1
00:00:04,360 --> 00:00:06,020
I'm sorry I'm late.

2
00:00:08,630 --> 00:00:13,490
You know, yesterday a lot of people told me I was supposed to speak at 11 o'clock.

3
00:00:14,210 --> 00:00:19,410
And so I didn't actually look on the DEF CON website to see if that was actually true.

4
00:00:20,350 --> 00:00:22,690
So here I am at 11 o'clock.

5
00:00:25,010 --> 00:00:27,050
I'm sorry for the inconvenience.

6
00:00:39,080 --> 00:00:42,500
By the way, I don't mind if anyone takes my photos.

7
00:00:45,080 --> 00:00:52,300
Yeah, either John Callis, John Callis is CTO of PGP, or me, doesn't matter.

8
00:00:52,740 --> 00:00:54,680
We get photoed all the time.

9
00:00:55,220 --> 00:01:01,120
I figure I've already gotten in enough trouble with the Fed so it can't get any worse, right?

10
00:01:10,440 --> 00:01:11,840
Let's see if this comes up.

11
00:01:11,840 --> 00:01:12,520
Yep.

12
00:01:12,660 --> 00:01:16,500
Wow, that's a little bit lower resolution than usual, but that's alright.

13
00:01:21,060 --> 00:01:24,040
I'm going to...

14
00:01:27,860 --> 00:01:29,040
Okay.

15
00:01:29,040 --> 00:01:31,640
I'm going to demo my new project today.

16
00:01:31,640 --> 00:01:34,840
My new project is Secure VoIP.

17
00:01:36,880 --> 00:01:40,180
I think it's about time we had Secure VoIP.

18
00:01:40,760 --> 00:01:43,140
How many people here use VoIP?

19
00:01:44,100 --> 00:01:47,520
Oh, you guys are so geeky.

20
00:01:47,520 --> 00:01:49,240
The early adopters.

21
00:01:50,300 --> 00:01:50,920
Um...

22
00:01:52,960 --> 00:01:53,580
Well...

23
00:01:54,240 --> 00:01:55,240
You know...

24
00:01:56,140 --> 00:02:00,760
For years we've enjoyed the relative safety of the public switch telephone network.

25
00:02:00,760 --> 00:02:02,420
I say relative safety.

26
00:02:02,420 --> 00:02:04,940
I'm only speaking relative to the Internet.

27
00:02:05,500 --> 00:02:12,510
Of course, we all know that phone calls on the public switch telephone network can be intercepted.

28
00:02:13,720 --> 00:02:14,340
But...

29
00:02:16,120 --> 00:02:17,820
It's a lot harder to do.

30
00:02:17,820 --> 00:02:25,280
You have to be like the government or somebody who's willing to physically go to a place and clip on some alligator clips.

31
00:02:26,840 --> 00:02:32,320
Or you have to have access to the phone company or the cooperation of the phone company.

32
00:02:32,320 --> 00:02:49,200
But with VoIP, it's possible for somebody in Malaysia to hack into a machine somewhere and install a piece of software that will intercept all the VoIP calls on your network.

33
00:02:49,340 --> 00:02:52,340
And organize them like a TiVo player.

34
00:02:52,340 --> 00:02:54,340
And so...

35
00:02:55,780 --> 00:03:10,920
To move our precious phone calls from the sort of well-manicured neighborhood of the public switch telephone network to the sort of crime-ridden slum that is now the Internet, I think would be unwise without protecting it with encryption.

36
00:03:14,540 --> 00:03:15,100
So...

37
00:03:15,100 --> 00:03:19,380
First I'm going to do a little demo here and then I'm going to explain how it works.

38
00:03:21,060 --> 00:03:29,320
Somewhere in a soundproof booth is an accomplice who will now call me on my VoIP phone.

39
00:03:31,880 --> 00:03:33,980
Steve, call me.

40
00:03:36,940 --> 00:03:40,560
He said he's watching this, so he'll be able to tell.

41
00:03:41,180 --> 00:03:41,940
Yep, here it is.

42
00:03:41,940 --> 00:03:42,760
It's ringing.

43
00:03:42,760 --> 00:03:44,180
So now I'm going to answer.

44
00:03:45,040 --> 00:03:47,160
This is a regular SIP phone, by the way.

45
00:03:47,160 --> 00:03:48,640
You can call any other SIP phone.

46
00:03:49,940 --> 00:03:51,060
Great.

47
00:03:52,200 --> 00:03:53,260
Okay.

48
00:03:55,220 --> 00:03:57,360
I was afraid this would happen.

49
00:03:59,700 --> 00:04:03,420
Let me just say... I'm going to exit and relaunch.

50
00:04:04,820 --> 00:04:07,660
I'm using an open-source VoIP client.

51
00:04:08,560 --> 00:04:11,520
And then I added crypto to it.

52
00:04:11,720 --> 00:04:17,220
And so, there are some issues with the open-source VoIP client that I'm using.

53
00:04:19,380 --> 00:04:23,670
And sometimes it has difficulty with NAT firewall traversal.

54
00:04:25,110 --> 00:04:27,140
Okay, I'm ready again.

55
00:04:27,140 --> 00:04:30,630
Steve, I hope you've exited and relaunched.

56
00:04:32,320 --> 00:04:34,020
Call me again.

57
00:04:38,480 --> 00:04:39,710
What I did was...

58
00:04:40,560 --> 00:04:46,140
You know, many of you are aware of PGP Phone, a project that I did about nine years ago.

59
00:04:46,140 --> 00:04:48,920
At that time, the Internet wasn't ready.

60
00:04:49,180 --> 00:04:50,740
No one had broadband.

61
00:04:50,740 --> 00:04:54,720
There were no protocols that were standardized for VoIP.

62
00:04:54,840 --> 00:04:56,600
SIP wasn't invented yet.

63
00:04:57,560 --> 00:04:59,300
Steve, you're supposed to call me now.

64
00:05:07,090 --> 00:05:09,090
Maybe if I try calling him.

65
00:05:11,430 --> 00:05:12,930
Come on, Steve.

66
00:05:15,890 --> 00:05:16,370
Anyway...

67
00:05:16,870 --> 00:05:19,370
Oh, he's calling me on my cell phone.

68
00:05:19,810 --> 00:05:20,810
To tell me...

69
00:05:23,310 --> 00:05:24,270
Yes?

70
00:05:32,170 --> 00:05:34,250
You had to reboot your machine?

71
00:05:35,190 --> 00:05:36,590
Oh, man.

72
00:05:37,350 --> 00:05:39,110
That would explain a lot.

73
00:05:39,110 --> 00:05:39,730
Okay.

74
00:05:42,570 --> 00:05:43,530
Alright.

75
00:05:46,170 --> 00:05:48,510
Okay, I'll leave this open here.

76
00:05:49,210 --> 00:05:51,290
I'm going to put you on the little speakerphone.

77
00:05:52,770 --> 00:05:58,170
Okay, so you just yell into your speakerphone or into your phone whenever you want to talk to me.

78
00:06:01,410 --> 00:06:03,070
Or you could just call me.

79
00:06:04,270 --> 00:06:05,810
Okay, well, anyway...

80
00:06:05,810 --> 00:06:07,530
So, what I did was...

81
00:06:08,690 --> 00:06:12,370
Back in the days of PGP Phone, I had to improvise my own protocols.

82
00:06:12,370 --> 00:06:14,470
There was no SIP, there was no RTP.

83
00:06:14,770 --> 00:06:17,190
It was just the beginnings of RTP at that time.

84
00:06:17,190 --> 00:06:19,210
They were just starting to design it.

85
00:06:19,590 --> 00:06:24,010
And so I had to just sort of improvise my own.

