Much press has been received in relation to security concerns regarding VoIP conversations in addition to the US governments’ monitoring of phone calls.  So just how do you encrypt your conversations that occur with Voice Over IP?

If you currently run a service with Skype then you may not wish to read on.  Skype already utilizes a closed propriety encryption which they do not publish and is therefore not available for peer scrutiny.

Already well recognized in the field of encryption due to his development of Pretty Good Privacy or PGP encryption for emails in 1991, Philip Zimmermann has now released a beta software version designed to encrypt VoIP calls which he claims “…lets you whisper in someone's ear, even if their ear is a thousand miles away.”

Known as Zfone, Zimmermann says it uses a different protocol called ZRTP and rather than relying on SIP signaling or on servers at all (ie no third party), it is said to achieve security without reliance on other aspects such as PKI or Public Key Infrastructure, key certification, trust models, certificate authorities or key management complexity.

It must be noted that Beta software by definition is software still under test however Zimmermann has made available the source code for peer review.  He has also submitted the software in a proposal for a public standard.

In the future Zimmermann claims that “…the ZRTP protocol will be integrated into standalone secure VoIP clients, but today we have a software product that lets you turn your existing VoIP client into a secure phone. The current Zfone software runs in the Internet Protocol stack on any Windows XP, Mac OS X, or Linux PC, and intercepts and filters all the VoIP packets as they go in and out of the machine, and secures the call on the fly.”

One must remember however that Zfone will only encrypt the contents of a call if it is calling another ZRTP client.  This is a basic of encryption in that the decrypting end obviously needs to be utilizing the same standard or will make no sense at all of data.

It is arguable that the Communications Assistance for Law Enforcement Act or CALEA is not breached as it imposes requirements on phone company and VoIP providers where ZRTP works on a peer to peer basis and it does still allow for traffic analysis with only the contents of the call encrypted.

Zfone will not work with a setup of an Analog Telephone Adaptor (ATA) as that is a hardware device.  Whilst it is hoped and envisaged that one day it will, for now if you wish to have encryption on a service other than Skype, you will need to utilize a software phone either provided by your VoIP provider or something like X-Lite, Gizmo or SJPhone.

Phil Zimmermann has released a Beta version of encryption software that will allow VoIP clients utilizing software clients with VoIP providers other than Skype, to encrypt the contents of their calls when calling another ZRTP client.