6 Voice-over-IP Security

Transcription

1 Information Security 2 (InfSi2) 6 Voice-over-IP Security Prof. Dr. Andreas Steffen Institute for Internet Technologies and Applications (ITA) ITA, , 6-VoIP_Security.pptx 1

2 VoIP Communications Channels Proxy Proxy Authentication Hop 2 Hop 1 atlanta.com Call setup via SIP biloxi.com Hop 3 Security? directly via RTP sip:alice@atlanta.com sip:bob@biloxi.com Audio/video connection Confidentiality / Data Integrity ITA, , 6-VoIP_Security.pptx 2

3 Session Initiation Protocol (RFC 3261) atlanta.com biloxi.com User Agent Proxy Proxy UA INVITE F1 INVITE F2 100 Trying F3 INVITE F4 100 Trying F5 180 Ringing F6 180 Ringing F7 180 Ringing F8 200 OK F9 200 OK F OK F11 ACK F12 Media Session BYE F OK F14 ITA, , 6-VoIP_Security.pptx 3

4 Voice-over-IP Demo Session Without security measures anyone with network access can eavesdrop on a VoIP session! ITA, , 6-VoIP_Security.pptx 4

5 Information Security 2 (InfSi2) 6.1 Eavesdropping on Multimedia Sessions ITA, , 6-VoIP_Security.pptx 5

6 Network-Sniffing with Wireshark Download: (Windows or Linux) ITA, , 6-VoIP_Security.pptx 6

7 Selecting a VoIP Call ITA, , 6-VoIP_Security.pptx 7

8 Playing the RTP Media Stream ITA, , 6-VoIP_Security.pptx 8

9 Tapping VoIP Sessions with Cain Download: (Windows) ITA, , 6-VoIP_Security.pptx 9

10 Information Security 2 (InfSi2) 6.2 Securing the Media Streams ITA, , 6-VoIP_Security.pptx 10

11 Virtual LAN for Hardware IP Phones A1 A2 A3 A4 A5 VLAN A VLAN Switch VLAN Switch?? VLAN B B1 B2 B3 B4 B5 ITA, , 6-VoIP_Security.pptx 11

12 encrypted authenticated Secure RTP Packet Format (RFC 3711) V P X CC M PT sequence number timestamp synchronization source (SSRC) identifier contributing source (CSRC) identifiers... RTP header extension (optional) RTP payload RTP padding SRTP master key identifier (MKI, optional) authentication tag (recommended) bits RTP pad count ITA, , 6-VoIP_Security.pptx 12

13 encrypted authenticated Secure RTCP Packet Format (RFC 3711) V P X RC M PT=RR length SSRC of packet sender sender info... report block 1... report block 2... E... SRTCP index SRTCP master key identifier (MKI, optional) authentication tag bits ITA, , 6-VoIP_Security.pptx 13

14 Default Encryption and Authentication Algorithms Encryption uses AES in Counter Mode (AES-CTR) with 128 bit key 128 bits IV IV = f(salt_key, SSRC, packet index) 112 bits 128 bits encr_key keystream generator AES-CTR RTP/RTCP payload + XOR encrypted payload Authentication uses HMAC-SHA-1 with truncated 80 bit MAC RTP/RTCP payload HMAC 160 bits auth_key SHA-1 auth tag 80/32 bits ITA, , 6-VoIP_Security.pptx 14

15 Session Key Derivation Key Derivation uses AES in Counter Mode (AES-CTR) master_key 128 bits 192 bits 256 bits 128 bits IV SRTP session keys key derivation AES-CTR SRTCP session keys IV = f(master_salt, label, packet index) 112 bits div key derivation rate label 0x00 0x01 0x02 0x03 0x04 0x05 encr_key auth_key salt_key encr_key auth_key salt_key 128 bits 160 bits 112 bits 128 bits 160 bits 112 bits ITA, , 6-VoIP_Security.pptx 15

16 Media Stream Encryption with Secure RTP SRTP for Kphone Silvan Geser & Christian Höhn HSR Project 2005 Problem: How to distribute the SRTP Master Key? ITA, , 6-VoIP_Security.pptx 16