86
00:06:24,150 --> 00:06:28,610
And it wasn't so bad for the time, but the Internet just wasn't ready.

87
00:06:28,610 --> 00:06:31,850
The bandwidth wasn't anywhere near what it had to be.

88
00:06:32,230 --> 00:06:37,550
So, it was a neglected product for many years.

89
00:06:37,830 --> 00:06:38,470
What?

90
00:06:39,530 --> 00:06:40,990
You ready to call?

91
00:06:44,700 --> 00:06:45,660
Okay.

92
00:06:46,660 --> 00:06:47,100
What?

93
00:06:47,100 --> 00:06:47,520
Okay.

94
00:06:47,520 --> 00:06:48,840
Just call when you're ready.

95
00:06:51,240 --> 00:06:55,940
So, fast forward nine years, and now the Internet is ready for this.

96
00:06:56,140 --> 00:06:58,460
Maybe this is not ready, but...

97
00:07:00,820 --> 00:07:05,960
So, there's still some NAT firewall traversal things in the open source VoIP plan.

98
00:07:05,960 --> 00:07:10,780
I'm using an open source VoIP plan called Stoom, which is written, oddly enough, in Python.

99
00:07:11,840 --> 00:07:14,860
And so, we had to write our crypto in Python.

100
00:07:15,340 --> 00:07:19,260
It's kind of a new experience to do that, to do a secure phone in Python.

101
00:07:19,260 --> 00:07:21,200
Or any kind of SIP phone in Python.

102
00:07:23,800 --> 00:07:27,660
And so, there are some problems with that.

103
00:07:27,660 --> 00:07:30,440
So, this is why... See, I didn't feel I was ready for this.

104
00:07:30,460 --> 00:07:36,320
But, Nico Sell persuaded me to unveil this at the Black Hat conference.

105
00:07:36,320 --> 00:07:37,940
And I said, no, no, I'm not ready.

106
00:07:38,140 --> 00:07:43,400
And so, she kind of, you know, kept pushing me to do it until finally I had to do it.

107
00:07:43,400 --> 00:07:46,280
Because the press started...

108
00:07:46,280 --> 00:07:47,000
What?

109
00:07:49,500 --> 00:07:50,920
Yeah, well, it's not.

110
00:07:54,500 --> 00:07:56,240
I would notice if it was.

111
00:07:57,860 --> 00:07:59,140
Oh, there it is.

112
00:07:59,940 --> 00:08:01,840
By the way, we don't have any audio.

113
00:08:03,040 --> 00:08:04,720
Oh, I didn't plug in the audio.

114
00:08:11,380 --> 00:08:13,780
Oh, it's... Just a minute.

115
00:08:14,220 --> 00:08:16,540
I'm gonna... We're gonna exit now.

116
00:08:18,120 --> 00:08:19,920
This is terribly embarrassing.

117
00:08:20,040 --> 00:08:23,880
This is the... You know, it worked the first time at Black Hat.

118
00:08:24,540 --> 00:08:26,700
When we were on an outside IP address.

119
00:08:26,700 --> 00:08:28,800
We couldn't get it to work inside the firewall.

120
00:08:28,800 --> 00:08:29,340
But...

121
00:08:30,340 --> 00:08:31,920
But we got some...

122
00:08:31,920 --> 00:08:34,280
But we got an outside IP address and it worked.

123
00:08:34,300 --> 00:08:36,200
Okay, now I'm ready, so call me.

124
00:08:37,100 --> 00:08:38,440
Oh, there we go.

125
00:08:42,630 --> 00:08:43,930
Oh, man, this is...

126
00:08:46,570 --> 00:08:48,010
This is not working.

127
00:08:49,310 --> 00:08:50,010
Okay.

128
00:08:50,290 --> 00:08:52,670
You know, the crypto is in pretty good shape.

129
00:08:52,670 --> 00:08:54,770
It's a good thing they gave me an hour to talk, right?

130
00:08:54,770 --> 00:08:56,610
So I can try this several times.

131
00:08:56,610 --> 00:09:00,430
I actually got here a little while ago and I wanted to test and test and test.

132
00:09:00,930 --> 00:09:04,110
But the Ethernet cable for this was right here at the podium.

133
00:09:04,110 --> 00:09:04,930
And so...

134
00:09:05,470 --> 00:09:07,070
I couldn't...

135
00:09:10,120 --> 00:09:11,960
Did you exit and relaunch?

136
00:09:15,440 --> 00:09:16,680
This is why I...

137
00:09:17,340 --> 00:09:19,860
This is why I never use...

138
00:09:19,860 --> 00:09:23,000
Why I never bring a laptop to a talk.

139
00:09:33,910 --> 00:09:36,090
All right, I'm gonna abort this.

140
00:09:36,090 --> 00:09:38,130
I'm just gonna explain how it works.

141
00:09:38,270 --> 00:09:38,930
Goodbye.

142
00:09:40,630 --> 00:09:41,390
Okay.

143
00:09:50,180 --> 00:09:52,900
Now I can get away from the...

144
00:10:10,390 --> 00:10:11,550
I'll just use this one.

145
00:10:12,350 --> 00:10:13,090
Okay.

146
00:10:14,950 --> 00:10:16,090
How humiliating.

147
00:10:16,690 --> 00:10:19,450
You have to believe me that it worked at Black Hat yesterday.

148
00:10:20,230 --> 00:10:21,690
I might try it again.

149
00:10:26,940 --> 00:10:27,900
Oh, yeah?

150
00:10:29,440 --> 00:10:30,580
It's tempting.

151
00:10:31,640 --> 00:10:34,300
If you want to bring it up here, maybe we can try it again.

152
00:10:37,880 --> 00:10:39,840
But do you have broadband?

153
00:10:41,360 --> 00:10:43,260
Okay, that's pretty impressive.

154
00:10:45,980 --> 00:10:47,460
All right.

155
00:10:48,920 --> 00:10:54,380
I looked at various other protocols that are currently being considered for secure VoIP.

156
00:10:55,440 --> 00:11:01,500
There is some IETF RFCs that define various ways of doing it.

157
00:11:01,500 --> 00:11:11,000
Most of them rely on external sources of a centrally controlled public key infrastructure with a certificate authority.

158
00:11:11,500 --> 00:11:16,700
I think that two people who want to talk to each other should not need permission from someone else to do it.

159
00:11:18,280 --> 00:11:22,060
And so I just do like I did with PGP Phone.

160
00:11:22,060 --> 00:11:24,000
I do a Diffie-Hellman key exchange.

161
00:11:31,480 --> 00:11:32,700
Yeah, okay.

162
00:11:32,700 --> 00:11:44,360
I do a Diffie-Hellman key exchange with hash commitment so that this means that I can read an authentication digest aloud that gets displayed.

163
00:11:44,360 --> 00:11:46,540
And the two people read it to each other.

164
00:11:46,540 --> 00:11:49,820
And if it matches, that means there's no man-in-the-middle attack.

165
00:11:50,140 --> 00:11:56,100
This eliminates the need for a certificate authority, a public key infrastructure.

166
00:11:56,160 --> 00:11:57,900
Boy, there's a lot of feedback here.

167
00:12:00,940 --> 00:12:01,740
The other way.

168
00:12:01,740 --> 00:12:02,560
Turn it the other way.

169
00:12:14,550 --> 00:12:17,230
Yes, I'm using a Macintosh.

170
00:12:19,130 --> 00:12:21,070
For security reasons.

171
00:12:26,220 --> 00:12:27,340
Yep.

172
00:12:28,080 --> 00:12:30,120
Alright, that's just not going to work.

173
00:12:36,520 --> 00:12:40,940
There are other approaches that don't use a public key infrastructure necessarily.

