[VOIPSEC] What % of voip apps or devices actually use SRTP or ZRTP to encrypt audio calls

Fabio Pietrosanti (naif) lists at infosecurity.ch
Thu Dec 2 16:46:40 GMT 2010


the telecommunication security environment it's not that easy as it's
plenty of proprietary solutions developed by government's lobbistic
company to put inside hidden codes (backdoors).

In the IETF world there are a *wide* set of standards and it's not just
a matter of saying SRTP or saying ZRTP.

You must look at the security model and differentiate:
- end-to-end encryption (pgp like security model)
- end-to-site encryption (vpn-like security model)

I wrote an analysis of most of the voice encryption protocols existing
out there, including proprietary ones that you can read here:

The two most commonly diffused and known IETF standards systems to
satisfy those security models are:
- ZRTP with DH3072 or ECDH-384 key exchange and cache verification
- SRTP with SDES key exchange over a SIP/TLS secure channel (end-to-site)

For what's regards to SRTP with SDES key exchange over a SIP/TLS secure
channel there are a lot of clients supporting but keep in mind that only
some of them are really secure.
For secure i mean that they have support for strict SSL/TLS server
certificate verification and that's not possible to carry a man in the
middle attacks to SSL/TLS underlying SIP protection layer.

I made an analysis about SRTP secured device when setting up the "EVSS"
(Enterprise VoIP Security Suite) for the company where i am CTO are:
- PrivateGSM Enterprise for iPhone, Nokia, Blackberry  - www.privatewave.com
- SNOM Desktop phone with Firmware 8.x - www.snom.com

Others that i tested does not support strict SSL/TLS certificate
checkings so they can be subject to man in the middle attacks by faking
SSL certificates. Even worst speak incompatible half-proprietary
SRTP/MIKEY key exchange systems (like Siemens VoIP phones) or full
proprietary key encryption system (like several Avaya ones).

With recently released Asterisk 1.8 the SIP/TLS+SRTP is supported and we
made an howto on using Asterisk 1.8 + SIP/TLS+SRTP for
Mobile-to-Landline secure telephony infrastructure using Mobile
PrivateGSM Enterprise clients and Landline SNOM Desktop phones that you
can read here:

For what's regards to ZRTP there are a lot less clients supporting it,
mostly because there are no compatibility with hardware Desktop Phones
and because it's required for very high sensitive environment.

I wrote a brief about ZRTP protocol here
http://www.privatewave.com/security/security-protocols/zrtp.html .

For mobile side we managed the development of mobile ZRTP clients with
ECDH-384 key exchange and AMR 4.75 audio codec to works too over
narrow-band links (GPRS, satellite, etc).

They can be downloaded for testing on mobile devices from
http://m.privategsm.com  .

There are softphone for personal computer with ZRTP such as:
- zFone for Linux, Windows, Mac OS X -
- Twinkle for Linux - http://www.xs4all.nl/~mfnboer/twinkle/
- SIP communicator for Linux, Windows, Mac OS X -

There is not Desktop phone with ZRTP.

At PrivateWave we managed in partnership with Philip Zimmermann also to
make ZRTP working for real peer-to-peer GSM CSD secure communications
creating a custom transport protocol called ZRTP/S:

It's basically a "ZRTP over a serial connection" protocol that works
with GSM CSD but could also works with ISDN and we are working to fully
release the ZRTP/S specification to open secure telephony also to
non-voip world.

However the amount of application that are encryption enabled and that
are secure and interoperable it's very reduced as a lot of vendors just
decided to go with their own encryption system making what's called in
the crypto world Snake Oil Encryption

I hope to have provided some useful information about the subject, i
really like to see encryption standards get diffused and widely adopted
to change the world in a more free one without nasty proprietary
encryption stuff plenty of backdoors (who work in intelligence
environment know well the issue).

Kind Regards,
Fabio Pietrosanti
Job @ http://www.privatewave.com
Blog @ http://infosecurity.ch

On 02/12/10 14.59, SM wrote:
> Hi,
>   I was wondering about what percentage of voip apps or devices actually use
> SRTP or ZRTP to encrypt audio calls in 2010. Are there any confirmed
> statistics for this? Has any study been done on this? Can I and where can I
> get such data?
>   Thanks for your early reply and have a wonderful day ahead.
> Regards,
>  SM.
> _______________________________________________
> Voipsec mailing list
> Voipsec at voipsa.org
> http://voipsa.org/mailman/listinfo/voipsec_voipsa.org

More information about the Voipsec mailing list