Yes, I've seen this http://wiki.freeswitch.org/wiki/SIP_TLS. I was just curious if the only way to have true end to end secure communications with FS would have to be a SIP trunk from one FS system to another encrypted SIP system on the other with no POTS/PRI/BRI circuits used in transit. I'm assuming if there's any POTS/BRI/PRI/DSS circuits used in transit, anyone with a lineman's handset could still eavesdrop on any conversations. Is this not the case? Paul
Well its not so easy to take a lineman's handset and eavesdrop on a T1/ BRI/PRI/DSS1 circuit.. that takes way more hardware.... but POTS you just need a lineman's handset. But yes true secure will need to be end to end. /b On May 7, 2009, at 10:35 AM, Paul wrote:
Yes, I've seen this http://wiki.freeswitch.org/wiki/SIP_TLS. I was just curious if the only way to have true end to end secure communications with FS would have to be a SIP trunk from one FS system to another encrypted SIP system on the other with no POTS/PRI/ BRI circuits used in transit. I'm assuming if there's any POTS/BRI/ PRI/DSS circuits used in transit, anyone with a lineman's handset could still eavesdrop on any conversations. Is this not the case?
Paul
Brian West brian@freeswitch.org -- Meet us at ClueCon! http://www.cluecon.com
You're right. Digital circuits are not so easy to tap into as opposed to POTS. I'm thinking about this issue because I'm wondering how the US Govt. sets their DRSN lines up to be secure. From what I read, only Raytheon and Telecore have DRSN-use JITC-approved switches. It seems that list may be old since I've heard that they're now running a 50k device DRSN network with Cisco gear/software. I suppose for their hardware switches, they must be installing some really long haul trunks from end to end around the world for security. Thanks Brian. ________________________________ From: Brian West <brian@freeswitch.org> To: freeswitch-users@lists.freeswitch.org Sent: Thursday, May 7, 2009 11:43:53 AM Subject: Re: [Freeswitch-users] FS + encryption Well its not so easy to take a lineman's handset and eavesdrop on a T1/BRI/PRI/DSS1 circuit.. that takes way more hardware.... but POTS you just need a lineman's handset. But yes true secure will need to be end to end. /b On May 7, 2009, at 10:35 AM, Paul wrote: Yes, I've seen this http://wiki.freeswitch.org/wiki/SIP_TLS. I was just curious if the only way to have true end to end secure communications with FS would have to be a SIP trunk from one FS system to another encrypted SIP system on the other with no POTS/PRI/BRI circuits used in transit. I'm assuming if there's any POTS/BRI/PRI/DSS circuits used in transit, anyone with a lineman's handset could still eavesdrop on any conversations. Is this not the case? Paul Brian West brian@freeswitch.org -- Meet us at ClueCon! http://www.cluecon.com
SIP TLS will protect the SIP session information with static keys via a certificate, assuming of course the call is direct between two peers. It will do nothing for the actual voice channel. There is SRTP, which can be used to create a cryptographic context over RTP. However, the key question is how to exchange the keys. If they are exchanged in the SIP session, even TLS SIP, then there are certificates around, and it is possible to acquire a past rtp session that has been intercepted. ZRTP offers a solution for setting up SRTP cryptographic contexts using distributed and self generated keys (much like gnupg or ssh) that are exchanged between the peers over RTP itself, and validated through a fingerprint hash at both ends. It is of course essential to initially validate the keys in a secure network first, but once that is done, a man-in-the-middle in the key exchange process will then stick out like a sore thumb. Furthermore, since each call uses different per-session generated keys, there is no forward knowledge; breaking one call does not allow one to also decrypt all past calls. Paul wrote:
Yes, I've seen this http://wiki.freeswitch.org/wiki/SIP_TLS. I was just curious if the only way to have true end to end secure communications with FS would have to be a SIP trunk from one FS system to another encrypted SIP system on the other with no POTS/PRI/BRI circuits used in transit. I'm assuming if there's any POTS/BRI/PRI/DSS circuits used in transit, anyone with a lineman's handset could still eavesdrop on any conversations. Is this not the case?