174
00:12:40,940 --> 00:12:52,240
They send SIP packets that use TLS connections and they put the session key right there in the SIP packet, not encrypted.

175
00:12:52,240 --> 00:12:54,960
They'll just send that, but they'll send it through a TLS connection.

176
00:12:54,960 --> 00:12:59,600
The problem is it's going through multiple TLS connections from server to server to server.

177
00:12:59,600 --> 00:13:05,300
And each one of them, it's decrypted and then re-encrypted in another TLS connection.

178
00:13:05,300 --> 00:13:12,920
So that means that each of those servers has access to the session key and is in a position to compromise the call.

179
00:13:13,480 --> 00:13:32,800
There's another scheme that actually takes the session key, encrypts it as an SMIME email message, and sticks that into the SIP packet and sends that to set up the call.

180
00:13:32,800 --> 00:13:38,760
And the other side receives it, decrypts it like it was a piece of email, extracts the session key, and then uses that.

181
00:13:39,440 --> 00:13:45,180
To use an email encryption standard... I mean, it's bad enough they're not using PGP for that, right?

182
00:13:45,460 --> 00:13:48,500
But even if it was PGP, I would still be complaining.

183
00:13:48,780 --> 00:13:50,480
Because it's just the wrong approach.

184
00:13:50,480 --> 00:13:55,140
You don't send an encrypted email to somebody to set up a phone call.

185
00:13:55,280 --> 00:13:58,320
It just feels wrong.

186
00:13:59,260 --> 00:14:07,780
And not only that, but it means that at the end of the call, you have persistent key material around that you can use to retroactively reconstruct the call.

187
00:14:07,780 --> 00:14:19,220
If somebody intercepted the call and recorded all the packets, they would be able to decrypt them after the fact if they could somehow later obtain the key that was sent through the SIP packet.

188
00:14:19,960 --> 00:14:23,000
In other words, it doesn't have perfect forward secrecy.

189
00:14:23,780 --> 00:14:30,100
Well, you know, I just can't imagine designing a secure phone that doesn't have perfect forward secrecy.

190
00:14:31,100 --> 00:14:37,180
Let's see, there's another one that has self-signed certificates, but you have to use a trusted server to get them.

191
00:14:37,520 --> 00:14:40,440
Or you don't know who they are, and it could be a man in the middle.

192
00:14:40,840 --> 00:14:44,760
So all of the other schemes that I looked at have problems.

193
00:14:45,600 --> 00:14:54,020
And almost all the problems come from trying to get somebody else involved in setting up a secure call between Alice and Bob.

194
00:14:54,500 --> 00:14:56,980
And it just seemed the wrong approach.

195
00:14:56,980 --> 00:15:01,740
So with my approach, just the two people are involved.

196
00:15:01,760 --> 00:15:05,320
It doesn't use anything involving another external server.

197
00:15:05,320 --> 00:15:08,860
It doesn't send anything in the SIP packet that relates to the crypto.

198
00:15:08,860 --> 00:15:17,580
Of course, it uses SIP to set up the call, like any SIP phone, but not to set up the encryption, not to set up the key agreement.

199
00:15:19,340 --> 00:15:29,480
Instead, you get the SIP call started, and then the RTP packets start flowing, and then it inserts a Diffie-Hellman exchange in the stream.

200
00:15:30,060 --> 00:15:37,160
Gets the key agreement, and then starts encrypting it using SRTP, secure real-time protocol.

201
00:15:37,980 --> 00:15:45,360
When I first started working on this, I thought I was going to have to encrypt my own packets with my own protocol, like I did with PGP Phone.

202
00:15:45,360 --> 00:15:53,420
But I discovered something called secure RTP, or SRTP, and I read the spec for it, and it looks a lot like PGP Phone.

203
00:15:54,020 --> 00:15:59,600
It encrypts the packets in a manner that is nearly identical to the way it was done in PGP Phone nine years ago.

204
00:15:59,600 --> 00:16:02,460
And I thought, this saves me a lot of trouble.

205
00:16:02,700 --> 00:16:04,720
I was going to do it this way already.

206
00:16:04,720 --> 00:16:07,540
So I'm going to use SRTP.

207
00:16:07,580 --> 00:16:13,140
This is actually one part of the protocol that is predefined in an RFC.

208
00:16:16,100 --> 00:16:20,460
But I do one more thing that I did not do in PGP Phone.

209
00:16:23,440 --> 00:16:32,240
At the end of the call, I erase all the keys, but I keep a hash of the shared secret that we used.

210
00:16:32,240 --> 00:16:35,900
I keep a hash of it around for the next phone call.

211
00:16:36,680 --> 00:16:48,800
And then when the next phone call happens, I do a fresh Diffie-Hellman key exchange, like I do with every call, but I also take one more step and mix in the retained shared secret from the last phone call.

212
00:16:49,660 --> 00:17:00,620
This means that there is sort of a key continuity model, which Peter Gutman, I see in the audience right here, he has called this the baby duck security model.

213
00:17:00,620 --> 00:17:02,540
He was referring to SSH.

214
00:17:02,820 --> 00:17:11,100
With SSH, you have an exchange of key material at the first session, and that's locally cached.

215
00:17:11,100 --> 00:17:15,720
And you assume that the man in the middle is not present in the first session.

216
00:17:16,080 --> 00:17:20,740
And if he's not present in the first session, it's too late for him to get involved in later sessions.

217
00:17:21,280 --> 00:17:23,780
Well, that's the same thing I'm using here.

218
00:17:25,120 --> 00:17:30,140
So, remember when I said about reading the hash aloud?

219
00:17:30,440 --> 00:17:32,360
Unfortunately, I can't show it to you.

220
00:17:33,780 --> 00:17:53,760
But, for those of you who have seen secure phones, like Eric Blossom's secure phone from back in the mid-90s, and the AT&T 3600, developed in the early 90s, they all involve displaying a short hash code that you read aloud to the other person to verify there's no man in the middle.

221
00:17:53,780 --> 00:18:03,420
Well, if you forget to do that, it's probably okay, because the attacker is afraid that you will do that, and so he won't attack.

222
00:18:03,720 --> 00:18:09,960
But, if he knows that you're lazy, he might be tempted to attack, knowing that you might not check it.

223
00:18:10,420 --> 00:18:15,340
But suppose you made 100 phone calls to your friend, and you didn't check.

224
00:18:15,340 --> 00:18:23,160
You just kept making phone calls, and you just forgot to check, or you were too lazy to check, by reading aloud the authentication digest.

225
00:18:23,860 --> 00:18:39,120
Well, if on the 50th call, you suddenly remember that, you know, I really ought to check this, and you read it aloud, and the other person reads it theirs aloud, and it checks, and it compares, and everything is good, it means that not only is this call secure,

226
00:18:39,120 --> 00:18:48,160
but every other call, all the way back in the previous 50 calls, to the first call you ever made to him, it proves that all of them were secure.

227
00:18:48,280 --> 00:18:51,660
It retroactively proves there was no man in the middle.

228
00:18:52,940 --> 00:18:55,500
That's really good for peace of mind.

229
00:18:55,620 --> 00:18:57,760
It means that you can be lazy most of the time.

230
00:18:58,280 --> 00:19:06,160
And then finally, one day, when you're diligent about it, your diligence assures you that all the other times you were lazy, it was okay.

231
00:19:06,780 --> 00:19:11,560
Of course, if it doesn't match, it means that there was a man in the middle all the way back to the beginning of time.

232
00:19:13,600 --> 00:19:16,020
That's a real, oh shit, moment, you know.

233
00:19:20,340 --> 00:19:28,620
But that's something that other secure phones don't do, and that my protocol does, and so I'm feeling pretty good about that feature.

