Secure Every Conversation
Criptarea vocii protejează conversațiile de interceptare. SRTP pentru media, TLS pentru signaling - security by default.
Encryption Layers
SIP messages (INVITE, BYE, etc.) encrypted with TLS. Protects call setup, metadata, and routing information.
Audio streams encrypted with SRTP (Secure RTP). AES-256 encryption, message authentication.
Encryption keys exchanged via DTLS handshake. Perfect forward secrecy supported.
SRTP (Secure RTP)
How SRTP Works
- 1. Derive encryption keys from DTLS
- 2. Encrypt RTP payload (audio data)
- 3. Add authentication tag (HMAC)
- 4. Protect against replay attacks
SRTP Packet Structure
Encryption Algorithms
| Algorithm | Key Size | Use | Status |
|---|---|---|---|
| AES-256-GCM | 256-bit | SRTP, TLS | Recommended |
| AES-128-CM | 128-bit | SRTP | Supported |
| ChaCha20-Poly1305 | 256-bit | TLS 1.3 | Supported |
| HMAC-SHA1 | 160-bit | SRTP Auth | Legacy |
TLS Configuration
# SIP over TLS (SIPS) configuration sip_transport: tls tls_version: 1.3 tls_cipher_suites: - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 - TLS_AES_128_GCM_SHA256 certificate: cert_file: /etc/ssl/sip.crt key_file: /etc/ssl/sip.key ca_file: /etc/ssl/ca-bundle.crt verify_client: optional min_tls_version: 1.2
Key Exchange Methods
SDES (SDP Security)
Keys exchanged in SDP body. Requires SIP over TLS.
DTLS-SRTP (Recommended)
Keys negotiated via separate DTLS handshake. Independent of signaling.
ZRTP
End-to-end key exchange. No trusted third party needed.
Security Status
WebRTC Encryption
WebRTC mandates encryption - all media is encrypted by default:
Media Encryption
- • SRTP mandatory (not optional)
- • DTLS-SRTP key exchange
- • AES-128 or AES-256
- • Cannot be disabled
Signaling Encryption
- • WSS (WebSocket Secure)
- • TLS 1.2+ required
- • Certificate validation
- • HTTPS only contexts
Common Security Issues
❌ RTP without SRTP
Unencrypted media can be captured and played back. Always use SRTP.
❌ SIP over UDP/TCP
Signaling visible în plaintext. Use TLS for all SIP traffic.
❌ Self-signed Certificates
Vulnerable to MITM attacks. Use CA-signed certificates în production.
❌ Weak Ciphers
Disable TLS 1.0/1.1, RC4, 3DES. Only use modern cipher suites.