Hugh
February 23rd, 2008, 06:19 PM
PGP Encryption
http://philzimmermann.com/EN/sales/index.html
http://www.pgp.com/products/wholediskencryption/faq.html
General
What is PGP Whole Disk Encryption and why is it important?
PGP Whole Disk Encryption is a solution for protecting all data on an entire desktop, laptop, or removable disk drive. PGP Whole Disk Encryption transparently secures disk contents, including system and temporary files, automatically safeguarding sensitive data from unauthorized access. PGP Whole Disk Encryption provides worry-free protection against unauthorized access of private and confidential data.
What business problem does PGP Whole Disk Encryption solve?
PGP Whole Disk Encryption enables individuals and organizations to secure sensitive data stored on systems or removable media, thereby meeting federal security mandates, partner requirements, and industry best practices for data protection.
How does PGP Whole Disk Encryption work?
The PGP Whole Disk Encryption engine operates at a system level between the operating system and the disk drive, providing user-transparent, sector-by-sector disk encryption and decryption. A successful pre-boot authentication unlocks the decryption key, enabling users to work without any other changes to their experience.
What is the end-user experience?
The only change in the end-user experience with PGP Whole Disk Encryption is the addition of a pre-boot authentication screen. The pre-boot authentication screen protects the system from being accessed by unauthorized users by disabling their ability to attack operating system–level authentication mechanisms. Once the end user provides valid authentication, encryption and decryption of the disk are transparent to both the user and the operating system. The pre-boot authentication passphrase can be synchronized with the Windows logon, enabling Windows users to be automatically logged into their system without requiring additional passphrases or user actions.
What’s new in PGP Whole Disk Encryption 9.8?
Expanded client controls – Enable the organization to better meet security requirements by locking down which features are enabled, visible to the user, and enforced.*
Enhanced status reporting – Enables inspection and reporting on the state of disk encryption in the organization to satisfy regulatory requirements and help prevent a data breach.*
Increased authentication options – Perform pre-boot authentication using smart cards such as the RSA SID800.
Trusted Platform Module (TPM) support – Protects encryption keys against unauthorized access.
Rapid deployment process – Speeds deployment by automating the installation and configuration process.
* Requires PGP Universal Server 2.8
How does PGP Whole Disk Encryption fit into the PGP Encryption Platform?
As a PGP Encryption Platform–enabled application, PGP Whole Disk Encryption leverages PGP Universal Server users, keys, and configurations. Deploying one enterprise encryption application, such as PGP Whole Disk Encryption, automatically delivers the PGP Encryption Platform, allowing organizations to quickly deploy new applications such as secure messaging or network file sharing security within the organization. PGP Encryption Platform–enabled applications can be used together to provide multiple layers of security, all administered from a single, consolidated management console using centralized policy and configurations.
Features
Does PGP Whole Disk Encryption provide automatic and transparent data encryption to the end user?
Yes. PGP Whole Disk Encryption automatically encrypts the entire contents of the hard disk in the background and is transparent to the end user.
Does PGP Whole Disk Encryption provide complete disk and removable media encryption?
Yes. PGP Whole Disk Encryption provides complete disk and removable media encryption.
Does PGP Whole Disk Encryption provide encryption of individual partitions?
Yes. PGP Whole Disk Encryption 9.8 provides encryption for individual partitions on fixed or removable drives. This feature enables users to encrypt the entire contents of a disk or encrypt only selected partitions. PGP Virtual Disk can be used to create encrypted virtual volumes, providing an additional layer of security for powered-on systems.
Can PGP Whole Disk Encryption and PGP Virtual Disk encryption be used at the same time?
Yes. PGP Virtual Disk can be used with PGP Whole Disk Encryption when encrypted files/folders are needed to protect data. For example, PGP Virtual Disk can be used to secure confidential data on multi-user shared systems protected with PGP Whole Disk Encryption, allowing individuals to ensure the privacy of their work on shared systems.
What performance impact should be expected when PGP Whole Disk Encryption is in use?
