start	end	text
4360	6020	I'm sorry I'm late.
8630	13490	You know, yesterday a lot of people told me I was supposed to speak at 11 o'clock.
14210	19410	And so I didn't actually look on the DEF CON website to see if that was actually true.
20350	22690	So here I am at 11 o'clock.
25010	27050	I'm sorry for the inconvenience.
39080	42500	By the way, I don't mind if anyone takes my photos.
45080	52300	Yeah, either John Callis, John Callis is CTO of PGP, or me, doesn't matter.
52740	54680	We get photoed all the time.
55220	61120	I figure I've already gotten in enough trouble with the Fed so it can't get any worse, right?
70440	72520	Let's see if this comes up. Yep.
72660	76500	Wow, that's a little bit lower resolution than usual, but that's alright.
81060	84040	I'm going to...
87860	89040	Okay.
89040	91640	I'm going to demo my new project today.
91640	94840	My new project is Secure VoIP.
96880	100180	I think it's about time we had Secure VoIP.
100760	103140	How many people here use VoIP?
104100	107520	Oh, you guys are so geeky.
107520	109240	The early adopters.
110300	110920	Um...
112960	113580	Well...
114240	115240	You know...
116140	120760	For years we've enjoyed the relative safety of the public switch telephone network.
120760	122420	I say relative safety.
122420	124940	I'm only speaking relative to the Internet.
125500	132510	Of course, we all know that phone calls on the public switch telephone network can be intercepted.
133720	134340	But...
136120	137820	It's a lot harder to do.
137820	145280	You have to be like the government or somebody who's willing to physically go to a place and clip on some alligator clips.
146840	152320	Or you have to have access to the phone company or the cooperation of the phone company.
152320	169200	But with VoIP, it's possible for somebody in Malaysia to hack into a machine somewhere and install a piece of software that will intercept all the VoIP calls on your network.
169340	172340	And organize them like a TiVo player.
172340	174340	And so...
175780	190920	To move our precious phone calls from the sort of well-manicured neighborhood of the public switch telephone network to the sort of crime-ridden slum that is now the Internet, I think would be unwise without protecting it with encryption.
194540	195100	So...
195100	199380	First I'm going to do a little demo here and then I'm going to explain how it works.
201060	209320	Somewhere in a soundproof booth is an accomplice who will now call me on my VoIP phone.
211880	213980	Steve, call me.
216940	220560	He said he's watching this, so he'll be able to tell.
221180	224180	Yep, here it is. It's ringing. So now I'm going to answer.
225040	228640	This is a regular SIP phone, by the way. You can call any other SIP phone.
229940	231060	Great.
232200	233260	Okay.
235220	237360	I was afraid this would happen.
239700	243420	Let me just say... I'm going to exit and relaunch.
244820	247660	I'm using an open-source VoIP client.
248560	251520	And then I added crypto to it.
251720	257220	And so, there are some issues with the open-source VoIP client that I'm using.
259380	263670	And sometimes it has difficulty with NAT firewall traversal.
265110	267140	Okay, I'm ready again.
267140	270630	Steve, I hope you've exited and relaunched.
272320	274020	Call me again.
278480	279710	What I did was...
280560	286140	You know, many of you are aware of PGP Phone, a project that I did about nine years ago.
286140	288920	At that time, the Internet wasn't ready.
289180	290740	No one had broadband.
290740	294720	There were no protocols that were standardized for VoIP.
294840	296600	SIP wasn't invented yet.
297560	299300	Steve, you're supposed to call me now.
307090	309090	Maybe if I try calling him.
311430	312930	Come on, Steve.
315890	316370	Anyway...
316870	319370	Oh, he's calling me on my cell phone.
319810	320810	To tell me...
323310	324270	Yes?
332170	334250	You had to reboot your machine?
335190	336590	Oh, man.
337350	339730	That would explain a lot. Okay.
342570	343530	Alright.
346170	348510	Okay, I'll leave this open here.
349210	351290	I'm going to put you on the little speakerphone.
352770	358170	Okay, so you just yell into your speakerphone or into your phone whenever you want to talk to me.
361410	363070	Or you could just call me.
364270	365810	Okay, well, anyway...
365810	367530	So, what I did was...
368690	372370	Back in the days of PGP Phone, I had to improvise my own protocols.
372370	374470	There was no SIP, there was no RTP.
374770	377190	It was just the beginnings of RTP at that time.
377190	379210	They were just starting to design it.
379590	384010	And so I had to just sort of improvise my own.
384150	388610	And it wasn't so bad for the time, but the Internet just wasn't ready.
388610	391850	The bandwidth wasn't anywhere near what it had to be.
392230	397550	So, it was a neglected product for many years.
397830	398470	What?
399530	400990	You ready to call?
404700	405660	Okay.
406660	408840	What? Okay. Just call when you're ready.
411240	415940	So, fast forward nine years, and now the Internet is ready for this.
416140	418460	Maybe this is not ready, but...
420820	425960	So, there's still some NAT firewall traversal things in the open source VoIP plan.