234
00:19:30,080 --> 00:19:42,380
Now, if somebody were to kick the door in, and come in with guns, and pin you against the wall, and take your computer, and suck all the bits out of the computer, they're not going to be able to retroactively reconstruct the call.

235
00:19:42,460 --> 00:19:45,360
Not even with the retained shared secrets I just described.

236
00:19:46,020 --> 00:19:51,060
Because what doesn't actually retain the shared secret that was used in the call, it hashes it.

237
00:19:51,120 --> 00:19:53,260
So you can't go backwards in the hash.

238
00:19:56,480 --> 00:19:59,800
I'll be publishing a document describing this protocol.

239
00:20:00,280 --> 00:20:03,600
I think this is a better way to do secure void.

240
00:20:03,660 --> 00:20:12,440
This is a much better way than the other protocols currently being considered in various IETF RFCs.

241
00:20:12,440 --> 00:20:18,420
You know, designs tend to resemble the institutions that give birth to them.

242
00:20:18,660 --> 00:20:33,600
And I think that the centrally managed approaches that we're seeing right now sort of reflect the sort of institutional thinking that went into making them.

243
00:20:33,960 --> 00:20:39,720
And I tend to be more libertarian in my approach.

244
00:20:39,720 --> 00:20:44,200
I'm not a big L libertarian, but I'm a civil libertarian.

245
00:20:44,560 --> 00:20:52,200
But it's not only my political instincts, it's also, from a design perspective, simpler.

246
00:20:52,280 --> 00:20:57,440
To add a certificate authority to a SIP server adds immense complexity.

247
00:20:57,480 --> 00:21:03,500
We've seen many companies go bankrupt in the 1990s trying to build public key infrastructure.

248
00:21:03,860 --> 00:21:09,360
There are companies that try to create the technology for building certificate authorities.

249
00:21:09,720 --> 00:21:11,280
Those companies are now bankrupt.

250
00:21:11,380 --> 00:21:16,560
And sure, you can explain some of that by saying the internet bubble burst, but I don't think it's always from that.

251
00:21:16,560 --> 00:21:20,780
Some of them went bankrupt just because of the difficulty of building public key infrastructure.

252
00:21:20,880 --> 00:21:25,640
Not only the companies that were providing that technology, but the companies that were trying to use the technology.

253
00:21:25,880 --> 00:21:32,820
They didn't go bankrupt necessarily, but their IT departments almost went under trying to deploy public key infrastructure.

254
00:21:33,240 --> 00:21:38,780
So I think that if we were to learn from our mistakes, we should stop trying to do it that way.

255
00:21:38,780 --> 00:21:48,320
And when we have a new opportunity to deploy something with a new technology like VoIP, the last thing we should do is go back and take a proven technology.

256
00:21:48,320 --> 00:21:51,200
When I say proven, I don't mean proven successful.

257
00:21:51,200 --> 00:21:57,600
I mean a proven failure of public key infrastructure and try to apply it to VoIP.

258
00:21:58,100 --> 00:22:00,660
And so, my design doesn't do that.

259
00:22:03,400 --> 00:22:19,300
So, for those of you that would like to see this prototype work better than what we just witnessed, this thing is built around an open source VoIP client called Stoom, written in Python.

260
00:22:19,340 --> 00:22:22,460
And if you Google for Stoom, you can find the homepage for it.

261
00:22:22,580 --> 00:22:40,100
And for those of you who are Python weenies, if you go out and try to fix the open source VoIP client and make it work on all platforms, PC, Windows platforms too, and get it a little bit more stable, then this thing will benefit from that.

262
00:22:40,200 --> 00:22:51,560
All the problems that we just saw relate to the state machine in the VoIP client and how they interact with a firewall.

263
00:22:53,000 --> 00:22:56,320
So, I'd like to open it up for questions.

264
00:23:00,800 --> 00:23:01,760
Yeah.

265
00:23:13,910 --> 00:23:17,950
You're asking me to elaborate on my remark that PKI is a failure.

266
00:23:18,790 --> 00:23:21,730
Well, you know, I don't think PKI is completely a failure.

267
00:23:21,730 --> 00:23:25,290
I think it's actually worked pretty well for web browsers and web servers.

268
00:23:25,430 --> 00:23:30,950
I think SSL connections between your browser and the server seems to work pretty well.

269
00:23:34,030 --> 00:23:36,470
But it doesn't work that well for email.

270
00:23:38,530 --> 00:23:44,290
Well, the PGP PKI works a lot better for email.

271
00:23:45,270 --> 00:23:46,870
But, you know, take S-MIME.

272
00:23:47,230 --> 00:23:51,810
S-MIME is widely deployed and is in fact embedded in a lot of Microsoft products.

273
00:23:51,810 --> 00:23:54,190
I mean, bundled, I should say, with Microsoft products.

274
00:23:54,190 --> 00:23:55,250
And yet no one uses it.

275
00:23:55,250 --> 00:23:55,870
Why?

276
00:23:55,870 --> 00:24:00,370
Because to make S-MIME work, you have to have a PKI up and running already.

277
00:24:00,370 --> 00:24:02,870
So the activation energy is too high.

278
00:24:03,090 --> 00:24:05,730
With PGP, you can run right out of the box.

279
00:24:06,850 --> 00:24:10,030
You don't need a PKI to be running first.

280
00:24:10,170 --> 00:24:15,450
And I think that it would be crazy to try to burden VoIP with that same high activation energy.

281
00:24:17,010 --> 00:24:19,850
That's what I mean by PKI is a failure.

282
00:24:30,660 --> 00:24:33,840
Well, let's talk about how a man-in-the-middle attack would work.

283
00:24:36,320 --> 00:24:39,540
Let's imagine that this was actually in a hardware phone.

284
00:24:39,640 --> 00:24:42,900
You had a phone on your desk that did this protocol.

285
00:24:42,900 --> 00:24:45,820
And you bought that phone at Walmart for $100.

286
00:24:47,220 --> 00:24:50,920
So imagine that your friend also has a phone like that.

287
00:24:50,920 --> 00:24:54,720
And you want to call and it sets up a Diffie-Hellman exchange and now you're talking, right?

288
00:24:54,840 --> 00:24:59,580
But imagine that an eavesdropper went down to Walmart and bought two of these phones.

289
00:25:01,200 --> 00:25:04,840
And brought them home and set up the two phones side by side.

290
00:25:05,060 --> 00:25:10,100
And had one of the phones interposed between you and the other person.

291
00:25:10,100 --> 00:25:11,540
And the other phone too.

292
00:25:11,540 --> 00:25:18,500
So that when you're calling your friend, you're not actually calling your friend, you're calling this eavesdropper's phone right here.

293
00:25:18,500 --> 00:25:19,720
The one on the left.

294
00:25:21,240 --> 00:25:29,080
And the eavesdropper knows you're going to do this and has your friend's phone number on the speed dial on this phone here on the right.

295
00:25:29,800 --> 00:25:40,720
And so when he sees the phone ring and sees that you're calling and you're calling your friend, hits the speed dial, waits for your friend to answer, and as soon as your friend answers, he answers you.

296
00:25:40,720 --> 00:25:45,280
And now he's got these two phones and he holds the two phones together like this.

297
00:25:45,780 --> 00:25:48,840
So that the earpiece and the mouthpiece are connected.

298
00:25:49,140 --> 00:25:52,860
In this kind of sort of lewd and lascivious kind of connection there.

299
00:25:53,340 --> 00:26:00,580
And now you think you're talking to your friend, but in fact you're talking to the man in the middle.

300
00:26:00,580 --> 00:26:06,300
And the man in the middle can listen in the air gap between the two mouthpieces, whatever.

