From Guardian Project Wiki
Open Secure Telephony Net
- Published Results
- Client Software
- Server Software
- Hosted SIP/VoIP Services
- Useful Resources
All of the necessary technologies and communications standards exist today for voice communications that is as secure as OpenPGP email. In fact, many proprietary and open-source solutions exist for desktop and mobile devices that already implement the necessary bits to provide a solution many times more secure than Skype, and not dependent upon just one global service provider. Yet people who are security-conscious enough to use Skype to secure their computer-based conversations will still hold sensitive discussion on mobile phones. The problem-the need-is usability, simplicity and reliability. This project will provide an application for Android phones that will be only marginally more complex to use than dialing an existing phone number, while still being based entirely on open standards. The app itself is based on existing open-source client code provided by the CSIPSim-ple, SIPCommunicator, PJSip and ZRT4J projects. We will coordinate with a network of au-dited, open service providers around the world who already provide free and commercial service to users, to ensure our users have an automated provisioning process to get connected. The project will interface with projects such as the GNU Free Telephony project to ensure compatible with new standards around peer-to-peer VOIP communication. We will seek inter-operability from other competitive, proprietary solutions from private companies, including WhisperSystems, and propose our implementation become the reference design for privacy and security standards.
Proposed Work Plan
- Real-time voice (VoIP) versus Async Voice (Push-to-talk)
- Is encrypted real-time voice calls the best solution to aim for, or does a push-to-talk model better address issues such as network latency and bandwidth limitations?
- Is pure standards based mobile SIP/VoIP viable as a solution? Do proprietary extensions need to be made to handle low-power modes and background notifications?
- Do encrypted VoIP protocols do anything to obfuscated the type of traffic, such to avoid network fingerprint and filtering of all SIP and VoIP communications?
- How well do public free SIP providers support secure configurations and best practices for protecting user privacy?
- Can VoIP communications be sent over single or multi-hop proxy services?
This work will consist of design a set of criteria for rating the security and privacy capability of various free services and software in order to develop an accurate model of the state of the market and available solutions.
- Audit security state of main free VoIP service providers
- TLS, SRTP, ZRTP capable, VPN capable
- Compatibility with CSipSimple Android open-source client
- Audit, Compare to RedPhone from WhisperSystems
- Interoperability between mobile and desktop clients (Jitsi, Twinkle)
- Audit security state of Freeswitch and Asterisk
Development & Deployment
This work will involve the development of customizations to existing software in order to ensure it is as secured as it can be within its known limits. This includes work on server software, such as Freeswitch, and on client software, such as CSipSimple for Android. All changes will be documented, tested and audited within an initial private testbed of servers. Once a level of stability has been reached, access to this network will be broadened to other qualified users and organizations, all still within the goal of verifying the proposed solutions. In this phase, we will also reach out to other partner testbed and audit projects, including the UC Berkeley DETER testbed, to help better understand how our solution performs in a simulated high-surveillance and filtering environment.
- Deploy small network of server instances
- Create customized turnkey Android client that connect to these servers
- Work with test group of users and organizations to verify from around the globe
The outcome of the auditing and deployment process will be the creation of two sets of documentation, one focused on server providers and organizations that wish to setup their own VoIP infrastructure in a secure best-practices manner. The other for end-user and application developers who want to understand how to properly configure an Android VoIP solution to be secure.
- Create Secure Setup Guides, Recipes, Scripts
- Freeswitch setup with all relevant security default
- CSipSimple Android Setup with all relevant security default
Duration: 6 months - from: October 2011 to March 2012
- Existing software and services will be inspected, tested and vetted
- Development Sprint
- Each sprint will last 6 weeks
- All code will be managed and logged in a public version control system
- User Testing and Design Review
- Promote the current stable release of prototype to a select group of users
- Hold design review meetings with all team, partners and others relevant
- Publishing Papers / Specifications
- Publicly share proposal for any new specifications or services
- Post documentation of best practices determined
|October 1 - December 31, 2011||
Auditing of current solutions, components
Design implementation spec based on audit
Review of spec and planning
|January 1 - March 1, 2012||
Initial Testbed Setup
Android app customization
Server setup scripting
Initial End-User Testing / Feedback
|March 1 - March 31, 2012||
Broader End-User Testing
Create documentation, scripts, recipes and publish, share