[VOIPSEC] Using SRTP for University project

[Hadriel Kaplan]

Hey Randell,
Fortunately your email below was filtered by my email client as spam.  I say
fortunately, because it shows to anyone that even over a TLS-secured
connection (which I have), a man-in-the-middle was able to see and perform
intercepting action for your email.  It just so happens that the middle-man
is my email program.  For a TLS-secured connection of the whole chain from
end2end, or even a S/MIME secured one or ZRTP, there will always be the
ability for 2 middle-men (the caller and called apps) to do nefarious
things.  Of course you and I and most technical people already know that -
this is nothing new in the security world.  And it's certainly the case that
adding the probability of compromised additional chain-links of trust makes
it worse, since it is simply the sum of all of them.  I'm just noting it, as
it seemed ironic to me in this discussion of "end-to-end" security...

Anyway, comments inline...

> -----Original Message-----
> From: Voipsec-bounces at voipsa.org [mailto:Voipsec-bounces at voipsa.org] On
> Behalf Of Randell Jesup
>
> That matches my understanding - they have to provide the keys if they have
> them, but are not required to block calls that they can't decrypt.
> Decryption becomes the problem of the FBI/NSA/etc.  They also have to
> provide the tap in a non-detectable way I understand, which is a big
> problem technically unless everything (media) is routed through a proxy.
> Originally the FCC orders only applied to PSTN<->VOIP calls, but I think
> the more recent ruling covered all calls by providers that have PSTN
> gateways, even if the call doesn't transit a gateway (i.e. IP<->IP calls).

Yes that's what I've heard as well.  There is a debate going on right now
about whether "non-detectable" includes media addressing or not.  For some
providers we'd rather not relay media if we don't have to, but as it stands
right now we've been told we have to.
 
> As more and more calls are IP<->IP, the costs associated with making
> tapping unnoticable will increase because to keep it unnoticable you have
> to make ALL calls at all times transit a media proxy.  This adds cost in
> hardware, bandwidth, complexity, downtime, etc.

Absolutely, for infrastructure-less providers that's a big deal.  For the
ones with IP infrastructure it's not clear media relaying by some element or
other will ever stop, though in some cases it would.  They started doing it
before they were required to tap, and before home NAT issues.

> >that today, as far as I know.  Or if media is your only concern, then
> just
> >try zrtp or some other end2end media-level encrypt+auth every time and if
> it
> >succeeds you succeed.
> 
> And that's where ZRTP's ability to work within an AVT/RTP stream is good -
> if it could do so without needing things like header-extensions.  A
> provider could block header extensions, or ones that look like ZRTP.  A
> [sniped more]

A provider can block most anything if they had to, if the signaling goes
through their equipment.  For example they could transcode each call to make
sure it's really 711 (emulating a pstn hop).  It would be insanely expensive
to do so, of course.  The only real way would be to secure at a layer above
the codec or replace it I think (which is what I think you were talking
about?), so it looks like 711 bytes, but white noise.  

But I'm not sure they'd need to be that tricky - if all/most providers
around the world wouldn't have to care about decrypting encrypted media,
they'd be fine to let it through.  It would have to take the same bandwidth,
though.  

There's still going to have to be SRTP though.  The PSTN is far too
pervasive to be easily dismissed, and it will take eons for the entire
planet to go to voip.  There is also the issue of transcoding even in ip-ip
which people often overlook.  In the meantime, providers want to let people
call the pstn and vice versa, and secure it on the IP side, and the
simplicity/lower-cost of SRTP in media gateway hardware will not overcome
any benefits of zrtp in my opinion, for calls to/from the pstn.

-hadriel