[VOIPSEC] Using SRTP for University project

[Hadriel Kaplan]

> -----Original Message-----
> From: Randell Jesup [mailto:rjesup at wgate.com]
> Sent: Tuesday, March 28, 2006 1:07 AM
> To: Hadriel Kaplan
> Cc: 'Alan Johnston'; Voipsec at voipsa.org; Christian.Stredicke at snom.de;
> 'Philip Zimmermann'
> Subject: Re: [VOIPSEC] Using SRTP for University project
> 
> "Hadriel Kaplan" <HKaplan at acmepacket.com> writes:
> >> Also, ZRTP uses key continuity which forces an attacker to
> >> perform an active DH MitM attack on every call or be detected.
> >
> >That's not hard.  That could just be the local TLS proxy.

I meant (and should have said) it's not hard to be in the path, and
certainly not compared to breaking ciphers or signatures.  It's definitely
"hard" from the aspect of actually building such B2BZA (Z for ZRTP) box.
(Cool, I just coined a new term)

 
> Transparent proxies can be detected by using a tunnel to somewhere outside
> of the provider's network.  Paranoid users might connect via SBC, and do a
> verification connection/message over a tunnel link to check response
> headers.
 
I'm curious what you mean by "transparent" SBC?  And who this tunnel link
would connect to, and what it would check?  Enterprise SBCs work differently
than service-provider ones, in general. (if by "transparent" you mean inline
like a firewall)  The person can call someone they know through the local
"proxy" and see if it's a B2BZA by doing a verbal check.  But it means
nothing about the other people they're going to call - they could be the
ones with the local B2BZA.  Wouldn't such a paranoid user just do the verbal
check with the person they really want to call, every time?  

-hadriel
p.s. I'm not opposed to ZRTP - the original discussion was about s/mime.  I
actually like many of ZRTP's properties - not the least of which being the
IP addresses/ports of RTP at both ends aren't included inside the check (I
think).  It's about time someone realized IP addresses need not be a
component of end-to-end identity.  But it's too heavy for media gateways I
think, and I've been told most sip calls go to media gateways today.