ZRTP: Media Path Key Agreement for Unicast Secure RTP

Abstract

This document defines ZRTP, a protocol for media path Diffie-Hellman exchange to agree on a session key and parameters for establishing unicast Secure Real-time Transport Protocol (SRTP) sessions for Voice over IP (VoIP) applications. The ZRTP protocol is media path keying because it is multiplexed on the same port as RTP and does not require support in the signaling protocol. ZRTP does not assume a Public Key Infrastructure (PKI) or require the complexity of certificates in end devices. For the media session, ZRTP provides confidentiality, protection against man-in-the-middle (MiTM) attacks, and, in cases where the signaling protocol provides end-to-end integrity protection, authentication. ZRTP can utilize a Session Description Protocol (SDP) attribute to provide discovery and authentication through the signaling channel. To provide best effort SRTP, ZRTP utilizes normal RTP/AVP (Audio-Visual Profile) profiles. ZRTP secures media sessions that include a voice media stream and can also secure media sessions that do not include voice by using an optional digital signature.

Multiplexing Scheme Updates for Secure Real-time Transport Protocol (SRTP) Extension for Datagram Transport Layer Security (DTLS)

“…0x000 RFC6189] is a protocol for media path Diffie-Hellman exchange to agree on a session key and parameters for establishing unicast SRTP sessions for Voice over IP (VoIP) applications. The ZRTP protocol is media path keying because it is multiplexed on the same port as RTP and does not require support in the signaling protocol.…”

“…In order to prevent future documents from assigning values from the unused range to a new protocol, this document modifies the [RFC5764] demultiplexing algorithm to properly account for ZRTP [RFC6189] by allocating the values from 16 to 19 for this purpose.…”

Network-Specific Attacks on Diffie-Hellman Key-Exchange in Commercial Protocols

“…The ZRTP [23] was developed by Phil Zimmerman and defines a cryptographic key agreement scheme for VoIP (voice over internet protocol) applications which rely on real-time protocol (RTP) [24]. ZRTP enables two VoIP parties to agree on session key/parameters for establishing secure real-time transport protocol (SRTP) [25].…”

Options for Securing RTP Sessions

“…The receiver of such an identity assertion can then independently verify the user identity to ensure that it is the identity that the receiver intended to communicate with, and that the cryptographic assertion holds; this way, a user can be certain that the application also can't perform a MITM and acquire the keys to the media communication. Other ways of verifying the certificate hashes exist; for example, they could be verified against a hash carried in some out-of-band channel (e.g., compare with a hash printed on a business card) or using a verbal short authentication string (e.g., as in ZRTP [RFC6189]) or using hash continuity.…”