301
00:26:06,300 --> 00:26:14,160
And now notice that the eavesdropper didn't have to have any special knowledge of mathematics.

302
00:26:14,160 --> 00:26:16,960
Didn't have to know anything about how Diffie-Hellman works.

303
00:26:17,640 --> 00:26:24,480
The only important thing is that there's these two phones that they bought at Walmart, right?

304
00:26:24,560 --> 00:26:32,000
And now there's a random session key between you and one of the phones, and there's a different random session key between the other phone and your friend, right?

305
00:26:32,720 --> 00:26:41,480
Well, if you could figure out a way of discovering the fact that the two session keys aren't the same, you would know there was a man in the middle.

306
00:26:42,480 --> 00:26:52,520
Well, what if the two phones could hash the session key and display that on the little display, and you read it aloud to your friend?

307
00:26:52,580 --> 00:26:56,680
Well, they better match, because if they don't match, that means there's a man in the middle.

308
00:26:57,640 --> 00:26:59,180
And that's what we do here.

309
00:26:59,580 --> 00:27:00,980
Only I couldn't show it to you.

310
00:27:02,180 --> 00:27:03,800
It did work yesterday.

311
00:27:03,800 --> 00:27:05,380
I swear it worked yesterday.

312
00:27:05,780 --> 00:27:07,420
It's worked in a lot of places.

313
00:27:07,820 --> 00:27:12,200
But in some places, there's some firewall problems, and I can't get it to work.

314
00:27:12,600 --> 00:27:20,680
You know, a lot of the SIP phones out there have difficulty with firewall NAT traversal, but there's better protocols coming out all the time.

315
00:27:20,680 --> 00:27:26,780
You know, Skype does overcome these firewall problems, and I think we can overcome them in the SIP world, too.

316
00:27:29,780 --> 00:27:31,000
Back there.

317
00:27:34,490 --> 00:27:36,590
Could you yell really loud?

318
00:27:44,740 --> 00:27:50,580
No, unfortunately, it's written in Python, so it would have to be, you know, sort of refactored into C.

319
00:27:51,880 --> 00:27:56,320
The question was, can this code be ported to other open source clients?

320
00:27:56,840 --> 00:27:59,520
Yeah, but it has to be rewritten in C.

321
00:27:59,520 --> 00:28:02,440
In fact, I'm looking for volunteers to do that.

322
00:28:05,160 --> 00:28:08,020
I've actually got a series of products on the roadmap.

323
00:28:08,200 --> 00:28:10,420
You know, this is starting out just like PGP.

324
00:28:10,420 --> 00:28:15,260
Remember, PGP was started out as a private project without any money, you know.

325
00:28:15,360 --> 00:28:17,360
I paid for all this myself.

326
00:28:17,720 --> 00:28:18,980
Actually, I did get some help.

327
00:28:18,980 --> 00:28:23,640
Jeff Culver, who is well-known in the VoIP world, put in some of his own money, too.

328
00:28:23,720 --> 00:28:26,040
But most of it came from me paying.

329
00:28:26,040 --> 00:28:29,200
I hired an engineer full-time to work on it for a few months.

330
00:28:29,540 --> 00:28:33,100
But I was paying him, you know, really very low wages.

331
00:28:33,800 --> 00:28:38,580
And eventually, he had to take a job with a real company that paid him good money.

332
00:28:39,200 --> 00:28:43,520
So the development has slowed down.

333
00:28:43,520 --> 00:28:47,540
There is some development still going on with it, but it's at a slower pace.

334
00:28:48,880 --> 00:28:51,560
And I am going to try to start a company for this.

335
00:28:51,560 --> 00:28:55,360
And I'm actually talking to some investors to get some funding for this.

336
00:28:55,780 --> 00:29:00,880
And I got funding now from two sources so far.

337
00:29:00,880 --> 00:29:02,860
Jeff Culver put some of his own money in.

338
00:29:03,100 --> 00:29:05,400
And I got a little bit of money from Dick Clark.

339
00:29:05,960 --> 00:29:08,540
I don't mean the guy from American Bandstand.

340
00:29:08,980 --> 00:29:10,320
The other Dick Clark.

341
00:29:11,480 --> 00:29:13,600
Cyber security czar, you know.

342
00:29:13,600 --> 00:29:18,300
He left the Bush White House and wrote a book called Against All Enemies.

343
00:29:18,300 --> 00:29:20,880
It's a really good book, but anyway, it's too late now.

344
00:29:26,020 --> 00:29:29,020
So I'm going to start a new company and commercialize this.

345
00:29:29,340 --> 00:29:32,480
But I will publish the source code, because that's what I did with PGP.

346
00:29:33,100 --> 00:29:35,580
And I believe it's necessary to get people to trust it.

347
00:29:43,600 --> 00:29:45,120
So, more questions.

348
00:29:46,520 --> 00:29:47,260
Yeah.

349
00:29:52,480 --> 00:29:54,280
Could you yell really loud?

350
00:29:54,280 --> 00:29:56,260
Could you get up and just absolutely yell?

351
00:30:10,550 --> 00:30:12,750
You mean the retain shared secrets?

352
00:30:13,310 --> 00:30:15,510
You just need a little bit of memory for that.

353
00:30:24,280 --> 00:30:25,600
Yeah, okay, yes.

354
00:30:25,600 --> 00:30:29,400
You want to be able to take sort of an identity with you from one machine to another.

355
00:30:29,400 --> 00:30:31,500
Well, I've thought about doing that.

356
00:30:31,500 --> 00:30:37,000
You could put your configuration files in a USB drive and carry that around and copy it.

357
00:30:37,500 --> 00:30:39,420
But, I don't know.

358
00:30:39,420 --> 00:30:43,260
I think we'd have to do something more elaborate to do what you're talking about.

359
00:30:43,540 --> 00:30:49,520
Because, do you really want to copy that onto a computer in a cyber cafe, you know?

360
00:30:55,890 --> 00:31:01,390
Well, it's okay, because the first time you call somebody, there isn't any retained shared secrets.

361
00:31:01,390 --> 00:31:04,810
So, you just read the hash aloud and it just works.

362
00:31:05,350 --> 00:31:09,350
The retained shared secret feature is an extra feature.

363
00:31:09,370 --> 00:31:11,010
It kind of makes it nicer.

364
00:31:11,230 --> 00:31:13,030
But, it isn't necessary.

365
00:31:16,350 --> 00:31:17,490
Yes.

366
00:31:23,160 --> 00:31:24,720
Right, yes.

367
00:31:25,200 --> 00:31:26,060
That's right.

368
00:31:26,060 --> 00:31:28,020
I'm using SHA-256.

369
00:31:28,960 --> 00:31:30,760
SHA-256.

370
00:31:31,240 --> 00:31:32,380
Yes.

371
00:31:32,380 --> 00:31:38,060
And, for the Diffie-Hellman exchange, I'm using a 4000-bit Diffie-Hellman.

372
00:31:38,300 --> 00:31:49,340
And, for the block cipher, I'm using AES-256 running in counter mode, as defined by the SRTP protocol.

373
00:31:51,080 --> 00:31:55,180
So, I think I'm doing... I picked the right algorithms for this.

374
00:31:56,100 --> 00:32:07,810
And, actually, you know, even the collision problems that we've seen in some of the hash functions, I think, are not likely to be exploitable in the particular scenario that we're using them here.

375
00:32:07,970 --> 00:32:10,690
Even if I were using one of the weaker hash functions.

376
00:32:15,370 --> 00:32:16,790
John, do you want to say anything?

377
00:32:19,070 --> 00:32:19,770
Yeah.

378
00:32:19,990 --> 00:32:29,310
We've been working with Phil on this, too, and supporting him, and getting him contact with VCs, and I've been cajoling him into demoing at places like this, as well.

