Comments on: A Tour Through Zfone http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/ Collective thoughts and musings on the state of VoIP security today. Sun, 12 Oct 2008 07:56:53 +0000 http://wordpress.org/?v=2.6.2 By: Dan York http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-155220 Dan York Tue, 12 Feb 2008 22:09:03 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-155220 Phil, thanks for commenting. I just forwarded your comment to Eric at the email address I have for him. Hopefully he'll be in touch soon. Phil, thanks for commenting. I just forwarded your comment to Eric at the email address I have for him. Hopefully he’ll be in touch soon.

]]> By: Philip Zimmermann http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-155212 Philip Zimmermann Tue, 12 Feb 2008 21:53:40 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-155212 Eric, this was a great article. I don't have your email address or other contact information. How can I reach you? Eric, this was a great article. I don’t have your email address or other contact information. How can I reach you?

]]> By: Zoran http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-51948 Zoran Sun, 29 Apr 2007 20:37:26 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-51948 Its time to explain for people who are not computer experts. Thank you Phill, and thank you because wrote PGP. Its time to explain for people who are not computer experts.
Thank you Phill, and thank you because wrote PGP.

]]> By: Voice of VOIPSA » Blog Archive » Talk to the Hand http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-2596 Voice of VOIPSA » Blog Archive » Talk to the Hand Tue, 10 Oct 2006 15:18:16 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-2596 [...] We’ve written here before about Phil Zimmermann’s Zfone and the ZRTP protocol, but what exactly does an encrypted phone call sound like?  Well, here is a sample, captured with Wireshark and converted to MP3 for your audio pleasure with Goldwave. [...] [...] We’ve written here before about Phil Zimmermann’s Zfone and the ZRTP protocol, but what exactly does an encrypted phone call sound like?  Well, here is a sample, captured with Wireshark and converted to MP3 for your audio pleasure with Goldwave. [...]

]]> By: VOIP IP Telephony http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-1953 VOIP IP Telephony Tue, 19 Sep 2006 15:51:40 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-1953 <strong> Zfone: Secure VOIP Telephony Pretty Good VOIP</strong> If you want to read a full test and a great article, I can point you to one. Eric Y. Chen at Voice of VOIPSA has done a super job of testing and publishing the results. You get driven through installation, test setup, man in the middle analysis and the... Zfone: Secure VOIP Telephony Pretty Good VOIP

If you want to read a full test and a great article, I can point you to one. Eric Y. Chen at Voice of VOIPSA has done a super job of testing and publishing the results. You get driven through installation, test setup, man in the middle analysis and the…

]]> By: Eric Y. Chen http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-476 Eric Y. Chen Mon, 03 Jul 2006 09:51:12 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-476 ZID is randomly generated when you install Zfone, not when you download it. So even if you share your copy of installation file with your colleagues, they should all get different ZIDs. However, I did something unusual (really just for the fun of it) by installing Zfone to a VMware virtual machine (Windows XP) and creating a clone of that virtual machine. This way, I got two virtual machines with an identical ZID and got error messages in Figure 11 when I let one call the other. Although I think this scenario is unlikely to occur in the real world, Dustin (the first commentator) asked me if I can reset the ZID by reinstalling Zfone. I tried but it seems that once a ZID is generated, it is stored somewhere even after Zfone is uninstalled. When I reinstalled Zfone, the old ZID somehow resurrected (you can verify your ZID in "zfone.log" in the Zfone directory). I don't know how we can reset the ZID if we do end up with a duplicate ZID. ZID is randomly generated when you install Zfone, not when you download it. So even if you share your copy of installation file with your colleagues, they should all get different ZIDs.

However, I did something unusual (really just for the fun of it) by installing Zfone to a VMware virtual machine (Windows XP) and creating a clone of that virtual machine. This way, I got two virtual machines with an identical ZID and got error messages in Figure 11 when I let one call the other.

Although I think this scenario is unlikely to occur in the real world, Dustin (the first commentator) asked me if I can reset the ZID by reinstalling Zfone. I tried but it seems that once a ZID is generated, it is stored somewhere even after Zfone is uninstalled. When I reinstalled Zfone, the old ZID somehow resurrected (you can verify your ZID in “zfone.log” in the Zfone directory). I don’t know how we can reset the ZID if we do end up with a duplicate ZID.

]]> By: Mark Trifiro http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-440 Mark Trifiro Fri, 30 Jun 2006 15:08:15 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-440 Great tour of Zfone! Is the upshot of the ZID issue that each user must retrieve their original copy of Zfone from Zfone's download site (that is, I can't share my copy of the installation software with colleagues)? Or have I misunderstood the issue? I recall that retrieving the installation software originally required waiting on an email from Zfone (don't remember the details now). Thanks Great tour of Zfone!

Is the upshot of the ZID issue that each user must retrieve their original copy of Zfone from Zfone’s download site (that is, I can’t share my copy of the installation software with colleagues)? Or have I misunderstood the issue? I recall that retrieving the installation software originally required waiting on an email from Zfone (don’t remember the details now).

Thanks

]]> By: Eric Y. Chen http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-433 Eric Y. Chen Fri, 30 Jun 2006 06:13:28 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-433 I haven't really tried it yet, but I think if the SIP phone is able to overcome its NAT barrier prior to the Zfone installation, Zfone should work in most cases. However, if the SIP phone does unusual things such as sending RTP/TCP instead of RTP/UDP to solve the NAT traversal problem, Zfone would not work since it currently looks at only UDP packets, as stated in its official homepage http://www.philzimmermann.com/EN/zfone/bugs.html. I haven’t really tried it yet, but I think if the SIP phone is able to overcome its NAT barrier prior to the Zfone installation, Zfone should work in most cases. However, if the SIP phone does unusual things such as sending RTP/TCP instead of RTP/UDP to solve the NAT traversal problem, Zfone would not work since it currently looks at only UDP packets, as stated in its official homepage http://www.philzimmermann.com/EN/zfone/bugs.html.

]]> By: Wence Van der Meersch http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-272 Wence Van der Meersch Wed, 21 Jun 2006 08:40:58 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-272 I wonder what it will do when you install zfone on a windows machine running internet connection sharing (or any other kind of NAT gateway software for that matter) and use a SIP phone through it's NAT... Would it attempt (and succeed?) in encrypting the RTP packets? Since technically the RTP packets will originate from the outside interface using the interface's IP. I wonder what it will do when you install zfone on a windows machine running internet connection sharing (or any other kind of NAT gateway software for that matter) and use a SIP phone through it’s NAT… Would it attempt (and succeed?) in encrypting the RTP packets? Since technically the RTP packets will originate from the outside interface using the interface’s IP.

]]> By: Eric Y. Chen http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-254 Eric Y. Chen Tue, 20 Jun 2006 18:16:05 +0000 http://voipsa.org/blog/2006/06/19/a-tour-through-zfone/#comment-254 I did, after reading your comment. I uninstalled and reinstalled Zfone on the second VMware system, but I still got the same error messages. And if I call from an entirely different system A to the first system B and then to the second system (clone) C , I would get a warning message saying that the shared secret has not been cached. In other words, from A's point of view, B and C are identical. It seems that we cannot generate a new ZID by simply reinstalling Zfone. I did, after reading your comment. I uninstalled and reinstalled Zfone on the second VMware system, but I still got the same error messages. And if I call from an entirely different system A to the first system B and then to the second system (clone) C , I would get a warning message saying that the shared secret has not been cached. In other words, from A’s point of view, B and C are identical. It seems that we cannot generate a new ZID by simply reinstalling Zfone.

]]>