Defcon 15 - T203 - The Zfone Project

Defcon 15 - T203 - The Zfone Project

DefCon 15 2007 at the Riviera Hotel and Casino, Las Vegas Defcon 15 - T203 Z-Phone presented by Phillip Zimmermann

duration: 49m:46s

A Pretty Good Way to Foil the NSA

How easy is it for the average internet user to make a phone call secure enough to frustrate the NSA's extrajudicial
surveillance program?

Wired News took Phil Zimmermann's newest encryption software, Zfone, for a test drive and found it's actually quite
easy, even if the program is still in beta.

Zimmermann, the man who released the PGP e-mail encryption program to the world in 1991 -- only to face an
abortive criminal prosecution from the government -- has been trying for 10 years to give the world easy-to-use
software to cloak internet phone calls.

But make no mistake: to eavesdroppers, Zfone is anything but routine. The protocol is based on SRTP, a system that
uses the 256-bit AES cipher and adds to that a 3,000-bit key exchange that produces the codes callers can read off to
one another. It has been submitted to IETF for approval as an internet standard, and by most accounts is strong enough
to defy even the most sophisticated code-breaking technologies, from a hacker's packet sniffer to the acres of
computers beneath Ft. Meade.

That makes Zfone the "most secure telephone system anyone has ever used," according to PGP Corporation's CTO Jon
Callas, who worked with Zimmermann on the protocol.

Q: What is Zfone?

A: Zfone™ is my new secure VoIP phone software which lets you
make secure encrypted phone calls over the Internet. The ZRTP
protocol used by Zfone will soon be integrated into many standalone
secure VoIP clients, but today we have a software product that lets you
turn your existing VoIP client into a secure phone. The current Zfone
software runs in the Internet protocol stack on any Windows XP, Vista,
Mac OS X, or Linux PC, and intercepts and filters all the VoIP packets
as they go in and out of the machine, and secures the call on the fly.
You can use a variety of different software VoIP clients to make a VoIP
call. The Zfone software detects when the call starts, and initiates a
cryptographic key agreement between the two parties, and then
proceeds to encrypt and decrypt the voice packets. It has its own little
separate GUI, telling the user if the call is secure. It's as if Zfone were
a "bump on the cord", sitting between the VoIP client and the Internet.
Think of it as a bump in the protocol stack.

source: http://zfone.com

Technical: This video is mostly audio.