ZRTP SAS to non ZRTP call leg UA?
Hi; When a call is between a ZRTP UA and non ZRTP UA, with FS MITM, I want to give the user the SAS that the ZRTP call leg is using. I note there is a script: scriptd/lua/zrtp_sas_proxy.lua that is supposed to hook into the call flow by: <action application="export" data="nolocal:api_on_answer=luarun zrtp_sas_proxy.lua ${uuid}"/> This appears to display the SAS, and, I will add TTS for POTS phones. Q1: Where do I make the script install call above? Q2: Is there a better way, code? Thanks; Bill Ross
Once the PBX is trusted it serves no purpose to have the SAS displayed to the end user in this case. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 15, 2014, at 3:52 PM, Bill Ross <rossbcan@gmail.com> wrote:
Hi;
When a call is between a ZRTP UA and non ZRTP UA, with FS MITM, I want to give the user the SAS that the ZRTP call leg is using.
I note there is a script:
scriptd/lua/zrtp_sas_proxy.lua
that is supposed to hook into the call flow by:
<action application="export" data="nolocal:api_on_answer=luarun zrtp_sas_proxy.lua ${uuid}"/>
This appears to display the SAS, and, I will add TTS for POTS phones.
Q1: Where do I make the script install call above? Q2: Is there a better way, code?
Thanks; Bill Ross
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Trouble is trust. Us techhies have it, but end users have no basis. Would still like to do this and, also add a UA to display /speak other call leg SAS on demand. -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: March-16-14 4:08 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA? Once the PBX is trusted it serves no purpose to have the SAS displayed to the end user in this case. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 15, 2014, at 3:52 PM, Bill Ross <rossbcan@gmail.com> wrote:
Hi;
When a call is between a ZRTP UA and non ZRTP UA, with FS MITM, I want to give the user the SAS that the ZRTP call leg is using.
I note there is a script:
scriptd/lua/zrtp_sas_proxy.lua
that is supposed to hook into the call flow by:
<action application="export" data="nolocal:api_on_answer=luarun zrtp_sas_proxy.lua ${uuid}"/>
This appears to display the SAS, and, I will add TTS for POTS phones.
Q1: Where do I make the script install call above? Q2: Is there a better way, code?
Thanks; Bill Ross
______________________________________________________________________ ___ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
On 2014-03-16 21:52, Bill Ross wrote:
Trouble is trust. Us techhies have it, but end users have no basis. Would still like to do this and, also add a UA to display /speak other call leg SAS on demand.
The trouble with this in practice is that it requires users to have an excellent understanding of the security parameters. The non-ZRTP leg user must understand that the SAS does nothing to enhance the security of his call leg. The entire exercise is to enhance the security of the other call leg. It's something of a perversion of the SAS as it's not being generated by the client device. Or rather, you have to treat the PBX as the client device, and the non-ZRTP UA as simply a terminal to that actual client. You also have to be careful about training users to accept an SAS presented in an insecure place like the Caller ID field or via an automated read-back. Attackers can trivially exploit user comfort with that behavior. The script is there because Phil wanted to use it. But Phil may be the only person I would trust to use this sort of thing regularly without getting confused about the awkward security situation.
Hi Travis; Agree with your analysis / interpretation. This is indeed about assuring the user on the encrypted leg that there is no MITM attack between encrypted UA and Freeswitch. Also agree that the unencrypted link is vulnerable to MITM / spoofing. Intend to handle this with physically secured LAN and, if any non-ZRTP UA's in the cloud, well, cannot assure security must be clearly understood. Under these conditions, given that no other (user friendly) way is provided to verify one legged ZRTP UA / Freeswitch SAS, believe this is worth doing, so, I am. My original question regarding where / how to call this script has been answered (duh, by me - on learning curve): just before bridge, and, it is getting called. I am now stuck at: Variable "zrtp_secure_media_confirmed_audio" (nor is zrtp_secure_media_confirmed) is never observed set on either one or two legged ZRTP calls. Have variable names changed? I am aware that I must modify zrtp_sas_proxy.lua to send the SAS to the unencrypted leg. Right now, stuck at lack of trigger condition above. Regards; Bill -----Original Message----- From: Travis Cross [mailto:tc@travislists.com] Sent: March-18-14 12:54 PM To: FreeSWITCH Users Help Cc: Bill Ross Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA? On 2014-03-16 21:52, Bill Ross wrote:
Trouble is trust. Us techhies have it, but end users have no basis. Would still like to do this and, also add a UA to display /speak other call leg SAS on demand.