425960	430780	I'm using an open source VoIP plan called Stoom, which is written, oddly enough, in Python.
431840	434860	And so, we had to write our crypto in Python.
435340	439260	It's kind of a new experience to do that, to do a secure phone in Python.
439260	441200	Or any kind of SIP phone in Python.
443800	447660	And so, there are some problems with that.
447660	450440	So, this is why... See, I didn't feel I was ready for this.
450460	456320	But, Nico Sell persuaded me to unveil this at the Black Hat conference.
456320	457940	And I said, no, no, I'm not ready.
458140	463400	And so, she kind of, you know, kept pushing me to do it until finally I had to do it.
463400	466280	Because the press started...
466280	467000	What?
469500	470920	Yeah, well, it's not.
474500	476240	I would notice if it was.
477860	479140	Oh, there it is.
479940	481840	By the way, we don't have any audio.
483040	484720	Oh, I didn't plug in the audio.
491380	493780	Oh, it's... Just a minute.
494220	496540	I'm gonna... We're gonna exit now.
498120	499920	This is terribly embarrassing.
500040	503880	This is the... You know, it worked the first time at Black Hat.
504540	506700	When we were on an outside IP address.
506700	508800	We couldn't get it to work inside the firewall.
508800	509340	But...
510340	511920	But we got some...
511920	514280	But we got an outside IP address and it worked.
514300	516200	Okay, now I'm ready, so call me.
517100	518440	Oh, there we go.
522630	523930	Oh, man, this is...
526570	528010	This is not working.
529310	530010	Okay.
530290	532670	You know, the crypto is in pretty good shape.
532670	534770	It's a good thing they gave me an hour to talk, right?
534770	536610	So I can try this several times.
536610	540430	I actually got here a little while ago and I wanted to test and test and test.
540930	544110	But the Ethernet cable for this was right here at the podium.
544110	544930	And so...
545470	547070	I couldn't...
550120	551960	Did you exit and relaunch?
555440	556680	This is why I...
557340	559860	This is why I never use...
559860	563000	Why I never bring a laptop to a talk.
573910	576090	All right, I'm gonna abort this.
576090	578130	I'm just gonna explain how it works.
578270	578930	Goodbye.
580630	581390	Okay.
590180	592900	Now I can get away from the...
610390	611550	I'll just use this one.
612350	613090	Okay.
614950	616090	How humiliating.
616690	619450	You have to believe me that it worked at Black Hat yesterday.
620230	621690	I might try it again.
626940	627900	Oh, yeah?
629440	630580	It's tempting.
631640	634300	If you want to bring it up here, maybe we can try it again.
637880	639840	But do you have broadband?
641360	643260	Okay, that's pretty impressive.
645980	647460	All right.
648920	654380	I looked at various other protocols that are currently being considered for secure VoIP.
655440	661500	There is some IETF RFCs that define various ways of doing it.
661500	671000	Most of them rely on external sources of a centrally controlled public key infrastructure with a certificate authority.
671500	676700	I think that two people who want to talk to each other should not need permission from someone else to do it.
678280	682060	And so I just do like I did with PGP Phone.
682060	684000	I do a Diffie-Hellman key exchange.
691480	692700	Yeah, okay.
692700	704360	I do a Diffie-Hellman key exchange with hash commitment so that this means that I can read an authentication digest aloud that gets displayed.
704360	706540	And the two people read it to each other.
706540	709820	And if it matches, that means there's no man-in-the-middle attack.
710140	716100	This eliminates the need for a certificate authority, a public key infrastructure.
716160	717900	Boy, there's a lot of feedback here.
720940	722560	The other way. Turn it the other way.
734550	737230	Yes, I'm using a Macintosh.
739130	741070	For security reasons.
746220	747340	Yep.
748080	750120	Alright, that's just not going to work.
756520	760940	There are other approaches that don't use a public key infrastructure necessarily.
760940	772240	They send SIP packets that use TLS connections and they put the session key right there in the SIP packet, not encrypted.
772240	774960	They'll just send that, but they'll send it through a TLS connection.
774960	779600	The problem is it's going through multiple TLS connections from server to server to server.
779600	785300	And each one of them, it's decrypted and then re-encrypted in another TLS connection.
785300	792920	So that means that each of those servers has access to the session key and is in a position to compromise the call.
793480	812800	There's another scheme that actually takes the session key, encrypts it as an SMIME email message, and sticks that into the SIP packet and sends that to set up the call.
812800	818760	And the other side receives it, decrypts it like it was a piece of email, extracts the session key, and then uses that.
819440	825180	To use an email encryption standard... I mean, it's bad enough they're not using PGP for that, right?
825460	828500	But even if it was PGP, I would still be complaining.
828780	835140	Because it's just the wrong approach. You don't send an encrypted email to somebody to set up a phone call.
835280	838320	It just feels wrong.
839260	847780	And not only that, but it means that at the end of the call, you have persistent key material around that you can use to retroactively reconstruct the call.
847780	859220	If somebody intercepted the call and recorded all the packets, they would be able to decrypt them after the fact if they could somehow later obtain the key that was sent through the SIP packet.
