Communications Security | Phil Zimmermann | Talks at Google

TL;DR

Phil Zimmermann discusses the need for secure VoIP and the challenges of protecting user privacy in an era of pervasive surveillance.

Transcript

SPEAKER 1: Hello, everyone. Thanks for coming here and for your interest in this talk. As announced via e-mail, today we have as guest at Google Mr. Phil Zimmermann, the creator of PGP and co-creator of Silent Circle and Silent Phone. Hi, Phil. Welcome to Google. How are you? PHIL ZIMMERMANN: I'm good. Yeah. SPEAKER 1: How we got Phil to Google was... Read More

Key Insights

• ❤️‍🩹 End-to-end encryption protocols like ZRTP can protect user privacy from both external surveillance and potential server compromises.
• 🚥 Traffic analysis poses significant challenges and is difficult to defend against effectively.
• 😥 It is crucial for companies to include themselves in the threat model and improve security to the point where they can refuse requests to compromise encryption.

Questions & Answers

Q: How does ZRTP, the protocol developed by Zimmermann, protect against man-in-the-middle attacks?

ZRTP uses a short authentication string and key continuity to ensure that each session key is derived from the previous key, reducing the chances of a successful attack.

Q: How does ZRTP defend against traffic analysis?

Traffic analysis is difficult to defend against, and Zimmermann admits that he doesn't actively try to protect against it. However, he avoids using variable bit-rate codecs to prevent packet length analysis.

Q: What are the challenges of implementing a decentralized system for secure calls and user databases?

While centralized servers are necessary for call setup, they don't need to be involved in the cryptographic negotiation. Key continuity can be used to ensure security even with centralized servers.

Summary & Key Takeaways

• Phil Zimmermann has been working on secure VoIP for over a decade, with a focus on end-to-end encryption and secure messaging.

• He highlights the importance of protecting users from themselves in situations where companies are asked to compromise their own encryption.

• Zimmermann advocates for companies to improve their security to the point where they can refuse requests to compromise encryption.