Paul
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hey David! You should come by to this year's ClueCon! We still have some speaking slots left. On Thu, May 7, 2009 at 11:08 AM, David Sugar <dyfet@gnutelephony.org> wrote:
SIP TLS will protect the SIP session information with static keys via a certificate, assuming of course the call is direct between two peers. It will do nothing for the actual voice channel.
There is SRTP, which can be used to create a cryptographic context over RTP. However, the key question is how to exchange the keys. If they are exchanged in the SIP session, even TLS SIP, then there are certificates around, and it is possible to acquire a past rtp session that has been intercepted.
ZRTP offers a solution for setting up SRTP cryptographic contexts using distributed and self generated keys (much like gnupg or ssh) that are exchanged between the peers over RTP itself, and validated through a fingerprint hash at both ends. It is of course essential to initially validate the keys in a secure network first, but once that is done, a man-in-the-middle in the key exchange process will then stick out like a sore thumb. Furthermore, since each call uses different per-session generated keys, there is no forward knowledge; breaking one call does not allow one to also decrypt all past calls.
Paul wrote:
Yes, I've seen this http://wiki.freeswitch.org/wiki/SIP_TLS. I was just curious if the only way to have true end to end secure communications with FS would have to be a SIP trunk from one FS system to another encrypted SIP system on the other with no POTS/PRI/BRI circuits used in transit. I'm assuming if there's any POTS/BRI/PRI/DSS circuits used in transit, anyone with a lineman's handset could still eavesdrop on any conversations. Is this not the case?
Paul
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:213-799-1400
If I can find funding for travel presently I would. Anthony Minessale wrote:
Hey David!
You should come by to this year's ClueCon! We still have some speaking slots left.
On Thu, May 7, 2009 at 11:08 AM, David Sugar <dyfet@gnutelephony.org <mailto:dyfet@gnutelephony.org>> wrote:
SIP TLS will protect the SIP session information with static keys via a certificate, assuming of course the call is direct between two peers. It will do nothing for the actual voice channel.
There is SRTP, which can be used to create a cryptographic context over RTP. However, the key question is how to exchange the keys. If they are exchanged in the SIP session, even TLS SIP, then there are certificates around, and it is possible to acquire a past rtp session that has been intercepted.
ZRTP offers a solution for setting up SRTP cryptographic contexts using distributed and self generated keys (much like gnupg or ssh) that are exchanged between the peers over RTP itself, and validated through a fingerprint hash at both ends. It is of course essential to initially validate the keys in a secure network first, but once that is done, a man-in-the-middle in the key exchange process will then stick out like a sore thumb. Furthermore, since each call uses different per-session generated keys, there is no forward knowledge; breaking one call does not allow one to also decrypt all past calls.
Paul wrote: > Yes, I've seen this http://wiki.freeswitch.org/wiki/SIP_TLS. > I was just curious if the only way to have true end to end secure communications with FS would have to be a SIP trunk from one FS system to another encrypted SIP system on the other with no POTS/PRI/BRI circuits used in transit. I'm assuming if there's any POTS/BRI/PRI/DSS circuits used in transit, anyone with a lineman's handset could still eavesdrop on any conversations. Is this not the case? > > Paul > > > > > > > _______________________________________________ > Freeswitch-users mailing list > Freeswitch-users@lists.freeswitch.org <mailto:Freeswitch-users@lists.freeswitch.org> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org <mailto:Freeswitch-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/
AIM: anthm MSN:anthony_minessale@hotmail.com <mailto:MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com <mailto:PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net <http://irc.freenode.net> #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <mailto:sip%3A888@conference.freeswitch.org> iax:guest@conference.freeswitch.org/888 <http://iax:guest@conference.freeswitch.org/888> googletalk:conf+888@conference.freeswitch.org <mailto:googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:213-799-1400
------------------------------------------------------------------------
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Anthony Minessale
-
Brian West
-
David Sugar
-
Paul