859960	863000	In other words, it doesn't have perfect forward secrecy.
863780	870100	Well, you know, I just can't imagine designing a secure phone that doesn't have perfect forward secrecy.
871100	877180	Let's see, there's another one that has self-signed certificates, but you have to use a trusted server to get them.
877520	880440	Or you don't know who they are, and it could be a man in the middle.
880840	884760	So all of the other schemes that I looked at have problems.
885600	894020	And almost all the problems come from trying to get somebody else involved in setting up a secure call between Alice and Bob.
894500	896980	And it just seemed the wrong approach.
896980	901740	So with my approach, just the two people are involved.
901760	905320	It doesn't use anything involving another external server.
905320	908860	It doesn't send anything in the SIP packet that relates to the crypto.
908860	917580	Of course, it uses SIP to set up the call, like any SIP phone, but not to set up the encryption, not to set up the key agreement.
919340	929480	Instead, you get the SIP call started, and then the RTP packets start flowing, and then it inserts a Diffie-Hellman exchange in the stream.
930060	937160	Gets the key agreement, and then starts encrypting it using SRTP, secure real-time protocol.
937980	945360	When I first started working on this, I thought I was going to have to encrypt my own packets with my own protocol, like I did with PGP Phone.
945360	953420	But I discovered something called secure RTP, or SRTP, and I read the spec for it, and it looks a lot like PGP Phone.
954020	959600	It encrypts the packets in a manner that is nearly identical to the way it was done in PGP Phone nine years ago.
959600	964720	And I thought, this saves me a lot of trouble. I was going to do it this way already.
964720	973140	So I'm going to use SRTP. This is actually one part of the protocol that is predefined in an RFC.
976100	980460	But I do one more thing that I did not do in PGP Phone.
983440	992240	At the end of the call, I erase all the keys, but I keep a hash of the shared secret that we used.
992240	995900	I keep a hash of it around for the next phone call.
996680	1002260	And then when the next phone call happens, I do a fresh Diffie-Hellman key exchange, like I do with every call,
1002260	1008800	but I also take one more step and mix in the retained shared secret from the last phone call.
1009660	1016980	This means that there is sort of a key continuity model, which Peter Gutman, I see in the audience right here,
1016980	1022540	he has called this the baby duck security model. He was referring to SSH.
1022820	1031100	With SSH, you have an exchange of key material at the first session, and that's locally cached.
1031100	1035720	And you assume that the man in the middle is not present in the first session.
1036080	1040740	And if he's not present in the first session, it's too late for him to get involved in later sessions.
1041280	1043780	Well, that's the same thing I'm using here.
1045120	1052360	So, remember when I said about reading the hash aloud? Unfortunately, I can't show it to you.
1053780	1061600	But, for those of you who have seen secure phones, like Eric Blossom's secure phone from back in the mid-90s,
1061600	1065920	and the AT&T 3600, developed in the early 90s,
1065920	1073760	they all involve displaying a short hash code that you read aloud to the other person to verify there's no man in the middle.
1073780	1083420	Well, if you forget to do that, it's probably okay, because the attacker is afraid that you will do that, and so he won't attack.
1083720	1089960	But, if he knows that you're lazy, he might be tempted to attack, knowing that you might not check it.
1090420	1095340	But suppose you made 100 phone calls to your friend, and you didn't check.
1095340	1103160	You just kept making phone calls, and you just forgot to check, or you were too lazy to check, by reading aloud the authentication digest.
1103860	1110460	Well, if on the 50th call, you suddenly remember that, you know, I really ought to check this,
1110460	1115800	and you read it aloud, and the other person reads it theirs aloud, and it checks, and it compares, and everything is good,
1115800	1122640	it means that not only is this call secure, but every other call, all the way back in the previous 50 calls,
1122640	1128160	to the first call you ever made to him, it proves that all of them were secure.
1128280	1131660	It retroactively proves there was no man in the middle.
1132940	1137760	That's really good for peace of mind. It means that you can be lazy most of the time.
1138280	1146160	And then finally, one day, when you're diligent about it, your diligence assures you that all the other times you were lazy, it was okay.
1146780	1151560	Of course, if it doesn't match, it means that there was a man in the middle all the way back to the beginning of time.
1153600	1156020	That's a real, oh shit, moment, you know.
1160340	1168620	But that's something that other secure phones don't do, and that my protocol does, and so I'm feeling pretty good about that feature.
1170080	1177220	Now, if somebody were to kick the door in, and come in with guns, and pin you against the wall, and take your computer,
1177220	1182380	and suck all the bits out of the computer, they're not going to be able to retroactively reconstruct the call.
1182460	1185360	Not even with the retained shared secrets I just described.
1186020	1191060	Because what doesn't actually retain the shared secret that was used in the call, it hashes it.
1191120	1193260	So you can't go backwards in the hash.
1196480	1199800	I'll be publishing a document describing this protocol.
1200280	1203600	I think this is a better way to do secure void.