The trouble with this in practice is that it requires users to have an excellent understanding of the security parameters. The non-ZRTP leg user must understand that the SAS does nothing to enhance the security of his call leg. The entire exercise is to enhance the security of the other call leg. It's something of a perversion of the SAS as it's not being generated by the client device. Or rather, you have to treat the PBX as the client device, and the non-ZRTP UA as simply a terminal to that actual client. You also have to be careful about training users to accept an SAS presented in an insecure place like the Caller ID field or via an automated read-back. Attackers can trivially exploit user comfort with that behavior. The script is there because Phil wanted to use it. But Phil may be the only person I would trust to use this sort of thing regularly without getting confused about the awkward security situation.
You shouldn’t need this, if thats not working a bug must be logged on JIRA for us to fix it. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 18, 2014, at 2:02 PM, Bill Ross <rossbcan@gmail.com> wrote:
I am aware that I must modify zrtp_sas_proxy.lua to send the SAS to the unencrypted leg.
Right now, stuck at lack of trigger condition above.
Regards; Bill
Assuming you mean I am using the correct variables (the script is not obsolete), for now, no bug report until I prove it. ..B -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: March-18-14 3:11 PM To: FreeSWITCH Users Help Cc: Travis Cross Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA? You shouldn't need this, if thats not working a bug must be logged on JIRA for us to fix it. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 18, 2014, at 2:02 PM, Bill Ross <rossbcan@gmail.com> wrote:
I am aware that I must modify zrtp_sas_proxy.lua to send the SAS to the unencrypted leg.
Right now, stuck at lack of trigger condition above.
Regards; Bill
I’m checking it now to be sure, been playing around with that code lately. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 18, 2014, at 2:16 PM, Bill Ross <rossbcan@gmail.com> wrote:
Assuming you mean I am using the correct variables (the script is not obsolete), for now, no bug report until I prove it.
..B -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: March-18-14 3:11 PM To: FreeSWITCH Users Help Cc: Travis Cross Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA?
You shouldn't need this, if thats not working a bug must be logged on JIRA for us to fix it.
Seems all the variables are being set properly. variable_zrtp_passthru_active: false variable_zrtp_secure_media: true variable_zrtp_secure_media_confirmed_audio: true variable_zrtp_sas1_string_audio: orca variable_zrtp_sas2_string: belowground I did the reverse of this with Polycom, See: freeswitch_public_conf_via_sip in default dialplan. Basically sends a display update to the polycom with the SAS so it displays on the polycom leg, so you can do SRTP to FS then talk to a ZRTP endpoint and see the SAS. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 18, 2014, at 2:16 PM, Bill Ross <rossbcan@gmail.com> wrote:
Assuming you mean I am using the correct variables (the script is not obsolete), for now, no bug report until I prove it.
..B -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: March-18-14 3:11 PM To: FreeSWITCH Users Help Cc: Travis Cross Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA?
You shouldn't need this, if thats not working a bug must be logged on JIRA for us to fix it. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com
T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED)
On Mar 18, 2014, at 2:02 PM, Bill Ross <rossbcan@gmail.com> wrote:
I am aware that I must modify zrtp_sas_proxy.lua to send the SAS to the unencrypted leg.
Right now, stuck at lack of trigger condition above.
Regards; Bill
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Brian; So, I am detecting variables correctly. Now having issues with "say" not working (modified zrtp_sas_proxy.lua) : if retries == 20 then log("debug","sending sas...") api:execute("say","en NAME_SPELLED iterated"..get_sas(aleg)) end I have verified the say function works (enabled talking clock UA) Suspect, when in the luarun context that say requires another variable (call leg?) or some other syntax problem. No errors logged and "sending sas" happens. Help? -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: March-18-14 3:35 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA? Seems all the variables are being set properly. variable_zrtp_passthru_active: false variable_zrtp_secure_media: true variable_zrtp_secure_media_confirmed_audio: true variable_zrtp_sas1_string_audio: orca variable_zrtp_sas2_string: belowground I did the reverse of this with Polycom, See: freeswitch_public_conf_via_sip in default dialplan. Basically sends a display update to the polycom with the SAS so it displays on the polycom leg, so you can do SRTP to FS then talk to a ZRTP endpoint and see the SAS. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 18, 2014, at 2:16 PM, Bill Ross <rossbcan@gmail.com> wrote:
Assuming you mean I am using the correct variables (the script is not obsolete), for now, no bug report until I prove it.
..B -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: March-18-14 3:11 PM To: FreeSWITCH Users Help Cc: Travis Cross Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA?
You shouldn't need this, if thats not working a bug must be logged on JIRA for us to fix it. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com
T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED)
On Mar 18, 2014, at 2:02 PM, Bill Ross <rossbcan@gmail.com> wrote:
I am aware that I must modify zrtp_sas_proxy.lua to send the SAS to the unencrypted leg.
