[Freeswitch-users] ZRTP proxying

[Dahlberg, David]

Hello all,

I have some problems with proxying ZRTP streams trough Freeswitch. My
setup is as follows:

[FS-A]----[FS-B]----[FS-C]

For End-to-end security, "A" should initiate a ZRTP session and "C"
shall terminate it.

What works: 
* With late negotiation, two ZRTP security associations (A,B) and (B,C)
  are established. Of course in that case there is no E2E encryption,
  so no real advantage over the usage of TLS/SAVP .

According to the Wiki, it should be possible to use "proxy_media" with
"inbound-zrtp-passthru". Only this does not work and the problem is
this:

ZRTP uses a slightly modified RTP header format with a CRC checksum that
is calculated over the whole ZRTP header and payload (excluding the CRC
field).

Freeswitch ("FS-B" in my use-case) on the other hand exchanges the RTP
"sequence numbers" and "syncronization source identifiers" (SSRC) (which
in ZRTP become "Source Identifiers"). Which leads to the case that the
checksums are valid on call leg (A,B) but invalid  on leg (B,C).

Accordingly, "FS-C" receives ZRTP hello packets from "FS-A", calculates
the checksums, finds a mismatch and discards the packets.

I have found a thread on [freeswitch-users] dated January 2013 and with
a subject "problems with freeswitch + zrtp in proxy-media mode" which
discusses exactly this problem. Within this thread was mentioned, that
FS would change the proxy behaviour, if it encounters "zrtp-hash"
attribute in the SDP and a quick test with SFLphone and w/o proxy_media
seems to confirm this. So is there any possibility to originate this
attribute, when FS originates the ZRTP?

Regards,

	David


-- 
David Dahlberg     

Fraunhofer FKIE, Dept. Communication Systems (KOM) | Tel: +49-228-9435-845
Fraunhoferstr. 20, 53343 Wachtberg, Germany        | Fax: +49-228-856277