Signal: Cellebrite claimed to have cracked chat app's encryption

"Signal keeps its database encrypted using SqlScipher, so reading it requires a key. We found that acquiring the key requires reading a value from the shared preferences file and decrypting it using a key called “AndroidSecretKey”, which is saved by an android feature called “Keystore”.

Once the decrypted key is obtained, we needed to know how to decrypt the database. "

TLDR: which is saved by an android feature called “Keystore”, Android Keystore compromised ?

Original post: https://web.archive.org/web/20201210150311/https://www.celle...

  In response to people questioning Cellebrite's claims, the creator of Signal - Moxie Marlinspike - dismissed the idea that the app had been compromised.

  "This was an article about 'advanced techniques' Cellebrite used to decode a Signal message on an unlocked Android device," he tweeted.

  "They could have also just opened the app to look at the messages.

  "The whole article read like amateur hour, which is I assume why they removed it."

Clickbait headline