Once the hard drive is encrypted, the performance impact of PGP Whole Disk Encryption is negligible. Some users may notice a performance impact during the initial encryption process; however, this is a one-time-only event during which all current-generation PCs will perform normally, although disk-intensive computing processes may take slightly longer. The initial encryption process can be suspended at any time to complete time-sensitive or disk-intensive tasks.
Does PGP Whole Disk Encryption allow encrypted data to be recovered if the key or passphrase is lost?
Yes. In a managed deployment, PGP Whole Disk Encryption allows users to regain access to their systems in the event the key stored on an Aladdin eToken Pro USB token or passphrase used for authentication is lost or forgotten. In such cases, PGP Whole Disk Encryption administrators issue a one-time-use recovery passphrase that allows users to regain access. Once the recovery passphrase is used, it is no longer valid and a new recovery passphrase is created for future use.
Does PGP Whole Disk Encryption enable users to have separate accounts, regardless of the number of users?
Yes. PGP Whole Disk Encryption provides the capability to have up to 28 separate user accounts on a single system.
Does PGP Whole Disk Encryption require authentication for access to all encrypted data?
Yes. PGP Whole Disk Encryption requires authentication via either a passphrase or USB token prior to granting access to the encrypted disks.
Does PGP Whole Disk Encryption prevent unauthorized access to encrypted data?
Yes. Only users with either the proper hardware token and/or passphrase can access encrypted data.
Technical
What operating systems are supported?
PGP Whole Disk Encryption supports the following operating systems:
Windows Vista (all 32-bit and 64-bit versions)
Windows Server 2003 (SP1)*
Windows XP (SP1 or SP2)
Windows XP Tablet PC Edition 2005 (keyboard required)
Windows 2000 (SP4)
Mac OS X 10.4.x and 10.5.x (Non-boot disks only – Intel & PPC)
* Full disk encryption functionality is not supported on Windows 2000 Server or Windows 2003 Server.
Does PGP Whole Disk Encryption store keys and passphrases in an encrypted format?
Yes. PGP Whole Disk Encryption stores all keys and passwords in an encrypted format.
Does PGP Whole Disk Encryption provide pre-boot authentication?
Yes. A PGP Whole Disk Encryption user will be prompted to enter either a passphrase or hardware token to unlock the encrypted disk.
Does PGP Whole Disk Encryption support screen saver functionality?
Yes. PGP Whole Disk Encryption is fully compatible with screen savers.
Does PGP Whole Disk Encryption support standby and hibernation modes?
Yes. At any time, even during initial hard drive encryption, a user may shut down the system or place it into standby or hibernation mode. When the system is shut down or placed in hibernation mode, a user must re-authenticate to PGP Whole Disk Encryption to access the system. If an initial drive encryption was in progress, it will be immediately resumed following successful authentication.
Does PGP Whole Disk Encryption provide the ability to use logon tokens?
Yes. PGP Whole Disk Encryption provides the ability to use hardware-based tokens such as the Aladdin eToken Pro USB token.
Does PGP Whole Disk Encryption provide the ability to use USB tokens for logon?
Yes. PGP Whole Disk Encryption currently provides support for the Aladdin eToken Pro USB token.
Does PGP Whole Disk Encryption provide the ability to use smart cards for logon?
No. PGP Whole Disk Encryption currently does not support smart cards during the login process. However, PGP Whole Disk Encryption does provide the ability to use hardware-based tokens such as the Aladdin eToken Pro USB token.
Does PGP Whole Disk Encryption support certificates for pre-boot authentication?
Yes. PGP Whole Disk Encryption supports certificate-based pre-boot authentication certificates as long as the certificate used is on a supported USB token. Any key or certificate can be used for non-boot volumes or flash drives. When not used for boot-level security, a token is not required to use a key or certificate.
Interoperability
Does PGP Whole Disk Encryption interfere with other systems or application software?
No. Both PGP Whole Disk Encryption and PGP Virtual Disk encryption operate transparently and do not interfere with the operating system or other application software.
Is PGP Whole Disk Encryption compatible with dual-boot environments?