17 Securing the Media Streams Secure RTP Needs a secret master key that must be distributed in a secure way. The key exchange can be effected via the Session Description Protocol (SDP) payload that is transmitted during the SIP connection setup. The SDP payload can be protected on a hop-to-hop basis via TLS (i.e. SIPS). This approach allows lawful inspection but on the down side requires full trust into the proxy-servers (SDP Security Descriptions, RFC 4568). As an alternative the Multimedia Internet KEYing Protocol (MIKEY, RFC 3830) can be used which guarantees a true peer-to-peer key exchange. MIKEY payloads are also transported via SDP. IPsec IPsec tunnels protecting media streams are set up via the Internet Key Exchange protocol (IKE). If there is already a site-to-site VPN or a remote access scheme in place then the VoIP calls can be transported via IPsec as well. Drawback: Large IPsec overhead of Bytes per RTP audio packet! ITA, , 6-VoIP_Security.pptx 17

18 SDP Security Descriptions (RFC 4568) v=0 o=jdoe IN IP s=sdp Seminar i=a Seminar on the session description protocol u= (Jane Doe) c=in IP /127 t= m=video RTP/SAVP 31 a=crypto:1 AES_CM_128_HMAC_SHA1_80 inline:d0rmdmcmvcspeec3qgzinwpvlfjhqx1cfhawjsoj 2^20 1:32 m=audio RTP/SAVP 0 a=crypto:1 AES_CM_128_HMAC_SHA1_32 inline:nzb4d1binuavlew6uzf3wsj+psdfcgdujshpx1zj 2^20 1:32 m=application udp wb a=orient:portrait ITA, , 6-VoIP_Security.pptx 18

19 MIKEY Key Exchange Methods RSA Public Key Encryption Method KEMAC PKE HDR [ID i Cert i ] [ID r ] ID i TGK MAC Env_Key Sig i HDR [ID r ] V Env_Key Pub_Key r Diffie-Hellman Key Exchange Method HDR [ID i Cert i ] [ID r ] DH i Sig i DH i = g xi TGK = g (xi xr) HDR [ID r Cert r ] ID i DH i DH r Sig r DH r = g xr ITA, , 6-VoIP_Security.pptx 19

20 MIKEY payload embedded into SDP attachment v=0 o=alice IN IP4 w-land.example.com s=cool stuff t=0 0 c=in IP4 w-land.example.com a=key-mgmt:mikey AQAFgM0XflABAAAAAAAAAAAAAAsAyONQ6gAAA...v9zV m=audio RTP/SAVP 98 a=rtpmap:98 AMR/8000 m=video RTP/SAVP 31 a=rtpmap:31 H261/90000 ITA, , 6-VoIP_Security.pptx 20

21 Information Security 2 (InfSi2) 6.3 Securing the SIP Call Setup ITA, , 6-VoIP_Security.pptx 21

22 SPIT SPam over Internet Telephony Short advertising messages automatically spread in large numbers by SPIT-bots could become a big nuisance in the not too distant future. Can content-based filtering methods known to work against SPAM successfully be applied to SPIT or will it become mandatory for callers to authenticate themselves in a cryptographically strong way? As long as no ubiquitous VoIP authentication is in place on a global scale, the access to the ENUM Domain Name Service must be tightly controlled in order to prevent the systematic collection of SIP URIs. My phone number as an ENUM entry: e164.arpa => sip:andreas.steffen@hsr.ch ITA, , 6-VoIP_Security.pptx 22

23 Abuse of VoIP Signalling Redirection or disruption of VoIP calls If the SIP session management is not protected by special security measures an attacker can redirect VoIP calls to an arbitrary network destination (MITM attack) or can forcefully terminate them (DoS attack). Dozens of VoIP signalling abuse scenarios have already been documented in the literature. The call setup can be effectively secured by setting up a TLS session on a hop-to-hop basis (sips:bob@biloxi.com) Main problem: Lack of strong peer and gateway authentication Man-in-the-Middle, Denial-of-Service or SPIT attacks can only be thwarted by a strong authentication of all communication parties (both clients and gateways). The introduction of a Public Key Infrastructure (PKI) will become indispensable at least at the domain level. ITA, , 6-VoIP_Security.pptx 23