379
00:32:30,670 --> 00:32:31,330
Okay.

380
00:32:31,330 --> 00:32:44,830
I've been saying that, you know, we at PGP have been helping Phil with this, that we've been getting him with VCs, cajoling him to demo the thing, because I believe that getting some exposure to this is going to be important to get it properly funded and out there.

381
00:32:44,830 --> 00:32:50,070
The really important thing in what he's doing is that this will go nearly anywhere.

382
00:32:50,070 --> 00:32:55,630
I mean, it can go in a handset, it can go in a handheld computer, it can go on a laptop.

383
00:32:56,050 --> 00:33:02,790
The protocols are also directly layerable on top of what's going on.

384
00:33:02,790 --> 00:33:11,410
Sorry that we don't have a good network here to do the demo, but the system that he's running is an ordinary VoIP phone.

385
00:33:11,410 --> 00:33:14,110
You can call any other VoIP phone in the world with it.

386
00:33:14,110 --> 00:33:20,990
And it just so happens that if somebody else has one that has this security in there, poof, now all of a sudden you've got a secure phone call.

387
00:33:20,990 --> 00:33:31,110
And that's a really important aspect of what this does, because it means that the network effect of getting people to get secure phones is lower.

388
00:33:31,110 --> 00:33:42,530
That if you build a infrastructure that is a secure phone infrastructure that doesn't interoperate with regular phones, it makes it increasingly hard for people to go on because they have to make a decision.

389
00:33:42,530 --> 00:33:44,850
Do I want secure or do I want easy?

390
00:33:44,850 --> 00:33:54,390
Well, this gives you both easy and secure and other things like, you know, that you only really need to do the hash once or maybe even not do that.

391
00:33:54,390 --> 00:33:59,430
It's like I make phone calls all the time and I can tell from the person's voice whom I'm talking to.

392
00:33:59,690 --> 00:34:07,790
And you know from the sharing shared secret that you are talking to the end point that you were talking to last time.

393
00:34:08,190 --> 00:34:14,430
So, you know, if you have anything that tells you that that was a good phone call, you know that you are in the same state you were before.

394
00:34:14,430 --> 00:34:20,950
So again, this makes it be very easy and very understandable for people who are not crypto savvy, who are not security savvy.

395
00:34:20,950 --> 00:34:24,290
It can be put into all sorts of devices.

396
00:34:42,640 --> 00:34:43,560
That's right.

397
00:34:43,560 --> 00:34:47,600
The question is, what about a non-technical person using this phone?

398
00:34:47,940 --> 00:34:54,260
If your mother wants to use this phone, she doesn't have to read aloud the little hash digits that are displayed.

399
00:34:54,260 --> 00:34:56,880
She could just talk on the phone.

400
00:34:58,040 --> 00:35:00,340
The protocol would work the same way.

401
00:35:00,340 --> 00:35:03,700
The packets going back and forth are still, you know, the same kind of packets.

402
00:35:03,860 --> 00:35:10,040
It's just that final check that you do to verify to yourself, to assure yourself that there's no man in the middle, you would skip it.

403
00:35:10,260 --> 00:35:15,440
And presumably the man in the middle doesn't know that you're going to be lazy and you're going to skip it.

404
00:35:15,440 --> 00:35:18,380
So he's afraid to do his attack.

405
00:35:18,380 --> 00:35:19,420
It's an active attack.

406
00:35:19,420 --> 00:35:23,320
He has to actually sit in there and generate packets and inject them.

407
00:35:23,340 --> 00:35:29,860
He's going to be afraid to do that, because he's afraid he'll be discovered, because maybe your mom isn't as lazy as he thinks.

408
00:35:32,600 --> 00:35:39,680
One of the other advantages of this is that you know that if there is anybody listening to a phone call, they've always been there.

409
00:35:39,900 --> 00:35:45,640
So this also makes it very difficult for the attacker, because there is no way for them to get in and get out.

410
00:35:45,640 --> 00:35:51,760
They have to be in at the beginning and stay in, because the minute they drop out, they are also detected.

411
00:35:51,760 --> 00:35:59,840
This is a non-cryptographic security property that is very nice, because it serves as a real deterrent to the attacker.

412
00:35:59,840 --> 00:36:01,820
It makes their life really difficult.

413
00:36:04,380 --> 00:36:05,260
Yeah.

414
00:36:14,800 --> 00:36:22,840
Well, the question is, what happens if you try to call somebody who's using a regular POTS phone on the public switch telephone network?

415
00:36:24,560 --> 00:36:29,680
In that case, you would have to go through a gateway that connects the VoIP world to the PSTN world.

416
00:36:30,180 --> 00:36:34,560
And that means that you're not going to be able to make it a secure call end-to-end.

417
00:36:34,580 --> 00:36:39,380
Now theoretically, at least, you could make it a secure call between your phone and the gateway.

418
00:36:39,620 --> 00:36:41,780
Where it touches the PSTN.

419
00:36:41,780 --> 00:36:48,120
And then that last mile, hopefully it's only a mile, would be in the clear.

420
00:36:48,500 --> 00:36:53,320
But that gets you across the Atlantic, or across national borders.

421
00:36:57,500 --> 00:37:02,360
In the worst case, it's no less secure than a regular PSTN call.

422
00:37:02,360 --> 00:37:11,620
So that means that the new vulnerabilities that come from being in a VoIP world have been largely solved by this.

423
00:37:29,440 --> 00:37:31,420
The question is, the U.S.

424
00:37:31,420 --> 00:37:36,940
government is requiring people to put back doors in their VoIP software.

425
00:37:36,940 --> 00:37:39,340
I believe you're probably referring to CALEA.

426
00:37:40,220 --> 00:37:53,620
Well, they may change the way CALEA works, but I'm not a lawyer, and I don't have the most perfect understanding of this.

427
00:37:53,780 --> 00:38:00,140
But my limited understanding of CALEA is that it largely applies to the service providers.

428
00:38:00,220 --> 00:38:06,140
It largely applies to the people who have gateways to the PSTN, or the servers.

429
00:38:06,140 --> 00:38:11,140
I don't think it applies to end users.

430
00:38:11,880 --> 00:38:32,760
So if you're running some software on your laptop computer, and it sets up an encrypted link between you and the other party, without the involvement of the service provider, and you're not going through a gateway to the PSTN, then I'm going to go out on a limb here and suggest that CALEA doesn't apply to that case.

431
00:38:32,760 --> 00:38:37,240
Now it's possible that they could change the laws, make it more aggressive.

432
00:38:37,740 --> 00:38:41,080
But we'll have to worry about that when that happens.

433
00:38:50,850 --> 00:38:54,770
I haven't worked out the protocol to make this an anonymous system.

434
00:38:58,510 --> 00:39:03,310
It's peer-to-peer, unless you have to go through a proxy because of some firewall problems.

435
00:39:06,750 --> 00:39:13,970
Yeah, probably if you do the anonymous part, you're probably going to sacrifice your man-in-the-middle protection.

436
00:39:23,230 --> 00:39:25,950
There's not that much overhead for the encryption.

437
00:39:26,030 --> 00:39:38,350
The SRTP adds a little bit of extra to each packet for an HMAC, an authentication code, that gets stuck onto each packet.

438
00:39:38,350 --> 00:39:42,650
It's 80 bits long, but it can be shortened to 32 bits.

439
00:39:43,290 --> 00:39:47,350
And it's not that much of a bandwidth hit.

440
00:39:47,450 --> 00:40:02,710
And the only reason why that's there is actually not to encrypt it, but to authenticate, to prevent someone from sending in packets in a denial-of-service attack, so that the packets can be rejected because they don't authenticate.

