Slashdot Mirror
Skype Encryption (Partly) Revealed
TSHTF writes "Just weeks after Skype unveiled a public API for the service, a group of cryptographers led by Sean O'Neill have successfully reverse engineered the encryption used by the Skype protocol. Source code is available under a non-commercial license which details Skype's implementation of the RC4 cipher." The linked article cautions, however, that "initial analysis suggests that O'Neill's publication does not mean that Skype's encryption can be considered 'cracked'. Further study will be needed to determine whether key expansion and initialisation vector generation are secure."
We're on the way to getting 3rd party Skype applications. Neat.
It is proprietary, centralized, bloatwared, closed, and bandwidth intensive. Simply fixing one of this is not an improvement on the situation.
Unless you happen to be one of the unfortunate souls whose boss requires all communication to be on skype, then maybe a non-crashy linux client will be your savior.
Queue the cease and desist in 3...2...1...
This just goes to show the US Govt. already likely has these streams pwnd.
Isn't reverse engineering such as this a clear violation of the DMCA?
Hopefully this means we will see some more 3rd party clients, and maybe some Jabber integration.
Interesting that they use multiple encryption algorithyms for their communication. simple yet apparently effective.
On the Wikipedia page http://en.wikipedia.org/wiki/Skype_protocol I see presentations from 2004 and 2006 about reversing Skype, including its encryption. What's new here compared to the previous work?
None of this harms Skype's existing security in any way. Encryption, if properly implemented, is secure even when all of the mechanisms are known. This is why you can have software like GPG and the zillion open source AES implementations and still use them to reliably protect data from interception.
What would weaken Skype's security was if someone found a shortcut (by way of a bug or design flaw) to decrypting the data without knowledge of the keys being used. According to TFA, this is what the O'Neill is working on now.
That said, the source material that O'Neill provided mentions only symmetric ciphers, which means that the keys might be buried in the Skype binaries somewhere. If that's the case, then finding those would break Skype's encryption wide open. But I rather doubt that will happen. We're only seeing part of the story here and I'd bet dollars to donuts that they're using one or more asymmetric ciphers somewhere to transmit keys for the symmetric ciphers.
Cryptome hosts this 2007 document:
http://cryptome.org/isp-spy/skype-spy.pdf
* Skype can provide records showing account creation, financial transaction and use of PSTN interconnections
* Due to the way by which Skype works, Skype does NOT have any records of user “logins”, “log offs” or other general online/offline status
* The Skype system is designed in such a way that voicemail is not centrally stored
* Calls, IMs and other activities between Skype users do not create billing records
Everything there implies that if you want your communications to be private with respect to what can be provided in response to a subpeona then Skype isn't a bad platform. As to what can be intercepted obviously that is not covered because it's not relevant to that document.
The actual RC4 cipher has bad key scheduling issues. Because the initialization step doesn't mix the key bytes well enough into the S-box, the first bytes of the keystream (which is XOR'd with the plaintext to produce the ciphertext) leak lots of data about the key. This is a major problem with WEP (there are, of course, others). Cryptographers recommend discarding the beginning of the keystream because of this weakness. Nevertheless, RC4 is popular because it is byte-oriented and fast. Even 8-bit machines can implement it trivially.
Ultimately, it comes down to the key scheduling. If Skype has a better key-scheduling algorithm, it may actually improve security over standard RC4.
...for *video* calls. I use Linux, my daughter uses Apple and my son uses Windows. Skype allows high quality video chat, telephone interconnect/transfer and IP voice calls on all three platforms.
They may be proprietary and bandwith hogs, but the Skype folks certainly offer a free product with great user appeal. Maybe that's why it's so popular?
A C&D for a clean-room reversed engineering of a publicly-available algorithm? Methinks not.
Methinks so. Universal v. Reimerdes.
That used to be the case for me, but more recently on several different machines I've found that I either could not send or receive videos (despite having working cameras on both ends, and the cams working with other apps).