Yes. PGP Whole Disk Encryption provides partition-level encryption, making it compatible with dual-boot environments with multi-partition disks that use different operating systems on each partition.
Does PGP Whole Disk Encryption work in conjunction with single sign-on solutions?
Yes: PGP Whole Disk Encryption can automatically synchronize with existing Windows account passwords, providing the user with a single sign-on solution for logging into Windows.
Does PGP Whole Disk Encryption support the Advanced Encryption Standard (AES) algorithm?
Yes. PGP Whole Disk Encryption supports AES 256.
Does PGP Whole Disk Encryption integrate with LDAP directories?
Yes. PGP Whole Disk Encryption is compatible with Microsoft Active Directory 2000 and Microsoft Active Directory 2003.
Does PGP Whole Disk Encryption work with systems management tools?
Yes. PGP Whole Disk Encryption is compatible with system management tools such as Microsoft SMS that support Microsoft MSI installers.
Management
How much administration does PGP Whole Disk Encryption require?
Very little. Once PGP Whole Disk Encryption is deployed, defined security policies are automatically enforced. User group management can be further automated by integrating PGP Whole Disk Encryption with Microsoft Active Directory.
Can encryption of disks and removable media be enforced by policy?
Yes. When PGP Whole Disk Encryption is deployed with PGP Universal Server, administrators can force encryption of disks and removable media by policy.
Can a rollout of PGP Whole Disk Encryption be automated?
Yes. Distribution and installation of the PGP Whole Disk Encryption MSI installer can be performed using systems management tools such as Microsoft SMS. Initial enrollment of users into the system is automated using email or LDAP-based authentication. Once PGP Whole Disk Encryption is installed, policy updates are automatically distributed to installed end-user systems.
Can email encryption be added to PGP Whole Disk Encryption?
Yes. To add gateway-based or end-to-end email encryption, PGP Whole Disk Encryption customers can simply purchase the respective email encryption license. Please contact a PGP sales representative for more information.
Encryption Software May Halt Wire Tapping
The creator of the most popular e-mail encryption program has a new application for Voice-over-Internet-Protocol phone calls.
Phil Zimmermann, creator of the Pretty Good Privacy (PGP) e-mail encryption software, wants to bring a similar level of security to phone conversations. A decade after U.S. Customs investigated him for allegedly violating export restrictions on cryptographic software (when PGP began to spread worldwide), Zimmermann has released encryption software, called Zfone, that makes it impossible for eavesdroppers to listen in on Voice-over-Internet-protocol (VoIP) phone calls.
VoIP encryption isn't new -- Skype, the most popular VoIP service uses encryption -- but Zimmermann's software issues encryption keys that bypass the servers routing Internet calls and sets up the encryption directly on the voice channel. That added layer of protection means even if someone can access the server that routes a call, there's no way to decrypt the call's contents.
With the ongoing controversy over the National Security Agency's program to collect information about phone calls made by Americans, privacy advocates are becoming increasingly concerned about the government's access to citizen's information. Thus, Zimmermann's software has serious implications, particularly for those involved with national security, since it could pose a technical challenge to the laws that currently allow the government to access information held by phone and VoIP service providers.
Technology Review: How does Zfone work?
Phil Zimmermann: Zfone is the software that implements my new encryption protocol, called ZRTP, in a certain way. Zfone is not a VoIP client; it watches for the packets of Internet data going in and out of the machine and looks for ones that are VoIP related. Upon detection of a VoIP call, it intercedes to encrypt the call by setting up a key agreement in the media stream and encrypts the packets of voice data. As time goes on, you'll start to see ZRTP inside VoIP clients. I have a software development kit that people can stick in their VoIP clients.
TR: How is Zfone different from most VoIP encryption schemes?
PZ: The other approaches all require the involvement of servers -- and some of them are egregiously insecure. To understand how they work, you need to understand how VoIP works. At the beginning of a call, a couple of packets go in between you and your server and say "Here I am. Here's my IP address." When I call you, my server knows where to call and sends packets to your server. Then the servers allow us to send voice packets directly to each other. They're involved at the beginning and get out of the way.
