Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wiretapping End-To-End Encrypted VoIP Calls: Real-World Attacks on ZRTP

sufficientlysecure.org

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Wiretapping End-To-End Encrypted VoIP Calls: Real-World Attacks on ZRTP

#11

Post by Fox8 »

sufficient wrote: post #9
rdtsc wrote: post #6

The more interesting would be to see how feasible is to crack the in band SAS authentication string, when callers verbally verify it. Deep learning and ability to train on a specific callers' voice [1] then mimic it might be an interesting attack vector. In practice Silent Circle's implementation does something interesting and instead of SAS numbers use dictionary words. So you end up with something like "Pink Elepha…

Author of the paper here. There is existing work on testing the feasibility of impersonating other person's voice. We discuss them in our related work section at the end of the paper. I think on the long run, SAS will no longer be a sufficient authentication technique due to advances in speech synthesis. To prolong ZRTP's life we propose usage of sentences instead of words/chars. This is discussed in detail in our be…

This is a fascinating and well elaborated article!

I noticed that UX/UI is important and a guarantee that SAS should increase in length, what are some of the recommendations that you advise to have a good ZRTP implementation ?

Or should we start discussing the fadeoff of ZRTP and a change to something like Matrix protocol or even Signal's one ?

Re: Wiretapping End-To-End Encrypted VoIP Calls: Real-World Attacks on ZRTP

#12

Post by lallysingh »

jessaustin wrote: post #7
lallysingh wrote: post #5

AFAICT, This looks more like attacks on the implementations of ZRTP than on attempts to find weaknesses in the underlying protocol.

One sort of assumes that from " Real-World Attacks", no?

Or real world attacks on solid implementations.

Re: Wiretapping End-To-End Encrypted VoIP Calls: Real-World Attacks on ZRTP

#14

Post by lozf »

Fox8 wrote: post #11
sufficient wrote: post #9

Earlier quoted context omitted.

Author of the paper here. There is existing work on testing the feasibility of impersonating other person's voice. We discuss them in our related work section at the end of the paper. I think on the long run, SAS will no longer be a sufficient authentication technique due to advances in speech synthesis. To prolong ZRTP's life we propose usage of sentences instead of words/chars. This is discussed in detail in our be…

This is a fascinating and well elaborated article! I noticed that UX/UI is important and a guarantee that SAS should increase in length, what are some of the recommendations that you advise to have a good ZRTP implementation ? Or should we start discussing the fadeoff of ZRTP and a change to something like Matrix protocol or even Signal's one ?

Both Matrix and Signal use WebRTC for VoIP so the content is encrypted by default. Call set up and signaling is also encrypted by default with Signal, and possible with Matrix - it's automatic if the room from which a call is established is already encrypted.

I know Signal attempts to prevent any data leakage by forcing the Opus codec to use a constant bitrate instead of its default VBR -- I'm not sure if Matrix implements anything similar yet.

Re: Wiretapping End-To-End Encrypted VoIP Calls: Real-World Attacks on ZRTP

#15

Post by jugbee »

sufficient wrote: post #10
mtgx wrote: post #2

For those interested, Signal doesn't seem to use ZRTP anymore: > The new Signal voice and video beta functionality eliminates the need for ZRTP. The "signaling" messages used to set up the voice/video beta calls (offer/answer SDPs, ICE candidates, etc) are transmitted over the normal Signal Protocol messaging channel, which binds the security of the call to that existing secure channel. It is no longer necessary to v…

Author of the paper here. Yup, in regards to Signal our findings are already obsolete :D I think that the new Signal developments are great. It is better to allow only one key verification mechanism for unified usability and also use key continuity. Before, SAS needed to be verified for each call again.

But isn't now with signal that you have to wiretap it once and your are good to go since there are no sas every time?

Re: Wiretapping End-To-End Encrypted VoIP Calls: Real-World Attacks on ZRTP

#16

Post by Johnny_Brahms »

jugbee wrote: post #15
sufficient wrote: post #10

Earlier quoted context omitted.

Author of the paper here. Yup, in regards to Signal our findings are already obsolete :D I think that the new Signal developments are great. It is better to allow only one key verification mechanism for unified usability and also use key continuity. Before, SAS needed to be verified for each call again.

But isn't now with signal that you have to wiretap it once and your are good to go since there are no sas every time?

Sure, but "wiretapping it once" would mean breaking a lot of well studied and until now unbroken crypto.
Post reply on HN