What are the pros and cons of SIP media encryption types SRTP, ZRTP, and DTLS?

Question

I'm just getting used to SIP for my first time using Linphone. Which encryption is better and why? My Settings > Network > Media Encryption has the options of SRTP, ZRTP, and DTLS.

Answer 1

I hope to keep this as simple as I can. I'll begin with some terms:

1. To establish any kind of SIP call, you first need to talk to the SIP server and well, initialize a session.
2. The call itself happens over a media stream, which may or may not be encrypted and may or may not be proxied by the SIP server depending on what was negotiated and the presence or absence of NAT.

The terms in your dashboard are actually confusing, as you'll see. To secure that media stream you need to exchange a key of some kind and work out if you trust each other and SRTP does not specify how to do this.

One way and the way I have seen used most often is SDES. I suspect what your interface is describing as "SRTP" is in fact "SIP and negotiating keys with SDES and encrypting with SRTP".

Needless to say, to exchange a key using this (simple) mechanism you absolutely have to be talking SIPS (or SIP over TLS). If you are not, or any part of the SIP chain is not, you are in trouble. You are likewise exposed to all drawbacks of TLS in establishing trust (you are reliant on PKI, which you may or may not regard as a good thing).

DTLS is actually DTLS-SRTP. This is another way to negotiate keys but rather than use an extension to SIP to do it, SIP simply indicates the media stream uses DTLS-SRTP and key negotiation happens in the media stream. Key negotiation happens as in TLS and thus relies on PKI.

ZRTP is the same idea and also happens in the media stream, except that rather than rely on TLS for the establishment of keys, Diffie-Hellman key agreement takes place and key verification is done by verifying "fingerprints" in the form of short strings. You can think of this as the voice equivalent of OTR.

Now let us introduce a major gotcha in SRTP - there is a NULL cipher which can be negotiated for "no crypto please" much like the NULL cipher in TLS.

Which to use then. On initial setup, all require you to trust your SIP server to negotiate the call successfully. Thereafter ZRTP will detect any MITM, whereas DTLS versus SDES will not. Of the the other two I would say that DTLS is more secure, since theoretically with key pinning and trust-on-first-use, you could achieve a similar guarantee to ZRTP (and the question of "which is better" becomes "do you trust certificate authorities". You could also potentially use a private PKI with DTLS). In addition, with DTLS, an attacker must compromise both the SIP server to redirect the SRTP stream and provide certificates the peers trust; this may or may not be easy. SDES as described exchanges keys via SIP, which must be entirely trusted.

I would generally say that ZRTP > DTLS > SDES given expected implementations, but the devil is in the detail. For example, can you key pin? Does your software tell you if the NULL cipher is in use? Can you configure your software not to negotiate it?

However, things get more complicated when realities arise. With many VOIP providers you are reliant on their SIP proxies to establish your communication and they may not negotiate the protocol you want. Moreover, media streams can be proxied especially if you are behind NAT and some VOIP software may not understand ZRTP. To this end FreeSwitch has a dedicated option for ZRTP passthru.

So to summarize, it really depends on what is available and what you can negotiate. However, all three result in your media stream being protected by SRTP, which uses AES in counter mode, with truncated HMACSHA1 in Encrypt-then-Mac mode over the packet header including index. The gotcha is that integrity protection might not be used. With the least truncated HMAC for integrity protection I think this would count as "not terrible" but also perhaps not the best.

In short, I would say that:

• ZRTP may be the best choice for small environments or maybe even large ones if the verification step is taken seriously.
• DTLS-SRTP may be a good choice if you configure all devices to trust only a well controlled CA you own. This however means calling out is difficult. If you generally trust CAs, this is a good choice.
• SRTP+SDES requires you definitely trust the SIP server, but if you do then this is OK.

In all cases you need to be sure you are talking to the correct SIP server and doing so securely, especially and critically for the first communication.