3 ms·

> I think I read that Zoom do decrypt AES-GCM server side already. They have to so they can put the little green box around the person currently speaking. Why

• dijksterhuis 6y ago
  * it used to be with ECB. not anymore. My bad. > Matthew Green, a cryptographer and computer science professor at Johns Hopkins University, points out that group video conferencing is difficult to encrypt end to end. That’s because the service provider needs to detect who is talking to act like a switchboard, which allows it to only send a high-resolution videostream from the person who is talking at the moment, or who a user selects to the rest of the group, and to send low-resolution videostreams of other participants. This type of optimization is much easier if the service provider can see everything because it’s unencrypted. https://theintercept.com/2020/03/31/zoom-meeting-encryption/ https://theintercept.com/2020/03/31/zoom-meeting-encryption/ This was 2 months ago so their new white paper clarifies the current situation: > For use cases such as meeting real-time content (video, voice, and content share), where data is transmitted over User Datagram Protocol (UDP), we use AES-256 GCM mode to encrypt these compressed data streams. Additionally, for video, voice, and content share encrypted with AES, once it’s encrypted, it remains encrypted as it passes through Zoom’s meeting servers until it reaches another Zoom Client or a Zoom Connector, which helps translate the data to another protocol. https://zoom.us/docs/doc/Zoom%20Encryption%20Whitepaper.pdf https://zoom.us/docs/doc/Zoom%20Encryption%20Whitepaper.pdf
  • monadic2 6y ago
    Ah, so their proprietary codec has come back to bite them in the ass. (I realize codec is not the correct term.)