Right now, stuck at lack of trigger condition above.
Regards; Bill
______________________________________________________________________ ___ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
Hi Brian; So, I have remedied my ignorance displayed by my last question. Here's a working script, attached, for your edification. If you consider this of use, the following must be done to be ready for prime time: Rename to something else Create a *.wav file that says "Security Code" for use prior to the say module stating the SAS Perhaps a better voice for "say" Recommendation? Note that both legs hear the security code, even though one is insecure (assumed to be on physically secured lan). I believe this is "of use" Note also that the uuid_broadcast documentation on the wiki is totally misleading. The parameters for say are: https://wiki.freeswitch.org/wiki/Mod_commands#uuid_broadcast uuid_broadcast 336889f2-1868-11de-81a9-3f4acc8e505e say::'en number pronounced 12345' aleg note the say parameters are quoted. ...not: uuid_broadcast 336889f2-1868-11de-81a9-3f4acc8e505e say::en\snumber\spronounced\s12345 aleg Enjoy... Bill Ross -----Original Message----- From: Bill Ross [mailto:rossbcan@gmail.com] Sent: March-19-14 2:44 PM To: 'FreeSWITCH Users Help' Subject: RE: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA? Hi Brian; So, I am detecting variables correctly. Now having issues with "say" not working (modified zrtp_sas_proxy.lua) : if retries == 20 then log("debug","sending sas...") api:execute("say","en NAME_SPELLED iterated"..get_sas(aleg)) end I have verified the say function works (enabled talking clock UA) Suspect, when in the luarun context that say requires another variable (call leg?) or some other syntax problem. No errors logged and "sending sas" happens. Help? -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: March-18-14 3:35 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA? Seems all the variables are being set properly. variable_zrtp_passthru_active: false variable_zrtp_secure_media: true variable_zrtp_secure_media_confirmed_audio: true variable_zrtp_sas1_string_audio: orca variable_zrtp_sas2_string: belowground I did the reverse of this with Polycom, See: freeswitch_public_conf_via_sip in default dialplan. Basically sends a display update to the polycom with the SAS so it displays on the polycom leg, so you can do SRTP to FS then talk to a ZRTP endpoint and see the SAS. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 18, 2014, at 2:16 PM, Bill Ross <rossbcan@gmail.com> wrote:
Assuming you mean I am using the correct variables (the script is not obsolete), for now, no bug report until I prove it.
..B -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: March-18-14 3:11 PM To: FreeSWITCH Users Help Cc: Travis Cross Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA?
You shouldn't need this, if thats not working a bug must be logged on JIRA for us to fix it. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com
T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED)
On Mar 18, 2014, at 2:02 PM, Bill Ross <rossbcan@gmail.com> wrote:
I am aware that I must modify zrtp_sas_proxy.lua to send the SAS to the unencrypted leg.
Right now, stuck at lack of trigger condition above.
Regards; Bill
______________________________________________________________________ ___ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
...also required for non ZRTP UA to know that call is encrypted. -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: March-16-14 4:08 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] ZRTP SAS to non ZRTP call leg UA? Once the PBX is trusted it serves no purpose to have the SAS displayed to the end user in this case. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 15, 2014, at 3:52 PM, Bill Ross <rossbcan@gmail.com> wrote:
Hi;
When a call is between a ZRTP UA and non ZRTP UA, with FS MITM, I want to give the user the SAS that the ZRTP call leg is using.
I note there is a script:
scriptd/lua/zrtp_sas_proxy.lua
that is supposed to hook into the call flow by:
<action application="export" data="nolocal:api_on_answer=luarun zrtp_sas_proxy.lua ${uuid}"/>
This appears to display the SAS, and, I will add TTS for POTS phones.
Q1: Where do I make the script install call above? Q2: Is there a better way, code?
Thanks; Bill Ross
______________________________________________________________________ ___ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
On 2014-03-16 20:07, Brian West wrote:
Once the PBX is trusted it serves no purpose to have the SAS displayed to the end user in this case.
The reason the script is there is for cases where the non-ZRTP leg trusts the PBX and its connection to it, but the ZRTP leg doesn't have a trust relationship yet. You could then in theory bootstrap the ZRTP trust relationship by comparing the SAS between legs. Without something like this it is indeed difficult to bootstrap that trust relationship with the PBX unless you're logged in and looking at the console so you can verify the SAS. But the non-ZRTP leg here must trust the PBX and the connection or the exercise is without purpose.
participants (3)
-
Bill Ross
-
Brian West
-
Travis Cross