In one encryption scheme, the key that encrypts and decrypts your voice packets is sent to your server, which sends it to my server, which then sends it to me, and then we talk using that encrypted channel. Unfortunately, now the servers know the sessions key, so what if I live in China and my service provider [that owns the servers] is in China? The Chinese government is going to know the key and they can wiretap the call. If you trust the service providers, then fine, no problem. But the people that operate the servers don't necessarily have in mind the best interests of the people who use them.
I'm the only one who does it through the voice stream. The voice packets already flow and I jump in there and put in special packets that negotiate all the keys between the two parties. The servers are not involved in any way in the process.
TR: Skype, the most popular VoIP client, already has encryption software, so why doesn't Zfone work with Skype?
PZ: Skype is not compliant with VoIP standards; they have a closed protocol. Skype uses its own encryption software and it doesn't tell anyone how it works. I prefer to use encryption that is open; I publish my source code.
TR: Who would use this VoIP encryption software?
PZ: Who wouldn't use this? Who wants to not be wiretapped? I'm not talking about wiretap from law enforcement -- I'm talking about wiretap from organized crime. Organized crime is doing phishing attacks and taking over your computer with hostile software. I'm making the prediction that those same criminals will attack VoIP when it gets big enough. It could be point-and-click wiretapping from the other side of the world.
TR: With your e-mail encryption software, you were under a criminal investigation by the U.S. government, which alleged that you violated export restrictions for cryptographic software. The case was eventually dropped, but how do you plan to avoid such a complication this time around?
PZ: This time I'm being careful about getting good legal advice and following export controls. I've filled out the paperwork and filed with the U.S. Commerce Department. I'm getting things back that clear it for export. I'm being very careful this time.
TR: Your software release is timely in light of the ongoing news about NSA's program to collect information about phone calls in the United States. Could you discuss the tension between technology and the law, especially when it comes to emerging forms of communication and keeping information safe and private?
PZ: I don't see this as a black-and-white situation. I sympathize with the need for NSA to catch the bad guys, and I want them to catch these bad guys. But we have to be careful about creating surveillance machinery that may be used for other purposes later.
http://philzimmermann.com/EN/sales/index.html
http://www.pgp.com/products/wholediskencryption/faq.html
General
What is PGP Whole Disk Encryption and why is it important?
PGP Whole Disk Encryption is a solution for protecting all data on an entire desktop, laptop, or removable disk drive. PGP Whole Disk Encryption transparently secures disk contents, including system and temporary files, automatically safeguarding sensitive data from unauthorized access. PGP Whole Disk Encryption provides worry-free protection against unauthorized access of private and confidential data.
What business problem does PGP Whole Disk Encryption solve?
PGP Whole Disk Encryption enables individuals and organizations to secure sensitive data stored on systems or removable media, thereby meeting federal security mandates, partner requirements, and industry best practices for data protection.
How does PGP Whole Disk Encryption work?
The PGP Whole Disk Encryption engine operates at a system level between the operating system and the disk drive, providing user-transparent, sector-by-sector disk encryption and decryption. A successful pre-boot authentication unlocks the decryption key, enabling users to work without any other changes to their experience.
What is the end-user experience?
The only change in the end-user experience with PGP Whole Disk Encryption is the addition of a pre-boot authentication screen. The pre-boot authentication screen protects the system from being accessed by unauthorized users by disabling their ability to attack operating system–level authentication mechanisms. Once the end user provides valid authentication, encryption and decryption of the disk are transparent to both the user and the operating system. The pre-boot authentication passphrase can be synchronized with the Windows logon, enabling Windows users to be automatically logged into their system without requiring additional passphrases or user actions.
What’s new in PGP Whole Disk Encryption 9.8?
Expanded client controls – Enable the organization to better meet security requirements by locking down which features are enabled, visible to the user, and enforced.*
Enhanced status reporting – Enables inspection and reporting on the state of disk encryption in the organization to satisfy regulatory requirements and help prevent a data breach.*
Increased authentication options – Perform pre-boot authentication using smart cards such as the RSA SID800.
Trusted Platform Module (TPM) support – Protects encryption keys against unauthorized access.