1203660	1212440	This is a much better way than the other protocols currently being considered in various IETF RFCs.
1212440	1218420	You know, designs tend to resemble the institutions that give birth to them.
1218660	1233600	And I think that the centrally managed approaches that we're seeing right now sort of reflect the sort of institutional thinking that went into making them.
1233960	1239720	And I tend to be more libertarian in my approach.
1239720	1244200	I'm not a big L libertarian, but I'm a civil libertarian.
1244560	1252200	But it's not only my political instincts, it's also, from a design perspective, simpler.
1252280	1257440	To add a certificate authority to a SIP server adds immense complexity.
1257480	1263500	We've seen many companies go bankrupt in the 1990s trying to build public key infrastructure.
1263860	1269360	There are companies that try to create the technology for building certificate authorities.
1269720	1271280	Those companies are now bankrupt.
1271380	1276560	And sure, you can explain some of that by saying the internet bubble burst, but I don't think it's always from that.
1276560	1280780	Some of them went bankrupt just because of the difficulty of building public key infrastructure.
1280880	1285640	Not only the companies that were providing that technology, but the companies that were trying to use the technology.
1285880	1292820	They didn't go bankrupt necessarily, but their IT departments almost went under trying to deploy public key infrastructure.
1293240	1298780	So I think that if we were to learn from our mistakes, we should stop trying to do it that way.
1298780	1308320	And when we have a new opportunity to deploy something with a new technology like VoIP, the last thing we should do is go back and take a proven technology.
1308320	1317600	When I say proven, I don't mean proven successful. I mean a proven failure of public key infrastructure and try to apply it to VoIP.
1318100	1320660	And so, my design doesn't do that.
1323400	1331780	So, for those of you that would like to see this prototype work better than what we just witnessed,
1333340	1339300	this thing is built around an open source VoIP client called Stoom, written in Python.
1339340	1342460	And if you Google for Stoom, you can find the homepage for it.
1342580	1349720	And for those of you who are Python weenies, if you go out and try to fix the open source VoIP client and make it work on all platforms,
1350660	1360100	PC, Windows platforms too, and get it a little bit more stable, then this thing will benefit from that.
1360200	1371560	All the problems that we just saw relate to the state machine in the VoIP client and how they interact with a firewall.
1373000	1376320	So, I'd like to open it up for questions.
1380800	1381760	Yeah.
1393910	1397950	You're asking me to elaborate on my remark that PKI is a failure.
1398790	1405290	Well, you know, I don't think PKI is completely a failure. I think it's actually worked pretty well for web browsers and web servers.
1405430	1410950	I think SSL connections between your browser and the server seems to work pretty well.
1414030	1416470	But it doesn't work that well for email.
1418530	1424290	Well, the PGP PKI works a lot better for email.
1425270	1431810	But, you know, take S-MIME. S-MIME is widely deployed and is in fact embedded in a lot of Microsoft products.
1431810	1435870	I mean, bundled, I should say, with Microsoft products. And yet no one uses it. Why?
1435870	1440370	Because to make S-MIME work, you have to have a PKI up and running already.
1440370	1442870	So the activation energy is too high.
1443090	1445730	With PGP, you can run right out of the box.
1446850	1450030	You don't need a PKI to be running first.
1450170	1455450	And I think that it would be crazy to try to burden VoIP with that same high activation energy.
1457010	1459850	That's what I mean by PKI is a failure.
1470660	1473840	Well, let's talk about how a man-in-the-middle attack would work.
1476320	1479540	Let's imagine that this was actually in a hardware phone.
1479640	1482900	You had a phone on your desk that did this protocol.
1482900	1485820	And you bought that phone at Walmart for $100.
1487220	1490920	So imagine that your friend also has a phone like that.
1490920	1494720	And you want to call and it sets up a Diffie-Hellman exchange and now you're talking, right?
1494840	1499580	But imagine that an eavesdropper went down to Walmart and bought two of these phones.
1501200	1504840	And brought them home and set up the two phones side by side.
1505060	1510100	And had one of the phones interposed between you and the other person.
1510100	1511540	And the other phone too.
1511540	1518500	So that when you're calling your friend, you're not actually calling your friend, you're calling this eavesdropper's phone right here.
1518500	1519720	The one on the left.
1521240	1529080	And the eavesdropper knows you're going to do this and has your friend's phone number on the speed dial on this phone here on the right.
1529800	1535400	And so when he sees the phone ring and sees that you're calling and you're calling your friend,
1535400	1540720	hits the speed dial, waits for your friend to answer, and as soon as your friend answers, he answers you.
1540720	1545280	And now he's got these two phones and he holds the two phones together like this.
1545780	1548840	So that the earpiece and the mouthpiece are connected.
1549140	1552860	In this kind of sort of lewd and lascivious kind of connection there.
1553340	1560580	And now you think you're talking to your friend, but in fact you're talking to the man in the middle.
1560580	1566300	And the man in the middle can listen in the air gap between the two mouthpieces, whatever.
1566300	1574160	And now notice that the eavesdropper didn't have to have any special knowledge of mathematics.
