Today, I published a new Internet-Draft on how to securely communicate over the Internet using a new web technology known as WebRTC and the ZRTP protocol. Using this technique, Internet users can determine if the National Security Agency, or anyone else, is listening in to their calls placed using a web browser. There are already a number of commercial and open source products utilizing ZRTP, including Silent Circle, Jitsi, and others, but this new technique opens it up for all web users.
With WebRTC, all media flows are encrypted and authenticated using Secure RTP or SRTP. Unfortunately, the keying method chosen for WebRTC is DTLS-SRTP or Datagram Transport Layer Security for Secure Real-time Transport Protocol. DTLS-SRTP on its own does not provide protection against Man-in-the-Middle (MitM) attacks, also known as eavesdropping attacks. Today, the news is full of reasons why Internet users need such protection. We now know the surveillance of Internet users is widespread.
The ZRTP security protocol, published as RFC 6189 back in 2011, was invented by Phil Zimmermann to allow Internet users to communicate securely and privately over the Internet. ZRTP was not selected as the default keying method for WebRTC, despite it being the ideal candidate.
How does this work? You’ll have to read the ZRTP specification to find out exactly how, but in simple technical terms, it is because ZRTP uses a technique known as a Diffie-Hellman key exchange augmented with a hash commitment. This allows the SAS, which can be two words or four hex digits, to prove that a media session has no eavesdroppers present.
Everyone needs privacy in their communication, and WebRTC with ZRTP finaly provides a real solution to all Internet users.