4 ms·
Decrypting SDES Protected SRTP Phone Calls
- zaroth 12y agoWhat could possibly be the point of putting a key field in the protocol? Why have a key at all of you already entirely depend on a higher level wrapper like TLS to protect it? It seems like the only purpose is increasing the incidence of self-inflicted gunshot wounds to your feet. It's not security. It's not even obscurity. It's just complexity! The only thing I can think of is establishing the key over TLS so you can then drop TLS later for devices that don't support it but continue the encrypted session using a simpler bare cipher. If the goal is to strip away TLS complexity, cipher suite negotiation, resumption, etc. functionality to just have a basic fixed cipher, this sounds stupendously more complex than just doing a DH key exchange in the first place, e.g. spiped.
- Canada 12y agoEncrypting SIP doesn't protect the payload at all. The purpose of this protocol is to remedy that. ZRTP is a much better solution, as it negotiates keys in band and doesn't depend on the confidentiality of the signalling channel.
- zaroth 12y agoThat makes sense. In the context of isolated control and data streams that must be separately encrypted, they are saying 'put the data key here in the signaling packet' but protecting the control plane is a separate exercise.