24 Authentication Data Integrity Confidentiality Securing the Session Management Authentication methods: PSK Pre-Shared Keys PKI Public Key Infrastructure HTTP 1.0 Basic Authentication PSK - - HTTP 1.1 Digest Authentication PSK - - Deprecated by SIPv2 Insecure transmission of password Challenge/response exchange based on MD5 hash of [strong] password Pretty Good Privacy (PGP) PKI Deprecated by SIPv2 Secure MIME (S/MIME) PKI For encryption the public key of the recipient user agent must be known SIPS URI (TLS) PKI SIP application and proxies must tightly integrate TLS IP Security (IPsec) PKI Integration with SIP application not required but proxies must be trusted ITA, , 6-VoIP_Security.pptx 24

25 Dream or Nightmare? Strong PKI-based Security Proxy Proxy Hop 2 atlanta.com biloxi.com Hop 3 Hop 1 sip:alice@atlanta.com directly via RTP Audio/video connection Smartcards sip:bob@biloxi.com ITA, , 6-VoIP_Security.pptx 25

26 Pragmatical Approach: DomainKeys via DNS DNS Server DNS Server Lookup for Encryption Lookup for Authentication biloxi.com bob._domainkey.biloxi.com k=rsa; p=xuydl 4+wQK atlanta.com alice._domainkey.atlanta.com k=rsa; p=c4obu ExUn/7 SIP INVITE Message with MIKEY Record HSR Diploma Thesis 2005 by Silvan Geser and Christian Höhn ITA, , 6-VoIP_Security.pptx 26

27 DomainKeys Generation openssl genrsa out myprivatekey.pem 1024 openssl rsa in myprivatekey pubout out mypublickey cat mypublickey -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1l4Y1oPxnYgrjKThuZVd1uJh2 xmip+wzpd0czdgpkw5w8ex0zghnws1gfmiqspcuzgr5sxebjgkbd+lyeebhhps0t j37f3zar9ly3ltucitw7cfzhxajc31vcsaewrxei+rjjnpjuwjeahycwoyqxs+dr fkt6gjjcz4ujzc3o9widaqab -----END PUBLIC KEY----- k=rsa; p=migfma0 widaqab Public Key Cache folder stores DomainKeys in the OpenSSL format shown above: alice._domainkey.atlanta.com bob._domainkey.biloxi.com andreas.steffen._domainkey.hsr.ch ITA, , 6-VoIP_Security.pptx 27

28 Summary SRTP - Confidentiality of VoIP Calls The Secure RTP protocol (SRTP) offers efficient encryption and authentication of multi-media packets. The main problem is the secure distribution of the SRTP session keys. MIKEY Secure Peer-to-Peer Key Exchange The MIKEY protocol allows the secure key exchange between two or more peers. Two public key methods are defined: RSA public key encryption (PKE) or Diffie-Hellman (DH). Both methods require the trusted distribution of the peers public keys. The main problem is the lack of a global Public Key Infrastructure (PKI). DomainKeys Global Public Key Distribution The DNS-based DomainKeys scheme postulated by Yahoo et al. for trusted can be used for the public key operations required by the MIKEY exchange. DNS requests are not very secure but currently DNSSEC is being deployed on a global scale. DomainKeys fetching was realized by HSR students for the Kphone and minisip clients as well as for the Soxy SIP security proxy server. ITA, , 6-VoIP_Security.pptx 28

29 What about Skype? The original Skype used proprietary, undisclosed protocols. The client was a tamper-proof black box (Anti-debugger traps, partial code encryption, junk code). The original Skype used strong 256 bit AES call encryption and a 1024 bit RSA authentication key for each user. Microsoft acquired Skype in October 2011 and started to integrate it into its key software and services. Skype does not publish Transparency Reports detailing which user data Microsoft collects and makes available to third parties! Microsoft replaced peer-to-peer supernodes by centralized Linux servers. ITA, , 6-VoIP_Security.pptx 29