1574160	1576960	Didn't have to know anything about how Diffie-Hellman works.
1577640	1584480	The only important thing is that there's these two phones that they bought at Walmart, right?
1584560	1587520	And now there's a random session key between you and one of the phones,
1587520	1592000	and there's a different random session key between the other phone and your friend, right?
1592720	1599320	Well, if you could figure out a way of discovering the fact that the two session keys aren't the same,
1599320	1601480	you would know there was a man in the middle.
1602480	1610580	Well, what if the two phones could hash the session key and display that on the little display,
1610580	1612520	and you read it aloud to your friend?
1612580	1616680	Well, they better match, because if they don't match, that means there's a man in the middle.
1617640	1619180	And that's what we do here.
1619580	1620980	Only I couldn't show it to you.
1622180	1625380	It did work yesterday. I swear it worked yesterday.
1625780	1627420	It's worked in a lot of places.
1627820	1632200	But in some places, there's some firewall problems, and I can't get it to work.
1632600	1637540	You know, a lot of the SIP phones out there have difficulty with firewall NAT traversal,
1637540	1640680	but there's better protocols coming out all the time.
1640680	1643660	You know, Skype does overcome these firewall problems,
1643660	1646780	and I think we can overcome them in the SIP world, too.
1649780	1651000	Back there.
1654490	1656590	Could you yell really loud?
1664740	1670580	No, unfortunately, it's written in Python, so it would have to be, you know, sort of refactored into C.
1671880	1676320	The question was, can this code be ported to other open source clients?
1676840	1679520	Yeah, but it has to be rewritten in C.
1679520	1682440	In fact, I'm looking for volunteers to do that.
1685160	1688020	I've actually got a series of products on the roadmap.
1688200	1690420	You know, this is starting out just like PGP.
1690420	1695260	Remember, PGP was started out as a private project without any money, you know.
1695360	1697360	I paid for all this myself.
1697720	1698980	Actually, I did get some help.
1698980	1703640	Jeff Culver, who is well-known in the VoIP world, put in some of his own money, too.
1703720	1706040	But most of it came from me paying.
1706040	1709200	I hired an engineer full-time to work on it for a few months.
1709540	1713100	But I was paying him, you know, really very low wages.
1713800	1718580	And eventually, he had to take a job with a real company that paid him good money.
1719200	1723520	So the development has slowed down.
1723520	1727540	There is some development still going on with it, but it's at a slower pace.
1728880	1731560	And I am going to try to start a company for this.
1731560	1735360	And I'm actually talking to some investors to get some funding for this.
1735780	1740880	And I got funding now from two sources so far.
1740880	1742860	Jeff Culver put some of his own money in.
1743100	1745400	And I got a little bit of money from Dick Clark.
1745960	1748540	I don't mean the guy from American Bandstand.
1748980	1750320	The other Dick Clark.
1751480	1753600	Cyber security czar, you know.
1753600	1758300	He left the Bush White House and wrote a book called Against All Enemies.
1758300	1760880	It's a really good book, but anyway, it's too late now.
1766020	1769020	So I'm going to start a new company and commercialize this.
1769340	1772480	But I will publish the source code, because that's what I did with PGP.
1773100	1775580	And I believe it's necessary to get people to trust it.
1783600	1785120	So, more questions.
1786520	1787260	Yeah.
1792480	1796260	Could you yell really loud? Could you get up and just absolutely yell?
1810550	1812750	You mean the retain shared secrets?
1813310	1815510	You just need a little bit of memory for that.
1824280	1825600	Yeah, okay, yes.
1825600	1829400	You want to be able to take sort of an identity with you from one machine to another.
1829400	1831500	Well, I've thought about doing that.
1831500	1837000	You could put your configuration files in a USB drive and carry that around and copy it.
1837500	1839420	But, I don't know.
1839420	1843260	I think we'd have to do something more elaborate to do what you're talking about.
1843540	1849520	Because, do you really want to copy that onto a computer in a cyber cafe, you know?
1855890	1861390	Well, it's okay, because the first time you call somebody, there isn't any retained shared secrets.
1861390	1864810	So, you just read the hash aloud and it just works.
1865350	1869350	The retained shared secret feature is an extra feature.
1869370	1871010	It kind of makes it nicer.
1871230	1873030	But, it isn't necessary.
1876350	1877490	Yes.
1883160	1884720	Right, yes.
1885200	1888020	That's right. I'm using SHA-256.
1888960	1890760	SHA-256.
1891240	1892380	Yes.
1892380	1898060	And, for the Diffie-Hellman exchange, I'm using a 4000-bit Diffie-Hellman.
1898300	1909340	And, for the block cipher, I'm using AES-256 running in counter mode, as defined by the SRTP protocol.
1911080	1915180	So, I think I'm doing... I picked the right algorithms for this.
1916100	1927810	And, actually, you know, even the collision problems that we've seen in some of the hash functions, I think, are not likely to be exploitable in the particular scenario that we're using them here.
1927970	1930690	Even if I were using one of the weaker hash functions.
