3 ms·
I'm curious... how does this app handle secure key exchange? There doesn't seem to be any details on the app's website.
by tjohns 14y ago
I'm curious... how does this app handle secure key exchange?
There doesn't seem to be any details on the app's website.
- deleted 14y ago[deleted]
- reidrac 14y agoCheck the wiki: https://github.com/WhisperSystems/RedPhone/wiki https://github.com/WhisperSystems/RedPhone/wiki Read "Encryption Protocols" (uses ZRTP -see rfc6189- for key negotiation). Although I'm not sure I understand what is this about, I didn't notice at first it is VoIP :)
- EthanHeilman 14y agoRedPhone uses a really interesting system. The first time you initiate a call with someone redphone displays a word that is based on the keys exchanged. Each user talks about the word and confirms they got the same word, thereby verifying that there is no man in the middle. The assumption is that it is hard for an attacker to forge and inject a believable conversation into an ongoing real time conversation. This is call SAS or Short Authenticated Strings and I believe it was introduced in the paper 'Secure Communications over Insecure Channels Based on Short Authenticated Strings' (the pdf can be found off of google). You can read about it here: http://en.wikipedia.org/wiki/ZRTP#Authentication http://en.wikipedia.org/wiki/ZRTP#Authentication
- EthanHeilman 14y agoSource code for how the words are generated can be found here. https://github.com/WhisperSystems/RedPhone/blob/master/src/org/thoughtcrime/redphone/crypto/zrtp/SASCalculator.java https://github.com/WhisperSystems/RedPhone/blob/master/src/o...