Phil Zimmerman and voice encryption; a Skype problem?

[Steven M. Bellovin]

There's an article in today's NY Times (for subscribers, it's at
http://www.nytimes.com/2006/05/22/technology/22privacy.html?_r=1&oref=slogin
)
on whether Phil Zimmerman's Zfone -- an encrypted VoIP package -- will
invite government scrutiny.  There doesn't seem to be any imminent threat
in the U.S.; the one concrete example mentioned -- the British plan to
give police the power to compel individuals to disclose keys -- doesn't
threaten Zfone, because it uses Diffie-Hellman for (among other things)
perfect forward secrecy and doesn't even have any long-term keys.  (See
draft-zimmermann-avt-zrtp-01.txt for protocol details.)

The fascinating thing, though, was this sentence near the end of the
article:

	But at a conference last week in Cyprus, German officials said
	they had technology for intercepting and decrypting Skype phone
	calls, according to Anthony M. Rutkowski, vice president for
	regulatory affairs and standards for VeriSign, a company that
	offers security for Internet and phone operations.

The Berson report says that Skype uses AES-256.  NSA rates that as
suitable for Top Secret traffic, so it's presumably not the cipher.
Berson analyzed a number of other possible attack scenarios; the only one
that seems to be possible is an active attack plus forged certificates.
If Berson's analysis was correct -- and we all know how hard it is to
verify cryptographic protocols -- that leaves open the possibility of a
protocol change that implemented some sort of Clipper-like functionality.
A silent change like that would be *very* ominous.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com

----- End forwarded message -----
--
Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820            http://www.ativel.com
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE

[demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]