441
00:40:02,750 --> 00:40:05,510
It's not actually necessary for the encryption.

442
00:40:06,350 --> 00:40:16,830
It's necessary, it's part of the extra protection you get from SRTP against a hacker coming in and injecting packets that aren't part of your phone call.

443
00:40:17,930 --> 00:40:19,770
I don't know if that's very clear.

444
00:40:19,950 --> 00:40:21,930
We can talk about it later if you want more details.

445
00:40:21,930 --> 00:40:26,110
Or go ahead and read the spec for SRTP, there's an RFC for it.

446
00:40:26,110 --> 00:40:29,730
It'll explain why you want to have that extra stuff.

447
00:40:33,390 --> 00:40:41,570
You know, it isn't only political reasons why I'm doing this.

448
00:40:41,570 --> 00:40:43,290
It's also business reasons.

449
00:40:43,410 --> 00:40:53,050
I think that if we're going to successfully migrate our phone calls to VoIP, to the internet, we're going to need this kind of protection.

450
00:40:53,810 --> 00:41:00,390
And in order to make a simpler design, I'm doing it this way.

451
00:41:01,290 --> 00:41:10,050
And so it isn't just my instincts for civil liberties, it's also my instincts for simple design.

452
00:41:10,190 --> 00:41:13,310
And the need for having secure calls.

453
00:41:14,790 --> 00:41:17,810
We need to protect critical infrastructure.

454
00:41:18,270 --> 00:41:19,990
And this is a good way to do it.

455
00:41:22,110 --> 00:41:25,630
That wasn't in response to any question, but I just wanted to add that.

456
00:41:26,590 --> 00:41:30,210
I don't want everybody to just think I do everything for political reasons.

457
00:41:33,310 --> 00:41:34,270
Yeah.

458
00:41:37,940 --> 00:41:41,820
Well, you know, the question is, what's the timing on the release of the source code?

459
00:41:41,820 --> 00:41:43,900
First, there has to be some source code.

460
00:41:44,720 --> 00:41:49,860
What you just didn't see is a demo of my prototype.

461
00:41:49,860 --> 00:41:50,560
It's a prototype.

462
00:41:50,560 --> 00:41:52,440
It's written in Python, you know?

463
00:41:52,440 --> 00:41:54,320
It's not the product.

464
00:41:55,000 --> 00:41:56,240
And it does work.

465
00:41:56,240 --> 00:41:57,520
I swear it works.

466
00:41:57,520 --> 00:41:59,240
It just doesn't work here.

467
00:41:59,240 --> 00:42:05,380
But what I want is a product where you can see.

468
00:42:06,140 --> 00:42:07,620
And there isn't one.

469
00:42:08,320 --> 00:42:11,220
To get one, I'm going to need funding.

470
00:42:11,700 --> 00:42:13,760
So I don't have a timetable for that.

471
00:42:13,760 --> 00:42:16,220
But what I might do, a lot of people have been asking me.

472
00:42:16,220 --> 00:42:21,920
I've gotten a tremendous number of requests to just release the prototype for people to play with.

473
00:42:22,400 --> 00:42:27,120
And for that, I'm looking at... I've got a whole lot of travel in August.

474
00:42:27,780 --> 00:42:30,560
And so I'm going to really try to get it out by the end of August.

475
00:42:30,560 --> 00:42:34,000
I actually considered trying to get it out yesterday for Black Hat.

476
00:42:34,340 --> 00:42:39,560
But I called a law office for... there's a lawyer I'm talking to about the export controls.

477
00:42:39,780 --> 00:42:43,280
Well, I had to file documents with the Commerce Department to tell them about it.

478
00:42:43,280 --> 00:42:46,900
Because, you know, there's still a little tiny bit of export controls left.

479
00:42:46,940 --> 00:42:51,460
I mean, we fought to get rid of the export controls in the 1990s.

480
00:42:51,520 --> 00:42:53,000
And we won.

481
00:42:53,000 --> 00:42:55,200
They got rid of the export controls.

482
00:42:55,340 --> 00:42:56,800
But there's just a little bit left.

483
00:42:57,400 --> 00:43:04,400
The only thing that you're required to do is that you just have to tell them about a product like this.

484
00:43:04,400 --> 00:43:06,120
You don't have to ask their permission.

485
00:43:06,120 --> 00:43:07,520
You just have to inform them.

486
00:43:07,520 --> 00:43:08,520
Well, I've done that.

487
00:43:08,520 --> 00:43:11,460
I've filed documents with them telling them about the product.

488
00:43:11,600 --> 00:43:15,940
But there's one other last vestigial remnant of the export controls.

489
00:43:15,940 --> 00:43:27,600
You're not allowed to export it to about six or seven countries like North Korea and Iran and Sudan and, you know, those countries.

490
00:43:27,600 --> 00:43:29,260
They're the embargoed countries.

491
00:43:29,260 --> 00:43:37,900
And so to put it on a web server, I have to put in special checks to make sure that it's not being downloaded by someone in one of those countries.

492
00:43:38,120 --> 00:43:40,460
And I don't know how to do that.

493
00:43:41,360 --> 00:43:45,520
And so I couldn't figure out how to do it in time for Black Hat yesterday.

494
00:43:45,940 --> 00:43:49,860
If I could have done it in time for Black Hat, you would have been able to download it today.

495
00:43:51,020 --> 00:43:56,280
If anybody wants to give me a hand on that, contact me and I'll put you to work.

496
00:43:57,060 --> 00:43:59,380
There's a lot of Unix weenies in here.

497
00:43:59,680 --> 00:44:06,120
And I'm sure that somebody in here can help me set up a server to do the reverse DNS lookups and all that kind of stuff.

498
00:44:06,880 --> 00:44:09,700
There's even some commercial packages that'll do it for you.

499
00:44:09,700 --> 00:44:11,520
But I don't want to have to pay for them.

500
00:44:16,870 --> 00:44:17,670
Yes?

501
00:44:18,550 --> 00:44:20,290
I've got to yell really loud.

502
00:44:20,290 --> 00:44:27,290
We've got this loud air conditioner and we've got a lawnmower and whatever else is going on.

503
00:44:27,290 --> 00:44:28,770
So I can't really hear you.

504
00:44:30,450 --> 00:44:31,210
Conference calls.

505
00:44:31,210 --> 00:44:32,710
What about conference calls?

506
00:44:35,130 --> 00:44:39,370
Well, in order to do a conference call, you would have to do one of these calls here.

507
00:44:39,370 --> 00:44:44,270
Just take this exact protocol and you'd have to do it between you and a server.

508
00:44:44,270 --> 00:44:49,070
And every other person who participates would all have to do it to the same server.

509
00:44:49,230 --> 00:44:51,350
The server would mix the audio together.

510
00:44:52,570 --> 00:44:54,670
And you've got to trust the server also.

511
00:44:55,270 --> 00:44:57,150
Which isn't so bad, you know.

512
00:45:00,810 --> 00:45:05,110
Now, each person would have a different encrypted Diffie-Hellman exchange.

513
00:45:05,730 --> 00:45:07,670
There would be a different session key.

514
00:45:08,150 --> 00:45:14,990
And the server would just treat them like they were all separate phone calls and then mix the audio together and distribute it back out.

515
00:45:14,990 --> 00:45:17,790
At least that's one way to do it.

516
00:45:25,320 --> 00:45:27,740
Alright, now let's not always see the same hands.

517
00:45:30,700 --> 00:45:32,480
Okay, well maybe I finished early.

518
00:45:34,260 --> 00:45:36,860
If you've got any other questions, you can ask me later.

519
00:45:37,520 --> 00:45:38,500
So what do you think?

520
00:45:38,500 --> 00:45:39,520
Is it going to work?

