ZORG, new C++ and Java ZRTP implementation public release
Milan, January 12th 2011 - PrivateWave Italia S.p.A, italian company engaged in developing technologies for privacy protection and information security in voice telecommunications, is pleased to announce the release of ZORG, a new open source ZRTP protocol implementation available for download from http://www.zrtp.org . ZRTP [1] provides end-to-end key exchange with Elliptic Curve Diffie-Hellmann 384bit and AES-256 SRTP encryption . ZORG has been originally developed and implemented in PrivateWave's PrivateGSM voice encryption products available for the following platforms: Blackberry, Nokia and iOS (iPhone) . Zorg C++ has been integrated with PJSIP open source VoIP SDK [2] and it's provided as integration patch against PJSIP 1.8.5. It has been tested on iPhone, Symbian, Windows, Linux and Mac OS X. Zorg Java has been integrated within a custom version of MJSIP [3] open source SDK on Blackberry platform and it includes memory usage optimizations required to reduce at minimum garbage collector activity. Both platforms have separated and modular cryptographic back-ends so that the cryptographic algorithms implementation could be easily swapped with other ones. ZORG is licensed under GNU AGPL and source code is available on github athttps://github.com/privatewave/ZORG. We are releasing it under open source and in coherence with our approach to security [4] as we really hope that it can be useful for the open source ecosystem to create new voice encryption systems in support of freedom of speech. More than 20 pjsip-based open source VoIP encryption software (several written in Java) could directly benefit from ZORG release. We would be happy to receive proposal of cooperation, new integration, new cryptographic back-ends, bug scouting and whatever useful to improve and let ZRTP affirm as voice encryption standard. Zorg is available from http://www.zrtp.org . [1] ZRTP: http://http://en.wikipedia.org/wiki/ZRTP [2] PJSIP: http://www.pjsip.org [3] MJSIP: http://www.mjsip.org [4] Security approach:http://www.privatewave.com/security/approch.html
Hi Fabio, thanks for your company's very valuable contribution! IANAL, and don't know how the Affero version of GPL is different from "normal" GPL. Maybe having double licensing (like AGPL and BSD) would help spreading the usage of ZORG. Anyway, yay for the feat! -giovanni On Wed, Jan 12, 2011 at 10:40 AM, Fabio Pietrosanti (naif) <lists@infosecurity.ch> wrote:
Milan, January 12th 2011 - PrivateWave Italia S.p.A, italian company engaged in developing technologies for privacy protection and information security in voice telecommunications, is pleased to announce the release of ZORG, a new open source ZRTP protocol implementation available for download from http://www.zrtp.org .
ZRTP [1] provides end-to-end key exchange with Elliptic Curve Diffie-Hellmann 384bit and AES-256 SRTP encryption .
ZORG has been originally developed and implemented in PrivateWave's PrivateGSM voice encryption products available for the following platforms: Blackberry, Nokia and iOS (iPhone) .
Zorg C++ has been integrated with PJSIP open source VoIP SDK [2] and it's provided as integration patch against PJSIP 1.8.5. It has been tested on iPhone, Symbian, Windows, Linux and Mac OS X.
Zorg Java has been integrated within a custom version of MJSIP [3] open source SDK on Blackberry platform and it includes memory usage optimizations required to reduce at minimum garbage collector activity.
Both platforms have separated and modular cryptographic back-ends so that the cryptographic algorithms implementation could be easily swapped with other ones.
ZORG is licensed under GNU AGPL and source code is available on github at https://github.com/privatewave/ZORG .
We are releasing it under open source and in coherence with our approach to security [4] as we really hope that it can be useful for the open source ecosystem to create new voice encryption systems in support of freedom of speech.
More than 20 pjsip-based open source VoIP encryption software (several written in Java) could directly benefit from ZORG release.
We would be happy to receive proposal of cooperation, new integration, new cryptographic back-ends, bug scouting and whatever useful to improve and let ZRTP affirm as voice encryption standard.
Zorg is available from http://www.zrtp.org .
