PGP founder talks about VOIP security at ITWeb

Zimmerman, who sold his company back in 2002, has devoted much of his efforts to his Zfone project, which centres on a secure internet telephony technology.

His presentation in South Africa will, Infosecurity notes, be on the subject of VOIP technology and how, despite what some government agencies are claiming around the world, the system is reasonably wiretap-friendly.

The bad news, Zimmerman will announce, is that because VOIP calls can be eavesdropped upon, organised crime can tap in to the resource on a global and remote basis.

Interestingly, according to South African newswire reports, Zimmerman is quoted as saying that many of the current security vulnerabilities of internet telephony services are related to denial-of-service attacks.

Zimmerman says that law enforcement agencies will be concerned that encrypted VOIP will block many of their lawful intercepts, but he also notes that, if internet telephony calls are not encrypted, there could also be repercussions.

This, he says, is because if criminals VOIP-wiretap prosecutors and judges, they can discover details of current and planned investigations, which is good news for criminals, but not so good for society as a whole.

This is where Zimmerman's Zfone technology enters the frame and, whilst the secure VOIP technology runs on top of existing session internet protocol (SIP) session internet protocol and real time transport protocol (RTP) applications software, it is wholly compatible with systems based on these internet telephony standards.

Because it is a software-based technology, Zfone is billed as turning many existing VOIP clients into secure phones.

The software runs in the internet protocol stack on any Windows XP, Mac OS X, or Linux PC, and intercepts and filters all the VOIP packets as they go in and out of the machine - and, says Zimmerman, secures the call on the fly.

When the Zfone software detects when the call starts, it initiates a cryptographic key agreement between the two parties, and then proceeds to encrypt and decrypt the IP voice packets in real time.

Infosecurity notes that the Zfone client has its own separate graphical user interface, advising the user if the call is secure.

According to Zimmerman, Zfone acts as if it were a "bump on the wire", sitting between the VOIP client and the internet, but implemented in software in the protocol stack.

What’s hot on Infosecurity Magazine?