Rapid deployment process – Speeds deployment by automating the installation and configuration process.
* Requires PGP Universal Server 2.8
How does PGP Whole Disk Encryption fit into the PGP Encryption Platform?
As a PGP Encryption Platform–enabled application, PGP Whole Disk Encryption leverages PGP Universal Server users, keys, and configurations. Deploying one enterprise encryption application, such as PGP Whole Disk Encryption, automatically delivers the PGP Encryption Platform, allowing organizations to quickly deploy new applications such as secure messaging or network file sharing security within the organization. PGP Encryption Platform–enabled applications can be used together to provide multiple layers of security, all administered from a single, consolidated management console using centralized policy and configurations.
Features
Does PGP Whole Disk Encryption provide automatic and transparent data encryption to the end user?
Yes. PGP Whole Disk Encryption automatically encrypts the entire contents of the hard disk in the background and is transparent to the end user.
Does PGP Whole Disk Encryption provide complete disk and removable media encryption?
Yes. PGP Whole Disk Encryption provides complete disk and removable media encryption.
Does PGP Whole Disk Encryption provide encryption of individual partitions?
Yes. PGP Whole Disk Encryption 9.8 provides encryption for individual partitions on fixed or removable drives. This feature enables users to encrypt the entire contents of a disk or encrypt only selected partitions. PGP Virtual Disk can be used to create encrypted virtual volumes, providing an additional layer of security for powered-on systems.
Can PGP Whole Disk Encryption and PGP Virtual Disk encryption be used at the same time?
Yes. PGP Virtual Disk can be used with PGP Whole Disk Encryption when encrypted files/folders are needed to protect data. For example, PGP Virtual Disk can be used to secure confidential data on multi-user shared systems protected with PGP Whole Disk Encryption, allowing individuals to ensure the privacy of their work on shared systems.
What performance impact should be expected when PGP Whole Disk Encryption is in use?
Once the hard drive is encrypted, the performance impact of PGP Whole Disk Encryption is negligible. Some users may notice a performance impact during the initial encryption process; however, this is a one-time-only event during which all current-generation PCs will perform normally, although disk-intensive computing processes may take slightly longer. The initial encryption process can be suspended at any time to complete time-sensitive or disk-intensive tasks.
Does PGP Whole Disk Encryption allow encrypted data to be recovered if the key or passphrase is lost?
Yes. In a managed deployment, PGP Whole Disk Encryption allows users to regain access to their systems in the event the key stored on an Aladdin eToken Pro USB token or passphrase used for authentication is lost or forgotten. In such cases, PGP Whole Disk Encryption administrators issue a one-time-use recovery passphrase that allows users to regain access. Once the recovery passphrase is used, it is no longer valid and a new recovery passphrase is created for future use.
Does PGP Whole Disk Encryption enable users to have separate accounts, regardless of the number of users?
Yes. PGP Whole Disk Encryption provides the capability to have up to 28 separate user accounts on a single system.
Does PGP Whole Disk Encryption require authentication for access to all encrypted data?
Yes. PGP Whole Disk Encryption requires authentication via either a passphrase or USB token prior to granting access to the encrypted disks.
Does PGP Whole Disk Encryption prevent unauthorized access to encrypted data?
Yes. Only users with either the proper hardware token and/or passphrase can access encrypted data.
Technical
What operating systems are supported?
PGP Whole Disk Encryption supports the following operating systems:
Windows Vista (all 32-bit and 64-bit versions)
Windows Server 2003 (SP1)*
Windows XP (SP1 or SP2)
Windows XP Tablet PC Edition 2005 (keyboard required)
Windows 2000 (SP4)
Mac OS X 10.4.x and 10.5.x (Non-boot disks only – Intel & PPC)
* Full disk encryption functionality is not supported on Windows 2000 Server or Windows 2003 Server.
Does PGP Whole Disk Encryption store keys and passphrases in an encrypted format?
Yes. PGP Whole Disk Encryption stores all keys and passwords in an encrypted format.
Does PGP Whole Disk Encryption provide pre-boot authentication?