1935370	1936790	John, do you want to say anything?
1939070	1949310	Yeah. We've been working with Phil on this, too, and supporting him, and getting him contact with VCs, and I've been cajoling him into demoing at places like this, as well.
1950670	1964830	Okay. I've been saying that, you know, we at PGP have been helping Phil with this, that we've been getting him with VCs, cajoling him to demo the thing, because I believe that getting some exposure to this is going to be important to get it properly funded and out there.
1964830	1975630	The really important thing in what he's doing is that this will go nearly anywhere. I mean, it can go in a handset, it can go in a handheld computer, it can go on a laptop.
1976050	1982790	The protocols are also directly layerable on top of what's going on.
1982790	1991410	Sorry that we don't have a good network here to do the demo, but the system that he's running is an ordinary VoIP phone.
1991410	2000990	You can call any other VoIP phone in the world with it. And it just so happens that if somebody else has one that has this security in there, poof, now all of a sudden you've got a secure phone call.
2000990	2011110	And that's a really important aspect of what this does, because it means that the network effect of getting people to get secure phones is lower.
2011110	2024850	That if you build a infrastructure that is a secure phone infrastructure that doesn't interoperate with regular phones, it makes it increasingly hard for people to go on because they have to make a decision. Do I want secure or do I want easy?
2024850	2034390	Well, this gives you both easy and secure and other things like, you know, that you only really need to do the hash once or maybe even not do that.
2034390	2047790	It's like I make phone calls all the time and I can tell from the person's voice whom I'm talking to. And you know from the sharing shared secret that you are talking to the end point that you were talking to last time.
2048190	2054430	So, you know, if you have anything that tells you that that was a good phone call, you know that you are in the same state you were before.
2054430	2064290	So again, this makes it be very easy and very understandable for people who are not crypto savvy, who are not security savvy. It can be put into all sorts of devices.
2082640	2094260	That's right. The question is, what about a non-technical person using this phone? If your mother wants to use this phone, she doesn't have to read aloud the little hash digits that are displayed.
2094260	2103700	She could just talk on the phone. The protocol would work the same way. The packets going back and forth are still, you know, the same kind of packets.
2103860	2110040	It's just that final check that you do to verify to yourself, to assure yourself that there's no man in the middle, you would skip it.
2110260	2119420	And presumably the man in the middle doesn't know that you're going to be lazy and you're going to skip it. So he's afraid to do his attack. It's an active attack.
2119420	2129860	He has to actually sit in there and generate packets and inject them. He's going to be afraid to do that, because he's afraid he'll be discovered, because maybe your mom isn't as lazy as he thinks.
2132600	2139680	One of the other advantages of this is that you know that if there is anybody listening to a phone call, they've always been there.
2139900	2145640	So this also makes it very difficult for the attacker, because there is no way for them to get in and get out.
2145640	2151760	They have to be in at the beginning and stay in, because the minute they drop out, they are also detected.
2151760	2161820	This is a non-cryptographic security property that is very nice, because it serves as a real deterrent to the attacker. It makes their life really difficult.
2164380	2182840	Yeah. Well, the question is, what happens if you try to call somebody who's using a regular POTS phone on the public switch telephone network?
2184560	2189680	In that case, you would have to go through a gateway that connects the VoIP world to the PSTN world.
2190180	2194560	And that means that you're not going to be able to make it a secure call end-to-end.
2194580	2199380	Now theoretically, at least, you could make it a secure call between your phone and the gateway.
2199620	2208120	Where it touches the PSTN. And then that last mile, hopefully it's only a mile, would be in the clear.
2208500	2213320	But that gets you across the Atlantic, or across national borders.
2217500	2222360	In the worst case, it's no less secure than a regular PSTN call.
2222360	2231620	So that means that the new vulnerabilities that come from being in a VoIP world have been largely solved by this.
2249440	2256940	The question is, the U.S. government is requiring people to put back doors in their VoIP software.
2256940	2259340	I believe you're probably referring to CALEA.
2260220	2273620	Well, they may change the way CALEA works, but I'm not a lawyer, and I don't have the most perfect understanding of this.
2273780	2280140	But my limited understanding of CALEA is that it largely applies to the service providers.
2280220	2286140	It largely applies to the people who have gateways to the PSTN, or the servers.
2286140	2291140	I don't think it applies to end users.
2291880	2299880	So if you're running some software on your laptop computer, and it sets up an encrypted link between you and the other party,
2299880	2306480	without the involvement of the service provider, and you're not going through a gateway to the PSTN,
2306480	2312760	then I'm going to go out on a limb here and suggest that CALEA doesn't apply to that case.
2312760	2317240	Now it's possible that they could change the laws, make it more aggressive.
2317740	2321080	But we'll have to worry about that when that happens.
2330850	2334770	I haven't worked out the protocol to make this an anonymous system.
2338510	2343310	It's peer-to-peer, unless you have to go through a proxy because of some firewall problems.
2346750	2353970	Yeah, probably if you do the anonymous part, you're probably going to sacrifice your man-in-the-middle protection.
