May 21st, 2006
PGP Creator Set to Release Free VOIP Encryption Software
By Michael Santo
Contributing Writer, RealTechNews
In 1991 Philip Zimmerman released Pretty Good Privacy, or PGP, for encrypting email. From then until 1996 gained a large following, but the product was also embr0iled in a federal criminal investigation in the United States into whether Zimmerman had violated export restrictions on cryptographic software. IN 1996 the case was dropped and PGP Inc. was born to sell the software.
On Monday, is history about to repeat itself? Zimmerman plans to release a free program for Windows called Zfone that encrypts a computer-to- computer voice conversation so both parties can be confident that no one is listening in. It became available earlier this year to Macintosh and Linux users.
What sets Zfone apart from comparable systems is that it does not require a web of computers to hold the keys, or long numbers, used in most encryption schemes. Instead, it performs the key exchange inside the digital voice channel while the call is being set up, so no third party has the keys.
From the commission’s (FCC) perspective, “you can’t regulate point-to-point communications, which I think will let Phil off the hook,” said Marc Rotenberg, director of the Electronic Privacy Information Center, an advocacy group in Washington.
Zfone may face more of a challenge in Europe, where the British government is preparing to give the police the legal authority to compel both organizations and individuals to disclose encryption keys. Source: The New York Times via IHT
We Say: It’s bound to attract more attention in the much larger space of Windows users, right? Although privacy advocates have been weighing in on this, the real use for the product, Zimmerman believes, is protection of corporate VOIP communications from corporate eavesdroppers. Zfone does not work with Skype, which has its own encryption scheme.
David Johnston says:
This is interesting, though one has to wonder how this will really protect a person if the “keys” are sent as the session is initialized when the government (or hacker) is monitoring *all* of one’s internet/VoIP activity. That seems to be where we’re headed in the US with VoIP.
May 21st, 2006 at 12:28 pm
Tim Pierce says:
What you refer to is known as a “man-in-the-middle” attack — how do you prevent someone positioned between the sender and receiver from grabbing the data (or, in this case, the keys) as they go by? See the Zfone FAQ at http://www.philzimmermann.com/EN/zfone/index-faq.html for some comments about what Phil is doing to guard against MITM attacks.
May 22nd, 2006 at 7:57 am