521
00:45:43,480 --> 00:45:45,960
I'd like to get your opinion about one thing.

522
00:45:45,960 --> 00:45:52,460
Is this going to... do you think that this is a better architecture than the other architectures?

523
00:45:52,460 --> 00:45:56,740
For those of you that have been reading about the encrypted VoIP approaches.

524
00:45:57,980 --> 00:45:59,140
What do you think?

525
00:46:14,230 --> 00:46:16,730
Oh hey, they opened up something in the firewall.

526
00:46:16,730 --> 00:46:18,870
We're going to try one more time to do the demo.

527
00:46:21,230 --> 00:46:22,730
Okay, alright.

528
00:46:25,600 --> 00:46:26,560
Just a minute.

529
00:46:26,560 --> 00:46:31,400
If you want to wait one more time and see another spectacular failure, just wait a second.

530
00:46:34,740 --> 00:46:35,620
What?

531
00:46:47,260 --> 00:46:48,920
Okay, I'm going to try calling them

532
00:47:00,560 --> 00:47:01,000
.

533
00:47:01,220 --> 00:47:02,440
Okay, you ready?

534
00:47:02,640 --> 00:47:03,360
You ready?

535
00:47:04,380 --> 00:47:06,100
Okay, let's see if this works.

536
00:47:16,560 --> 00:47:17,660
I did.

537
00:47:19,320 --> 00:47:21,120
You know, I hit the call button.

538
00:47:21,780 --> 00:47:23,220
We're not getting any evidence that...

539
00:47:25,580 --> 00:47:27,880
Okay, I'm going to hang up.

540
00:47:32,850 --> 00:47:34,310
Oh, incoming call.

541
00:47:36,270 --> 00:47:37,090
Unsecured call.

542
00:47:37,090 --> 00:47:38,070
Hey, it's secure.

543
00:47:38,070 --> 00:47:38,630
Hey!

544
00:47:39,110 --> 00:47:40,790
Look at that, going secure.

545
00:47:40,790 --> 00:47:42,090
But we have no audio.

546
00:47:57,400 --> 00:47:58,240
No audio.

547
00:47:58,240 --> 00:47:59,240
We're not getting any audio.

548
00:47:59,240 --> 00:48:03,520
Okay, what we're going to do is we're going to hold the microphone up to the little tiny speaker on here.

549
00:48:05,460 --> 00:48:07,620
Where's the... okay, yell it.

550
00:48:10,580 --> 00:48:11,420
Yell.

551
00:48:12,940 --> 00:48:14,220
Say something.

552
00:48:19,040 --> 00:48:21,900
I don't hear anything now.

553
00:48:24,420 --> 00:48:27,140
Yeah, okay, yes, there's sound coming out here.

554
00:48:27,540 --> 00:48:29,300
Alright, now listen to this.

555
00:48:29,380 --> 00:48:32,260
You see this secure button, this secure light here?

556
00:48:32,260 --> 00:48:32,940
Watch this.

557
00:48:32,940 --> 00:48:33,940
I'm going to press this.

558
00:48:33,940 --> 00:48:35,800
And this is what a wiretapper hears.

559
00:48:35,800 --> 00:48:38,100
This is a little Easter egg in the program.

560
00:48:38,240 --> 00:48:40,000
Okay, watch.

561
00:48:45,380 --> 00:48:50,260
That's taking the encrypted packets and playing them without decrypting them first.

562
00:48:52,440 --> 00:48:55,000
It sounds like white noise.

563
00:48:56,060 --> 00:48:57,680
I'm going to do that again.

564
00:48:58,280 --> 00:49:00,440
Wiretapper hears this.

565
00:49:01,680 --> 00:49:06,360
And that little staccato, you know, there's a lot of gaps there.

566
00:49:06,360 --> 00:49:09,760
It's because of jitter and bandwidth problems.

567
00:49:11,360 --> 00:49:16,700
Anyway, so encrypted text, encrypted voice sounds like white noise.

568
00:49:17,020 --> 00:49:19,280
So let them eat cipher text.

569
00:49:20,820 --> 00:49:25,660
And we have a go clear button here for the weenies here.

570
00:49:26,540 --> 00:49:30,420
And now it's just like making a normal plain text call.

571
00:49:30,440 --> 00:49:35,380
And if we hit go secure, it goes back to secure mode.

572
00:49:36,340 --> 00:49:39,180
Alright, but I'm sorry we have no audio.

573
00:49:54,420 --> 00:49:57,600
Say something, Steve, say something.

574
00:49:59,020 --> 00:50:01,220
No, no audio, sorry.

575
00:50:01,220 --> 00:50:02,060
No

576
00:50:08,320 --> 00:50:08,840
audio.

577
00:50:25,140 --> 00:50:28,000
Okay, so this is a secure call.

578
00:50:28,000 --> 00:50:30,300
Nobody can listen to this call.

579
00:50:31,620 --> 00:50:32,980
Say something.

580
00:50:34,440 --> 00:50:35,280
Hey, Phil, how you doing?

581
00:50:35,280 --> 00:50:36,600
You look great on TV.

582
00:50:36,900 --> 00:50:41,520
Alright, now I'm going to click that little indicator light that says secure.

583
00:50:41,520 --> 00:50:42,000
Alright

584
00:50:52,870 --> 00:50:55,830
, now we're going to actually...

585
00:50:55,830 --> 00:51:04,410
These buttons here, go clear and go secure, are not necessary in the real product, but we put them in because we're engineers and we like to fool around.

586
00:51:05,230 --> 00:51:07,630
So I'm going to say go secure here.

587
00:51:08,210 --> 00:51:11,630
And it does a little calculation for Diffie-Hellman.

588
00:51:11,650 --> 00:51:16,310
And now that little bong that you just heard is the bong that says you're now secure.

589
00:51:18,090 --> 00:51:18,890
Anyway.

590
00:51:20,090 --> 00:51:20,970
3U8.

591
00:51:21,630 --> 00:51:22,630
Oh, the hashes.

592
00:51:22,630 --> 00:51:24,650
Let's see, is there a man in the middle?

593
00:51:24,710 --> 00:51:27,430
I say 5SZ.

594
00:51:29,050 --> 00:51:29,930
3U8.

595
00:51:30,470 --> 00:51:31,010
3U8.

596
00:51:31,010 --> 00:51:31,790
That's right.

597
00:51:31,790 --> 00:51:33,350
There's no man in the middle.

598
00:51:34,450 --> 00:51:35,230
Alright.

599
00:51:35,750 --> 00:51:36,750
So it's great.

600
00:51:36,750 --> 00:51:39,310
No one knows what we're talking about.

601
00:51:39,410 --> 00:51:41,210
We have a secure call here.

602
00:51:41,210 --> 00:51:43,210
Do you have anything secret you want to tell me?

603
00:51:45,790 --> 00:51:46,530
Alright.

604
00:51:46,530 --> 00:51:47,650
So we're done.

605
00:51:47,650 --> 00:51:50,290
I'm going to hang up and that's it.

606
00:51:50,290 --> 00:51:51,150
See you later.

607
00:51:51,150 --> 00:51:52,050
Thanks, Steve.

608
00:51:53,270 --> 00:51:58,740
Alright, finally, we got it to work.

609
00:51:58,740 --> 00:51:59,940
We got it to work!

610
00:52:00,140 --> 00:52:01,880
I told you it worked.

611
00:52:02,580 --> 00:52:04,500
I wasn't just making this up.

612
00:52:13,420 --> 00:52:16,140
Oh, yeah, you had one more question?

613
00:52:16,860 --> 00:52:17,780
What?

614
00:52:23,300 --> 00:52:25,200
The open-source VoIP we're using...