Yes. A PGP Whole Disk Encryption user will be prompted to enter either a passphrase or hardware token to unlock the encrypted disk.
Does PGP Whole Disk Encryption support screen saver functionality?
Yes. PGP Whole Disk Encryption is fully compatible with screen savers.
Does PGP Whole Disk Encryption support standby and hibernation modes?
Yes. At any time, even during initial hard drive encryption, a user may shut down the system or place it into standby or hibernation mode. When the system is shut down or placed in hibernation mode, a user must re-authenticate to PGP Whole Disk Encryption to access the system. If an initial drive encryption was in progress, it will be immediately resumed following successful authentication.
Does PGP Whole Disk Encryption provide the ability to use logon tokens?
Yes. PGP Whole Disk Encryption provides the ability to use hardware-based tokens such as the Aladdin eToken Pro USB token.
Does PGP Whole Disk Encryption provide the ability to use USB tokens for logon?
Yes. PGP Whole Disk Encryption currently provides support for the Aladdin eToken Pro USB token.
Does PGP Whole Disk Encryption provide the ability to use smart cards for logon?
No. PGP Whole Disk Encryption currently does not support smart cards during the login process. However, PGP Whole Disk Encryption does provide the ability to use hardware-based tokens such as the Aladdin eToken Pro USB token.
Does PGP Whole Disk Encryption support certificates for pre-boot authentication?
Yes. PGP Whole Disk Encryption supports certificate-based pre-boot authentication certificates as long as the certificate used is on a supported USB token. Any key or certificate can be used for non-boot volumes or flash drives. When not used for boot-level security, a token is not required to use a key or certificate.
Interoperability
Does PGP Whole Disk Encryption interfere with other systems or application software?
No. Both PGP Whole Disk Encryption and PGP Virtual Disk encryption operate transparently and do not interfere with the operating system or other application software.
Is PGP Whole Disk Encryption compatible with dual-boot environments?
Yes. PGP Whole Disk Encryption provides partition-level encryption, making it compatible with dual-boot environments with multi-partition disks that use different operating systems on each partition.
Does PGP Whole Disk Encryption work in conjunction with single sign-on solutions?
Yes: PGP Whole Disk Encryption can automatically synchronize with existing Windows account passwords, providing the user with a single sign-on solution for logging into Windows.
Does PGP Whole Disk Encryption support the Advanced Encryption Standard (AES) algorithm?
Yes. PGP Whole Disk Encryption supports AES 256.
Does PGP Whole Disk Encryption integrate with LDAP directories?
Yes. PGP Whole Disk Encryption is compatible with Microsoft Active Directory 2000 and Microsoft Active Directory 2003.
Does PGP Whole Disk Encryption work with systems management tools?
Yes. PGP Whole Disk Encryption is compatible with system management tools such as Microsoft SMS that support Microsoft MSI installers.
Management
How much administration does PGP Whole Disk Encryption require?
Very little. Once PGP Whole Disk Encryption is deployed, defined security policies are automatically enforced. User group management can be further automated by integrating PGP Whole Disk Encryption with Microsoft Active Directory.
Can encryption of disks and removable media be enforced by policy?
Yes. When PGP Whole Disk Encryption is deployed with PGP Universal Server, administrators can force encryption of disks and removable media by policy.
Can a rollout of PGP Whole Disk Encryption be automated?
Yes. Distribution and installation of the PGP Whole Disk Encryption MSI installer can be performed using systems management tools such as Microsoft SMS. Initial enrollment of users into the system is automated using email or LDAP-based authentication. Once PGP Whole Disk Encryption is installed, policy updates are automatically distributed to installed end-user systems.
Can email encryption be added to PGP Whole Disk Encryption?
Yes. To add gateway-based or end-to-end email encryption, PGP Whole Disk Encryption customers can simply purchase the respective email encryption license. Please contact a PGP sales representative for more information.
Encryption Software May Halt Wire Tapping
The creator of the most popular e-mail encryption program has a new application for Voice-over-Internet-Protocol phone calls.
