OSTN

From Guardian Project Wiki

(Difference between revisions)
Jump to: navigation, search
(→Client Software)
(→Client Software)
Line 68: Line 68:
|-
|-
| [[Jitsi]]
| [[Jitsi]]
-
| [[Jitsi]]
+
|  
| open-source
| open-source
| TLS, ZRTP, SRTP
| TLS, ZRTP, SRTP
Line 75: Line 75:
|-
|-
| [[SFLPhone]]
| [[SFLPhone]]
-
| [[SFLPhone]]
+
|  
| open-source
| open-source
| TLS, ZRTP, SRTP
| TLS, ZRTP, SRTP

Revision as of 22:57, 11 April 2012

Contents

Open Secure Telephony Network (OSTN)

We are working to define a defacto standard by which a voice over internet protocol service can be considered end-to-end secured, with verifiable encryption, minimal logging, and a decentralised model of deployment and use. From this standard, we will work to deploy a network of compliant server/service instances and client software, mobile and desktop, that are federated, audited and interoperable.

Summary

All of the necessary technologies and communications standards exist today for voice communications that is as secure as OpenPGP email. Many proprietary and open source solutions exist for desktop and mobile devices that already implement the necessary bits to provide a solution many times more secure than Skype, without dependence upon one global service provider. Yet people who are security conscious enough to use Skype to secure their computer based conversations will still hold sensitive discussion on mobile phones. The problem is simplicity, usability and reliability.

This project will provide an application for Android phones that will be only marginally more complex to use than dialing an existing phone number, while still being based entirely on open standards. The app itself is based on existing open source client code provided by the CSipSimple, pjsip and ZORG projects. We will coordinate with a network of audited, open service providers around the world who already provide free and commercial service to users, to ensure our users have an automated provisioning process to get connected.

OSTN will interface with a variety of projects to ensure compatible with new standards around peer-to-peer VOIP communication. We will seek interoperability from other competitive, proprietary solutions from private companies and propose our implementation become the reference design for privacy and security standards.

Details

Project Output

Client Software

Name OSTN Tutorial License Security Platform Link
Ostel Available GPL TLS, ZRTP, SRTP Android https://ostel.me/
CSipSimple Available GPL TLS, ZRTP, SRTP Android http://nightlies.csipsimple.com/
Twinkle   GPL TLS, ZRTP, SRTP Linux
Telephone    ? in progress MacOS
Groundwire Available closed TLS, ZRTP, SRTP iOS http://itunes.apple.com/us/app/groundwire-business-caliber/id378503081?mt=8
Jitsi   open-source TLS, ZRTP, SRTP Linux, Win, Mac http://jitsi.org/
SFLPhone   open-source TLS, ZRTP, SRTP Linux http://sflphone.org/
PhonerLite   closed TLS, ZRTP, SRTP Windows

Server Software

Hosted SIP/VoIP Services

Service TLS/SSL SRTP ZRTP Personal Info Reqd Data Retention
Ostel.me Yes; RapidSSL RootCA No Yes Email
Tanstagi Yes; Self-signed Yes Yes No
PillowTalk Yes; Self-signed Yes Yes No
Ekiga




IPtel




Callcentric






















Useful Resources

Proposed Work Plan

Research Questions

  1. Real-time voice (VoIP) versus Async Voice (Push-to-talk)
    1. Is encrypted real-time voice calls the best solution to aim for, or does a push-to-talk model better address issues such as network latency and bandwidth limitations?
  2. Is pure standards based mobile SIP/VoIP viable as a solution? Do proprietary extensions need to be made to handle low-power modes and background notifications?
  3. Do encrypted VoIP protocols do anything to obfuscated the type of traffic, such to avoid network fingerprint and filtering of all SIP and VoIP communications?
  4. How well do public free SIP providers support secure configurations and best practices for protecting user privacy?
  5. Can VoIP communications be sent over single or multi-hop proxy services?

Auditing

This work will consist of design a set of criteria for rating the security and privacy capability of various free services and software in order to develop an accurate model of the state of the market and available solutions.

  1. Audit security state of main free VoIP service providers
    1. TLS, SRTP, ZRTP capable, VPN capable
    2. Compatibility with CSipSimple Android open-source client
  2. Audit, Compare to RedPhone from WhisperSystems
  3. Interoperability between mobile and desktop clients (Jitsi, Twinkle)
  4. Audit security state of Freeswitch and Asterisk

Development & Deployment

This work will involve the development of customizations to existing software in order to ensure it is as secured as it can be within its known limits. This includes work on server software, such as Freeswitch, and on client software, such as CSipSimple for Android. All changes will be documented, tested and audited within an initial private testbed of servers. Once a level of stability has been reached, access to this network will be broadened to other qualified users and organizations, all still within the goal of verifying the proposed solutions. In this phase, we will also reach out to other partner testbed and audit projects, including the UC Berkeley DETER testbed, to help better understand how our solution performs in a simulated high-surveillance and filtering environment.

  1. Deploy small network of server instances
  2. Create customized turnkey Android client that connect to these servers
  3. Work with test group of users and organizations to verify from around the globe

Documentation

The outcome of the auditing and deployment process will be the creation of two sets of documentation, one focused on server providers and organizations that wish to setup their own VoIP infrastructure in a secure best-practices manner. The other for end-user and application developers who want to understand how to properly configure an Android VoIP solution to be secure.

  1. Create Secure Setup Guides, Recipes, Scripts
  2. Freeswitch setup with all relevant security default
  3. CSipSimple Android Setup with all relevant security default

Checklist

The process of making the tool public will be documented in a checklist to ensure that all the pieces are finished and ready to be launched.

Timetable

Duration: 6 months - from: October 2011 to March 2012

Task Detail

  1. Auditing
    1. Existing software and services will be inspected, tested and vetted
  2. Development Sprint
    1. Each sprint will last 6 weeks
    2. All code will be managed and logged in a public version control system
  3. User Testing and Design Review
    1. Promote the current stable release of prototype to a select group of users
    2. Hold design review meetings with all team, partners and others relevant
  4. Publishing Papers / Specifications
    1. Publicly share proposal for any new specifications or services
    2. Post documentation of best practices determined


Timeframe Milestone
October 1 - December 31, 2011

Auditing of current solutions, components

Design implementation spec based on audit

Review of spec and planning

January 1 - March 1, 2012

Initial Testbed Setup

Android app customization

Server setup scripting

Initial End-User Testing / Feedback

March 1 - March 31, 2012

Broader End-User Testing

Create documentation, scripts, recipes and publish, share

Retrieved from "http://guardianproject.info/wiki/OSTN"
Personal tools
Namespaces
Variants
Actions
Navigation
Projects
Toolbox