2363230	2365950	There's not that much overhead for the encryption.
2366030	2376250	The SRTP adds a little bit of extra to each packet for an HMAC, an authentication code,
2376250	2378350	that gets stuck onto each packet.
2378350	2382650	It's 80 bits long, but it can be shortened to 32 bits.
2383290	2387350	And it's not that much of a bandwidth hit.
2387450	2392890	And the only reason why that's there is actually not to encrypt it, but to authenticate,
2392890	2398170	to prevent someone from sending in packets in a denial-of-service attack,
2398170	2402710	so that the packets can be rejected because they don't authenticate.
2402750	2405510	It's not actually necessary for the encryption.
2406350	2416830	It's necessary, it's part of the extra protection you get from SRTP against a hacker coming in and injecting packets that aren't part of your phone call.
2417930	2419770	I don't know if that's very clear.
2419950	2421930	We can talk about it later if you want more details.
2421930	2426110	Or go ahead and read the spec for SRTP, there's an RFC for it.
2426110	2429730	It'll explain why you want to have that extra stuff.
2433390	2441570	You know, it isn't only political reasons why I'm doing this.
2441570	2443290	It's also business reasons.
2443410	2451010	I think that if we're going to successfully migrate our phone calls to VoIP, to the internet,
2451010	2453050	we're going to need this kind of protection.
2453810	2460390	And in order to make a simpler design, I'm doing it this way.
2461290	2470050	And so it isn't just my instincts for civil liberties, it's also my instincts for simple design.
2470190	2473310	And the need for having secure calls.
2474790	2477810	We need to protect critical infrastructure.
2478270	2479990	And this is a good way to do it.
2482110	2485630	That wasn't in response to any question, but I just wanted to add that.
2486590	2490210	I don't want everybody to just think I do everything for political reasons.
2493310	2494270	Yeah.
2497940	2501820	Well, you know, the question is, what's the timing on the release of the source code?
2501820	2503900	First, there has to be some source code.
2504720	2509860	What you just didn't see is a demo of my prototype.
2509860	2512440	It's a prototype. It's written in Python, you know?
2512440	2514320	It's not the product.
2515000	2517520	And it does work. I swear it works.
2517520	2519240	It just doesn't work here.
2519240	2525380	But what I want is a product where you can see.
2526140	2527620	And there isn't one.
2528320	2531220	To get one, I'm going to need funding.
2531700	2533760	So I don't have a timetable for that.
2533760	2536220	But what I might do, a lot of people have been asking me.
2536220	2541920	I've gotten a tremendous number of requests to just release the prototype for people to play with.
2542400	2547120	And for that, I'm looking at... I've got a whole lot of travel in August.
2547780	2550560	And so I'm going to really try to get it out by the end of August.
2550560	2554000	I actually considered trying to get it out yesterday for Black Hat.
2554340	2559560	But I called a law office for... there's a lawyer I'm talking to about the export controls.
2559780	2563280	Well, I had to file documents with the Commerce Department to tell them about it.
2563280	2566900	Because, you know, there's still a little tiny bit of export controls left.
2566940	2571460	I mean, we fought to get rid of the export controls in the 1990s.
2571520	2573000	And we won.
2573000	2575200	They got rid of the export controls.
2575340	2576800	But there's just a little bit left.
2577400	2584400	The only thing that you're required to do is that you just have to tell them about a product like this.
2584400	2587520	You don't have to ask their permission. You just have to inform them.
2587520	2591460	Well, I've done that. I've filed documents with them telling them about the product.
2591600	2595940	But there's one other last vestigial remnant of the export controls.
2595940	2607600	You're not allowed to export it to about six or seven countries like North Korea and Iran and Sudan and, you know, those countries.
2607600	2609260	They're the embargoed countries.
2609260	2617900	And so to put it on a web server, I have to put in special checks to make sure that it's not being downloaded by someone in one of those countries.
2618120	2620460	And I don't know how to do that.
2621360	2625520	And so I couldn't figure out how to do it in time for Black Hat yesterday.
2625940	2629860	If I could have done it in time for Black Hat, you would have been able to download it today.
2631020	2636280	If anybody wants to give me a hand on that, contact me and I'll put you to work.
2637060	2639380	There's a lot of Unix weenies in here.
2639680	2646120	And I'm sure that somebody in here can help me set up a server to do the reverse DNS lookups and all that kind of stuff.
2646880	2649700	There's even some commercial packages that'll do it for you.
2649700	2651520	But I don't want to have to pay for them.
2656870	2657670	Yes?
2658550	2660290	I've got to yell really loud.
2660290	2667290	We've got this loud air conditioner and we've got a lawnmower and whatever else is going on.
2667290	2668770	So I can't really hear you.
2670450	2672710	Conference calls. What about conference calls?
2675130	2679370	Well, in order to do a conference call, you would have to do one of these calls here.
2679370	2684270	Just take this exact protocol and you'd have to do it between you and a server.
2684270	2689070	And every other person who participates would all have to do it to the same server.