Phil Zimmermann, creator of the Pretty Good Privacy (PGP) e-mail encryption software, wants to bring a similar level of security to phone conversations. A decade after U.S. Customs investigated him for allegedly violating export restrictions on cryptographic software (when PGP began to spread worldwide), Zimmermann has released encryption software, called Zfone, that makes it impossible for eavesdroppers to listen in on Voice-over-Internet-protocol (VoIP) phone calls.
VoIP encryption isn't new -- Skype, the most popular VoIP service uses encryption -- but Zimmermann's software issues encryption keys that bypass the servers routing Internet calls and sets up the encryption directly on the voice channel. That added layer of protection means even if someone can access the server that routes a call, there's no way to decrypt the call's contents.
With the ongoing controversy over the National Security Agency's program to collect information about phone calls made by Americans, privacy advocates are becoming increasingly concerned about the government's access to citizen's information. Thus, Zimmermann's software has serious implications, particularly for those involved with national security, since it could pose a technical challenge to the laws that currently allow the government to access information held by phone and VoIP service providers.
Technology Review: How does Zfone work?
Phil Zimmermann: Zfone is the software that implements my new encryption protocol, called ZRTP, in a certain way. Zfone is not a VoIP client; it watches for the packets of Internet data going in and out of the machine and looks for ones that are VoIP related. Upon detection of a VoIP call, it intercedes to encrypt the call by setting up a key agreement in the media stream and encrypts the packets of voice data. As time goes on, you'll start to see ZRTP inside VoIP clients. I have a software development kit that people can stick in their VoIP clients.
TR: How is Zfone different from most VoIP encryption schemes?
PZ: The other approaches all require the involvement of servers -- and some of them are egregiously insecure. To understand how they work, you need to understand how VoIP works. At the beginning of a call, a couple of packets go in between you and your server and say "Here I am. Here's my IP address." When I call you, my server knows where to call and sends packets to your server. Then the servers allow us to send voice packets directly to each other. They're involved at the beginning and get out of the way.
In one encryption scheme, the key that encrypts and decrypts your voice packets is sent to your server, which sends it to my server, which then sends it to me, and then we talk using that encrypted channel. Unfortunately, now the servers know the sessions key, so what if I live in China and my service provider [that owns the servers] is in China? The Chinese government is going to know the key and they can wiretap the call. If you trust the service providers, then fine, no problem. But the people that operate the servers don't necessarily have in mind the best interests of the people who use them.
I'm the only one who does it through the voice stream. The voice packets already flow and I jump in there and put in special packets that negotiate all the keys between the two parties. The servers are not involved in any way in the process.
TR: Skype, the most popular VoIP client, already has encryption software, so why doesn't Zfone work with Skype?
PZ: Skype is not compliant with VoIP standards; they have a closed protocol. Skype uses its own encryption software and it doesn't tell anyone how it works. I prefer to use encryption that is open; I publish my source code.
TR: Who would use this VoIP encryption software?
PZ: Who wouldn't use this? Who wants to not be wiretapped? I'm not talking about wiretap from law enforcement -- I'm talking about wiretap from organized crime. Organized crime is doing phishing attacks and taking over your computer with hostile software. I'm making the prediction that those same criminals will attack VoIP when it gets big enough. It could be point-and-click wiretapping from the other side of the world.
TR: With your e-mail encryption software, you were under a criminal investigation by the U.S. government, which alleged that you violated export restrictions for cryptographic software. The case was eventually dropped, but how do you plan to avoid such a complication this time around?
PZ: This time I'm being careful about getting good legal advice and following export controls. I've filled out the paperwork and filed with the U.S. Commerce Department. I'm getting things back that clear it for export. I'm being very careful this time.
TR: Your software release is timely in light of the ongoing news about NSA's program to collect information about phone calls in the United States. Could you discuss the tension between technology and the law, especially when it comes to emerging forms of communication and keeping information safe and private?
PZ: I don't see this as a black-and-white situation. I sympathize with the need for NSA to catch the bad guys, and I want them to catch these bad guys. But we have to be careful about creating surveillance machinery that may be used for other purposes later.