Slashdot Mirror
PGP Creator's Zfone Encrypts VoIP
Philip Zimmermann, creator of PGP wrote in to tell me about
Zfone, his new system for encrypting any SIP VoIP voice stream. His first release is Mac & Linux only. I tested it with him using Gizmo as our client and it was pretty trivial to use. While it should work on most any SIP compatible VoIP client, he hopes that clients like OpenWengo and Gizmo will incorporate Zfone directly into the UI.
Zfone has no centralization, and has been submitted to the IETF.
He hasn't yet determined a license, but he believes strongly in releasing source code for all encryption products. A windows client is forthcoming.
>His first release is Mac & Linux only.
you misspelled Windows.
oh... that makes a refreshing change.
...is that the US (yes, I live there) will use security fears relating to terrorism to ban or severely restrict this technology. Some elements of our government seem almost Luddite (http://en.wikipedia.org/wiki/Luddite) these days.
Sad, because this kind of encryption would permit greater use of this technology in medicine under HIPPA privacy regulations.
Using plain ol' text since 1968
This is important stuff as more and more phone traffic is routing open in the internet. While most people do not believe their emails are totally private, when it comes to talking on the phone I believe there is a perception (and assumption) that no one else is listening. SIP, Asterisk and all the flavors of VOIP is changing telecom and encryption is necessary.
Quality Hosting e3 Servers
For some reason I got to thinking about Phill Zimmerman and DVD John [Johansen]. Both seem to pop up now and then and give us all reasons to smile.
Hmm... I wonder if Phil could come up with security that Jon couldn't find a way around?
It would also almost totally negate any ISP's attempt at shaping VOIP traffic to try and get people to buy their service instead. This has been somewhat of a question in recent months, but if you can encrypt your stream, then there's not much chance they can slow your packets. I'm all for the increased security as well. Now if we can only get them to cut down on the spam....
The MIT Website has taken it down, but I remember it working somewhat well between two IP address.
Was it just too far ahead of its time?
We know the network is hostile and retrofitting encryption onto something after the fact doesn't always work either because too many people using the unencrypted protocol, it's too hard to configure (as opposed to being mostly automatic like ssh connections), or just general security ignorance. What's really holding us back?
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
Wouldn't that kinda be the point?
0xB315AA8D852DCD3F3DCA578FD2E0BF88
great idea, this is very much needed. I don't know how secure this actually is, the writer (phillip zimmermann) said he builds the encryption into tcpstack of whatever operating system the user is running and the key exchange is done automatically between hosts.. he also makes the statement that this technology/standard (zfone) would be integrated into the end-user software, in the near future. I'm not sure why he's so confident, it's nice but who's to guarantee any sip softphone end-points or better yet, hard telephones, will actually have this built in.
hmm.. i wonder if I have linux nat router running this (and it being my default gateway, if it will automatically encrypt any sip sessions if the end system is running the zphone gui. I mean this apparently works at the network layer (like tcpdump, promiscuously), I wonder if it has to be running on the same system the sip session is originating from. oh dear, i really need to replace my dlink router these days.
Because encryption is very difficult to do correctly. And we should all know by now that a false sense of security is worse than no security at all.
There's also the not insignificant fact that encryption is complex to use and administer. Adding in robust encryption is not free from a user-friendliness perspective. Much thought has to be put into reducing the user-visible complexity as much as possible so that the user base will actually use the encryption, and use it in such a way that security is preserved. Not trivial.
As there is no cryptographic signature on the package, these are my sums
as received. Please compare and post if yours are different.
SHA1 (zfone-linux.tar.gz) = aa9ac66a5dce43cff2639787f30e939078b47ebe
MD5 (zfone-linux.tar.gz) = c6a47feca0fd5cb5bf72a8f6a1e8f207
PRZ, please sign your packages! Thanks, World.
Hopefully, this will be the straw that breaks the camel's back.
Ultimately, ALL traffic should be encrypted, whether it is VOIP, email, web browsing, whatever.
The guy is right when on his home page he talks about how it is so difficult to implement this sort of stuff as an add-on for emails, managing keys and the like. It's why no one does it. Of course, there has always been a computing overhead, also, which is why only pages that "need" to be secured currently are. But as horsepower goes up, those limitations should go away.
Ultimately, it should be a matter of course before all traffic that goes in our out of your computer is encrypted by default.
Hopefully this is the start of something huge!
Steve
A work that expires before its copyright never enters the public domain and thus enjoys eternal copyright protection.
I can remember Phil's PGPfone which was released before VoIP was "the next big thing." It used GSM speech compression and 3-DES/CAST/Blowfish cryptography "to give you the ability to have a 'real-time' secure telephone conversation" (directly over 14.4 Kbps (or faster) modem-to-modem, through the Internet, or through AppleTalk).
That died. It is good to see a new alternative that has adopted newer standards.
Another "oldy but goody" was Speak Freely.
There was a presentation from another group (wasn't Phil, although he was there) at DefCon 13 relating to reverse-engineering the GSM voice compression so that data could be fed through a GSM voice link accoustically with almost no overhead (in other words, at close to the GSM native digital bandwidth). The intent being to provide a means to attach accoustic peripherals (handsfree headset for example) that could perform encryption and send the encrypted, digitized voice over the GSM link accoustically (to be recieved and decoded by a similar device on the other end), thus allowing encrypted voice communication over an untrusted and unmodified cell phone without the need to install any software.
Igpay atinlay isway ethay estbay ayway otay encryptway ouryay onversationcay!
Could Phil microwave a burrito so hot even Jon couldn't eat it?
SIP is just a protocol that sets up connectivity and media control; the stream itself is not covered by the SIP protocol. For that, you need something that supports Secure RTP (SRTP), which encrypts the payloads of all RTP streams. If you've managed to encrypt SIP, all you're doing is encrypting call setup and feature requests. Your conversation is not encrypted.
Philip Zimmermann has apparently vanished from the face of the earth. Film at 11.
WWJD?
JWRTFM!
The mention of 911 gives me an idea for an interesting angle to ensure ISPs can't neuter VoIP.....claim that by doing so they're endangering lives in the event of a 911 call.
I used to get high on life, but I developed a tolerance. Now I need something stronger.
Let's be honest -- this guy needs to go to jail NOW. Privacy is almost as treasonous as sharing or questioning your leaders.
VoIP is different from most other traffic types in that it is hard realtime and needs real low latency. This means VoIP uses UDP
OpenSSL builds encrypted sessions over TCP. TCP is not designed to work well for the requirement space needed by VoIP.
If fact, it just would not work well at all.
OpenSSL is not just an SSL API. It's a full cryptographic API. The socket stuff is not even in the core crypto library. There is libssl and then there is libcrypto. Both are part of OpenSSL.
OpenSSL is a misnomer.
I didn't mean "use SSL", I meant use OpenSSL the cryptographic library that supports all that standard stream ciphers. You can use whatever networking stuff you want outside of OpenSSL.
The ratio of people to cake is too big
I don't live in the US but I live very close and almost all of my IP traffic travels through the US at some point and my worry is that any business information collected by the US/CIA/FBI or other US agency would be made available to US companies. There have been court cases in the past of US sponsored spying benefiting US companies. They say they are after terrorist but who knows? With the knowledge of past activities of US spies and the current computing power of the US agencies all foreign businesses would be well advised to encrypt all sensitive information.
r eyfuss.html
. pdf
t m
http://www.motherjones.com/news/feature/1994/05/d
http://web.nps.navy.mil/~relooney/4141_Spring2002
http://www.commondreams.org/headlines/070200-02.h
Not using encryption is to believe GWB when he says "Trust me"