2689230	2691350	The server would mix the audio together.
2692570	2694670	And you've got to trust the server also.
2695270	2697150	Which isn't so bad, you know.
2700810	2705110	Now, each person would have a different encrypted Diffie-Hellman exchange.
2705730	2707670	There would be a different session key.
2708150	2714990	And the server would just treat them like they were all separate phone calls and then mix the audio together and distribute it back out.
2714990	2717790	At least that's one way to do it.
2725320	2727740	Alright, now let's not always see the same hands.
2730700	2732480	Okay, well maybe I finished early.
2734260	2736860	If you've got any other questions, you can ask me later.
2737520	2739520	So what do you think? Is it going to work?
2743480	2745960	I'd like to get your opinion about one thing.
2745960	2752460	Is this going to... do you think that this is a better architecture than the other architectures?
2752460	2756740	For those of you that have been reading about the encrypted VoIP approaches.
2757980	2759140	What do you think?
2774230	2776730	Oh hey, they opened up something in the firewall.
2776730	2778870	We're going to try one more time to do the demo.
2781230	2782730	Okay, alright.
2785600	2791400	Just a minute. If you want to wait one more time and see another spectacular failure, just wait a second.
2794740	2795620	What?
2807260	2821000	Okay, I'm going to try calling them.
2821220	2823360	Okay, you ready? You ready?
2824380	2826100	Okay, let's see if this works.
2836560	2837660	I did.
2839320	2841120	You know, I hit the call button.
2841780	2843220	We're not getting any evidence that...
2845580	2847880	Okay, I'm going to hang up.
2852850	2854310	Oh, incoming call.
2856270	2857090	Unsecured call.
2857090	2858630	Hey, it's secure. Hey!
2859110	2860790	Look at that, going secure.
2860790	2862090	But we have no audio.
2877400	2879240	No audio. We're not getting any audio.
2879240	2883520	Okay, what we're going to do is we're going to hold the microphone up to the little tiny speaker on here.
2885460	2887620	Where's the... okay, yell it.
2890580	2891420	Yell.
2892940	2894220	Say something.
2899040	2901900	I don't hear anything now.
2904420	2907140	Yeah, okay, yes, there's sound coming out here.
2907540	2909300	Alright, now listen to this.
2909380	2912260	You see this secure button, this secure light here?
2912260	2913940	Watch this. I'm going to press this.
2913940	2915800	And this is what a wiretapper hears.
2915800	2918100	This is a little Easter egg in the program.
2918240	2920000	Okay, watch.
2925380	2930260	That's taking the encrypted packets and playing them without decrypting them first.
2932440	2935000	It sounds like white noise.
2936060	2937680	I'm going to do that again.
2938280	2940440	Wiretapper hears this.
2941680	2946360	And that little staccato, you know, there's a lot of gaps there.
2946360	2949760	It's because of jitter and bandwidth problems.
2951360	2956700	Anyway, so encrypted text, encrypted voice sounds like white noise.
2957020	2959280	So let them eat cipher text.
2960820	2965660	And we have a go clear button here for the weenies here.
2966540	2970420	And now it's just like making a normal plain text call.
2970440	2975380	And if we hit go secure, it goes back to secure mode.
2976340	2979180	Alright, but I'm sorry we have no audio.
2994420	2997600	Say something, Steve, say something.
2999020	3001220	No, no audio, sorry.
3001220	3008840	No audio.
3025140	3030300	Okay, so this is a secure call. Nobody can listen to this call.
3031620	3032980	Say something.
3034440	3036600	Hey, Phil, how you doing? You look great on TV.
3036900	3041520	Alright, now I'm going to click that little indicator light that says secure.
3041520	3055830	Alright, now we're going to actually...
3055830	3060250	These buttons here, go clear and go secure, are not necessary in the real product,
3060250	3064410	but we put them in because we're engineers and we like to fool around.
3065230	3067630	So I'm going to say go secure here.
3068210	3071630	And it does a little calculation for Diffie-Hellman.
3071650	3076310	And now that little bong that you just heard is the bong that says you're now secure.
3078090	3078890	Anyway.
3080090	3080970	3U8.
3081630	3084650	Oh, the hashes. Let's see, is there a man in the middle?
3084710	3087430	I say 5SZ.
3089050	3089930	3U8.
3090470	3093350	3U8. That's right. There's no man in the middle.
3094450	3095230	Alright.
3095750	3099310	So it's great. No one knows what we're talking about.
3099410	3101210	We have a secure call here.
3101210	3103210	Do you have anything secret you want to tell me?
3105790	3107650	Alright. So we're done.
3107650	3110290	I'm going to hang up and that's it.
3110290	3111150	See you later.
3111150	3112050	Thanks, Steve.
3113270	3118740	Alright, finally, we got it to work.
3118740	3119940	We got it to work!
3120140	3121880	I told you it worked.
3122580	3124500	I wasn't just making this up.
3133420	3136140	Oh, yeah, you had one more question?
3136860	3137780	What?
3143300	3145200	The open-source VoIP we're using...