ZRTP for Telephone.app

[Hans-Christoph Steiner]

Hey Alexei,

I'm a regular user of your very nice Telephone.app. I'm currently
working with Guardian Project, and we are looking for a SIP app that
works well and also supports ZRTP secure communications. We are also
working with csipsimple on Android, which is also based on pjsip.

I have updated Telephone.app to support SIP/TLS, and that is working
well. https://github.com/eighthave/Telephone Next, I would like to
update Telephone.app to support ZRTP just like csipsimple does. The
bulk of this work needs to happen in the pjsip build, but there also
needs to be a minimal UI work.

For ZRTP, there needs to be some notification:

* show whether ZRTP is in use
* show whether the ZRTP session is verified
* show the four letter verification code

That is all the UI that is needed. So the question is now, how to
approach this work?

.hc

[M]

no reply, sad :(

[Robbie]

I am also interested in this.

[Alexei Kuznetsov]

Hi,

I always had plans to implement encryption in Telephone, and now they
are in the top priority. I made a personal research and came to a
conclusion that firstly and most importantly Telephone should have
ZRTP support.

The problem is, PJSIP doesn't implement it, and other projects that
integrated ZRTP with PJSIP were using PJSIP 1.x, but Telephone is now
using the latest PJSIP 2.1. This doesn't mean that ZRTP is not coming,
but that it is probably coming later than it could. Maybe I'll need to
do the integration myself.

TLS for signaling and built-in PJSIP SRTP support will come later, if
ever. Firstly, they don't provide the real end-to-end security. And
secondly, the typical user that has an account at a typical public SIP
provider can't use them anyway. I couldn't find SIP providers
supporting TLS for signaling, and without that SRTP doesn't make
sense.

Alexei

[Sergei Shuykov]

Maybe it's better to revert back to PJSIP 1.X branch and implement zrtp?

PJSIP 2.X main feature is video calls, which is not necessary in current telephone state.

[Alexei Kuznetsov]

I want to move only forward. If PJSIP 1.x is still supported, it won’t be at some point. And if it requires some security or other fix, it’ll be problematic to update it.

Alexei

[Sergei Shuykov]

I guess, when 1.X branch will be dropped, there will be a zrtp implementation for 2.X branch (people will have no choice, or asterisk will implement it).

But it's only my guess as i said.