Study on the usability and security of the fingerprint and safety number methods used in public key verification

Public key cryptography is a cryptographic method that uses two different keys for encryption and decryption, respectively, public key and a private key, which cannot be generated from this public key. In some systems, the various interfaces (e.g. SSH fingerprint) derived from public keys for the end user are being used as a security measure. Different methods of solution have been proposed to this problem called as "public key verification" in the literature. These methods are based on the principle that they are done by the user rather than costly solutions that involve the use of reliable third parties such as digital certificates. Some instant messaging applications that are used in daily life also provide the possibility to perform public key verification. Mobile application developers can present their public key verification to users with different interfaces. The safety number and fingerprint methods are two different public key verification methods that are commonly used in these applications. Since these public key verification methods are developed for end-user, usability and security are key success criteria. SIGNAL, an open source instant messaging application that provides end-to-end encryption, has allowed its users for public key verification with "fingerprint" in past versions and "safety number" in current version. In the public key verification method with fingerprinting, each user registered to the system has a fingerprint derived from the public key. In the case of public key verification with the safety number, verification is provided by a single safety number derived from the public keys of the user and his/her conversation partner. As predicted, this safety number produced is specific to the session; there is a different safety number for each person that the user is messaging with. In both versions, the QR code scan option is also available for easier comparison. In our work, we have performed a user study to test these two public key verification methods through the SIGNAL android application, in the laboratory environment. In the study with two similar user groups of 21 users, we tested how much security and usability that safety number method actually offer, by comparing with the fingerprint method. The results show that the "safety number" method is more advantageous than the "fingerprint" method with respect to verification time and simplicity.