Everyone is so concerned with the strength of this algorithm... What does it matter if there is no secret key to break? The whole thing relies only on the secrecy of this algorithm! Just check the Wikipedia article and the Vanilla Skype docs.
I hope Skype doesn't bury these guys under 6 feet of dirt and a deadly law suit and they publish everything else - compression, key management, digital signatures, user authentication, P2P AES-256 encryption... We want more! We want more! We want more!
Does this mean we can finally have Skype protocol built into Pidgin? I would love to stop using Skype's crapware.
All data is speech. All speech is Free.
cheap gucci sale http://www.gucciusaoutlet.net/index.php?main_page=index&cPath=75&zenid=aa7cf3c1c03ba16b9ac00c8cd2a23ef2
Then that would have to be one crappy encryption algorithm.
They should have used the chaocipher. That should be way past its copyright period. Ta!
The VoIP world is going the way of open standards with SIP - if Skype don't adapt to embrace SIP, they'll just edge themselves out of the marketplace.
The biggest VoIP business provider Avaya has been moving to SIP for years and, interestingly though maybe not relevant, are owned mostly by the Silver Lake investors, who also own most of Skype.
Gentoo Linux - another day, another USE flag.
Why would anyone use Skype for security critical conversations?
Facetime is an open standard from Apple.
People really loves the iPhone 4 implementation.
So what you're saying about this is that the ONLY reason why you like Skype is because they've made a slick installer for all three platforms.
Please tell me how this makes a propriatory solution the ONLY solution?
Skype could open up their protocol so other people could use Skype freely.
Anyone can write a nice installer setting up SIP accepted standard. The problem being that nobody has. All someone has to show you is how to set up one SIP client and that client should be able to talk to any other SIP client, then there's no problem.
the problem is that people like you assume that SIP != Skype and that Skype is the ONLY SOLUTION. It isn't. If Skype were using a SIP configuration others could use, there would be no issue. If people like you didn't DEMAND Skype compatability, others would be able to fill its place.
Examine the rumors: H, and The Register.
Examine the facts: Digitask was contracted to provide the technology.
Facetime is a proprietary standard that Apple has claimed it will open at some point in the future.
I am TheRaven on Soylent News
If you are behind NAT, Skype routes your call through someone who isn't. In other words, you will be using somebody else's bandwidth for your call. And that someone probably doesn't know you are doing it. Up until this point, there has been no free software author willing to do what Skype has done. Basically, because it is unethical in many people's minds. And free software authors tend to work based on ethics.
Er, which part of that is unethical? Using other people's bandwidth is how peer-to-peer systems work, and there's no shortage of free software P2P: BitTorrent, Freenet, etc.
Visual IRC: Fast. Powerful. Free.
What is even neater than a 3rd party Skype software would be some one assembling :
- a 3rd party Skype implementation
- using already available RTP, SIP, ZRTP to make a SIP implementation, throwing STUN *and* TURN into the mix (like libNICE) together with a list of known servers for 100% automatic NAT traversal
- maybe throw another couple of open implementations (like Google LibJingle for XMPP).
- and find a way to put a nice "find friend" function in there (so people won't have trouble finding who among their friend use open protocols too). (Bonus if it leverage some viral social network API. Like piggy backing on Facebook).
- then package everything in a easy-to-use, non bloated (does only voice and messages), non crashy application.
This could be the first step toward helping the users move to open standard :
- as a non bloated, non crashy application, that would be compelling curring Skype users to start using this instead of official client, while keeping every contact in their list.
- as long as several friend moves to this new software, they could also start using other alternatives (just like OTR made possible to use encryption between OTR compatible clients without needed to lose friends).
- in a few years, once a pricacy crisis breaks out once people realise the backdoors in skype, people will simply use the other services or the encryption layer provided by their preferred software.
Best part of it ? Skype won't even mind - they make their only profit by selling SkypeIn / -Out service.
As long as people buy minutes, it doesn't really matter what software the users are using to connect.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]