involve the use of trusted third parties. One of these methods, fingerprinting was recently replaced by a method called safety number in the open source messaging application, SIGNAL. The developers of SIGNAL claimed this change would bring usability and security advantages however no formal user study was conducted supporting this claim. In this study, we compare the usability and security aspects of these two methods with a user study on 42 participants. The results indicate with significance that the safety number method leads to more successful results in less time for public key verification as compared to the fingerprint method.

KW - Fingerprint

KW - Public key verification

KW - Safety number

KW - SIGNAL

KW - Usability

UR - http://www.scopus.com/inward/record.url?scp=85053994819&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-99136-8_5

DO - 10.1007/978-3-319-99136-8_5

M3 - Conference contribution

AN - SCOPUS:85053994819

SN - 9783319991351

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 85

EP - 98

BT - Information Security - 21st International Conference, ISC 2018, Proceedings

A2 - Chen, Liqun

A2 - Manulis, Mark

A2 - Schneider, Steve

PB - Springer Verlag

T2 - 21st Information Security Conference, ISC 2018

Y2 - 9 September 2018 through 12 September 2018

ER -

Bicakci K, Altuncu E, Sahkulubey MS, Kiziloz HE, Uzunay Y. How Safe Is Safety Number? A User Study on SIGNAL’s Fingerprint and Safety Number Methods for Public Key Verification. In Chen L, Manulis M, Schneider S, editors, Information Security - 21st International Conference, ISC 2018, Proceedings. Springer Verlag. 2018. p. 85-98. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-99136-8_5

How Safe Is Safety Number? A User Study on SIGNAL’s Fingerprint and Safety Number Methods for Public Key Verification

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this