Welcome to VoIP technology
Skype , Cell Phone , Zfone
Technology Review: How does Zfone work?
<<<... Phil Zimmermann: Zfone is the software that implements my new encryption protocol, called ZRTP, in a certain way. Zfone is not a VoIP client; it watches for the packets of Internet data going in and out of the machine and looks for ones that are VoIP related. Upon detection of a VoIP call, it intercedes to encrypt the call by setting up a key agreement in the media stream and encrypts the packets of voice data. As time goes on, you'll start to see ZRTP inside VoIP clients. I have a software development kit that people can stick in their VoIP clients.
TR: How is Zfone different from most VoIP encryption schemes?
PZ: The other approaches all require the involvement of servers -- and some of them are egregiously insecure. To understand how they work, you need to understand how VoIP works. At the beginning of a call, a couple of packets go in between you and your server and say "Here I am. Here's my IP address." When I call you, my server knows where to call and sends packets to your server. Then the servers allow us to send voice packets directly to each other. They're involved at the beginning and get out of the way.
In one encryption scheme, the key that encrypts and decrypts your voice packets is sent to your server, which sends it to my server, which then sends it to me, and then we talk using that encrypted channel. Unfortunately, now the servers know the sessions key, so what if I live in China and my service provider [that owns the servers] is in China? The Chinese government is going to know the key and they can wiretap the call. If you trust the service providers, then fine, no problem. But the people that operate the servers don't necessarily have in mind the best interests of the people who use them ... more >>>