[1] ZRTP: http://http://en.wikipedia.org/wiki/ZRTP [2] PJSIP: http://www.pjsip.org [3] MJSIP: http://www.mjsip.org [4] Security approach: http://www.privatewave.com/security/approch.html _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Giovanni Maruzzelli Cell : +39-347-2665618
AGPL is the most evil license you can ever pick for anything... its the one that reaches over the socket and steals your code and soul. /b On Jan 12, 2011, at 7:53 AM, Giovanni Maruzzelli wrote:
Hi Fabio,
thanks for your company's very valuable contribution!
IANAL, and don't know how the Affero version of GPL is different from "normal" GPL.
Maybe having double licensing (like AGPL and BSD) would help spreading the usage of ZORG.
Anyway, yay for the feat!
-giovanni
Brian, Not really... "IANAL" but the AGPL is virtually identical to the GPL except that it eliminates the "ASP loophole". Let's pretend FreeSWITCH was licensed under the GPL. Let's say I make my own modifications to FreeSWITCH and provide network services to my customers. Under the GPL I am NOT required to provide these source changes to anyone because I'm not distributing a binary - I'm providing network services to customers. The binary runs in my datacenter (or wherever); it's not being "distributed". If you're providing "network services" to customers and not distributing software using a GPL license it may as well be BSD or something else with a weak copyleft. Under the AGPL providing network services to customers is essentially equal to distributing binaries under the GPL. In my hypothetical situation above if FreeSWITCH were licensed under the AGPL I would be required to distribute my source changes to my customers even though I never provided them with a binary. Of course (under both licenses) once I distribute the binary and source to my customers I might as well distribute it to the rest of the world because are free to do so anyway... On Wed, Jan 12, 2011 at 10:11 AM, Brian West <brian@freeswitch.org> wrote:
AGPL is the most evil license you can ever pick for anything... its the one that reaches over the socket and steals your code and soul.
/b
-- Kristian Kielhofner http://www.astlinux.org http://blog.krisk.org http://www.star2star.com http://www.submityoursip.com http://www.voalte.com
While I'm not a lawyer the guy that wrote this article (Paul Arne) is our open source license specialist and him and I have talked about the AGPL at length (as attorneys usually do): http://www.mmmtechlaw.com/2010/12/14/gnu-affero-general-public-license-risks... On Wed, Jan 12, 2011 at 10:51 AM, Kristian Kielhofner <kris@kriskinc.com> wrote:
Brian,
Not really...
"IANAL" but the AGPL is virtually identical to the GPL except that it eliminates the "ASP loophole".
Let's pretend FreeSWITCH was licensed under the GPL. Let's say I make my own modifications to FreeSWITCH and provide network services to my customers. Under the GPL I am NOT required to provide these source changes to anyone because I'm not distributing a binary - I'm providing network services to customers. The binary runs in my datacenter (or wherever); it's not being "distributed".
If you're providing "network services" to customers and not distributing software using a GPL license it may as well be BSD or something else with a weak copyleft.
Under the AGPL providing network services to customers is essentially equal to distributing binaries under the GPL. In my hypothetical situation above if FreeSWITCH were licensed under the AGPL I would be required to distribute my source changes to my customers even though I never provided them with a binary.
Of course (under both licenses) once I distribute the binary and source to my customers I might as well distribute it to the rest of the world because are free to do so anyway...
On Wed, Jan 12, 2011 at 10:11 AM, Brian West <brian@freeswitch.org> wrote:
AGPL is the most evil license you can ever pick for anything... its the one that reaches over the socket and steals your code and soul.
/b
-- Kristian Kielhofner http://www.astlinux.org http://blog.krisk.org http://www.star2star.com http://www.submityoursip.com http://www.voalte.com
insightful comment! -jesse On Wed, Jan 12, 2011 at 7:11 AM, Brian West <brian@freeswitch.org> wrote:
AGPL is the most evil license you can ever pick for anything... its the one that reaches over the socket and steals your code and soul.
/b
On Jan 12, 2011, at 7:53 AM, Giovanni Maruzzelli wrote:
Hi Fabio,
thanks for your company's very valuable contribution!
IANAL, and don't know how the Affero version of GPL is different from "normal" GPL.
Maybe having double licensing (like AGPL and BSD) would help spreading the usage of ZORG.
Anyway, yay for the feat!
-giovanni
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (5)
-
Brian West
-
Fabio Pietrosanti (naif)
-
Giovanni Maruzzelli
-
jesse
-
Kristian Kielhofner