USENIX Security ’26 Research · Copenhagen, Luxembourg, Karlsruhe
The Message Inside the Message
Peer-reviewed research presented at USENIX Security ’26 reveals a hard limit to lawful access: even when an intelligence service possesses session keys and decrypts every overt Signal message flawlessly, communicating parties can conceal a second conversation inside the protocol’s mathematical transcript. The transmission remains computationally indistinguishable from standard traffic.
The Illusion of the Opened Safe
A core assumption underlying the international debate on mandatory encryption backdoors is that if authorities can compel a provider or device to surrender decryption keys, communications visibility is completely solved.
A team of researchers from the IT University of Copenhagen, the University of Luxembourg, and Karlsruhe Institute of Technology has provided a practical mathematical counterexample. Integrating anamorphic encryption into Signal’s Double Ratchet library and an Android client, the researchers created a counterintuitive reality: Alice sends an overt message (“Dinner at 7 at the bistro?”), a lawful surveillance system decrypts it with the mandated key and inspects an innocuous message, while Bob simultaneously extracts a covert payload from the exact same cryptographic exchange. To an external observer possessing the legitimate decryption keys, the transcript looks completely normal.
The Interceptor’s Wiretap
Enter an overt and a covert message, or select a preset. The interactive engine executes the Curve25519 point generation and displays the live network transcript alongside both decryption endpoints.
The first 32 bits (highlighted in violet) encode the covert message recoverable only via Bob’s shared pseudorandom function seed. To an external interceptor without the double key, every single bit exhibits an exact statistical probability of 0.5, rendering the key indistinguishable from uniform cryptographic randomness.
Hiding Inside Obligatory Protocol Values
Unlike conventional steganography, which embeds information into image or audio carriers and leaves detectable artifacts or opportunities for sanitization, anamorphic encryption exploits values the secure-messaging protocol is mathematically required to generate on every turn.
Signal's Double Ratchet maintains two continuous key renewal mechanisms: the Diffie–Hellman ratchet, which creates a fresh 256-bit Curve25519 public key on each turn of conversation, and the symmetric ratchet, which generates per-message encryption keys and MAC tags. To transmit a 32-bit covert payload, Alice’s client repeatedly samples ephemeral private keys until the resulting public point matches the target covert bits under a shared pseudorandom function. Because Curve25519 points appear as uniform high-entropy noise, an observer holding only the official Signal session keys cannot distinguish an anamorphic key from standard output.
Using optimized subgroup constructions, generating an anamorphic ratchet step takes under 1.8 milliseconds on standard mobile hardware.
Three Surveillance Regimes Compared
The evolution of lawful interception policies and cryptographic countermeasures can be categorized into three distinct operating regimes:
| Surveillance Regime | What Interceptor Obtains | What Interceptor Sees | What Communicators Experience |
|---|---|---|---|
| 1. Standard End-to-End Encryption | No keys (access blocked) | Opaque ciphertext | Full confidentiality for all users |
| 2. Mandated Access (Key Escrow / Backdoor) | Session keys compelled by law | Plaintext messages in clear | Confidentiality destroyed for ordinary citizens |
| 3. Mandated Access + Anamorphic Clients | Session keys compelled by law | Plaintext overt messages (innocuous decoy) | Sophisticated targets maintain an undetectable covert channel |
The Perverse Policy Equilibrium
The second-order policy implications of this construction challenge prevailing arguments on both sides of the encryption debate.
A policy regime mandating key surrender or client state extraction successfully weakens the everyday privacy of law-abiding citizens who rely on stock software. However, it fails against capable adversaries willing to run modified binaries. The result is plausible cryptographic compliance: the surveillance authority legally unlocks the safe, finds harmless messages prepared specifically for inspection, and closes the case satisfied, while genuine clandestine communication continues entirely undetected within the expected protocol randomness.
Methodology & Scientific References
Primary Publication
This explainer is based on research presented at the USENIX Security ’26 conference (August 12–14, 2026), titled Crypto Wars in Secure Messaging: Covert Channels in Signal Despite Leaked Keys, authored by researchers from the IT University of Copenhagen, the University of Luxembourg, and Karlsruhe Institute of Technology (Giustolisi, Phan, and collaborators).
Measurements & Benchmarks
The experimental implementation achieved 32 bits of covert payload per Diffie–Hellman ratchet step and up to 64 bits per symmetric MAC tag, incurring under 1.8 milliseconds of latency on Android hardware and requiring zero changes to official Signal server infrastructure.
Assumptions & Threat Model
The construction assumes communicating endpoints run modified software and possess a pre-shared auxiliary secret (double key) that is not yielded alongside ordinary Signal state. It does not protect against complete physical device seizure with active screen logging, nor does it conceal network transport metadata such as timing and communication graphs.