diff --git a/sflphone-client-gnome/doc/C/figures/accounts_security.png b/sflphone-client-gnome/doc/C/figures/accounts_security.png new file mode 100644 index 000000000..ca3f76c3d Binary files /dev/null and b/sflphone-client-gnome/doc/C/figures/accounts_security.png differ diff --git a/sflphone-client-gnome/doc/C/figures/srtp_enabled.png b/sflphone-client-gnome/doc/C/figures/srtp_enabled.png new file mode 100644 index 000000000..68dabf1d3 Binary files /dev/null and b/sflphone-client-gnome/doc/C/figures/srtp_enabled.png differ diff --git a/sflphone-client-gnome/doc/C/figures/zrtp_options.png b/sflphone-client-gnome/doc/C/figures/zrtp_options.png new file mode 100644 index 000000000..b9229d7b8 Binary files /dev/null and b/sflphone-client-gnome/doc/C/figures/zrtp_options.png differ diff --git a/sflphone-client-gnome/doc/C/sflphone.xml b/sflphone-client-gnome/doc/C/sflphone.xml index b104b8b2f..c08d76564 100644 --- a/sflphone-client-gnome/doc/C/sflphone.xml +++ b/sflphone-client-gnome/doc/C/sflphone.xml @@ -270,15 +270,31 @@ Security features - These features are only available with SIP. - - Secure RTP + These features are only available with SIP. + Follow the indications to edit an account and choose the Security tab. + +
+ Security features configuration panel + + + + + + + +
+ + + + Credentials + SFLphone supports multiple realms. - - TLS + + + Security + Please refer to the section Security features for detailed information about security features. - @@ -607,6 +623,109 @@ + + Security features + + SRTP/ZRTP + + SRTP and ZRTP, the big picture + RTP is the underlying protocol that is used in pair with the widely used SIP protocol to carry voice data. RTP alone does not provide any security features. + Details for implementing Secure RTP (SRTP) were described independently in a separate document (RFC). However, in this paper, one aspect was deliberately left unspecified: how should the encryption keys be exchanged between the two parties involved in a secure RTP session ? + + Mutiple solutions were proposed to fill in that blank. Among them, are SDES (RFC4568) and ZRTP which are probably the most popular today. For the 0.9.7 release, SFLphone integrates support for Secure RTP through the ZRTP protocol, and SDES is expected to be implemented in the very few next releases. + + As of today, blueprints for ZRTP are still laid out and are recognized under the name "zrtp-draftzimmerman" in the RFC machine. The author of ZRTP is Phil Zimmermann, that same person who brought us PGP. Therefore, it is not suprising that he designed ZRTP as an anti-PKI solution for key exchange. + + ZRTP makes possible for two parties to automatically establish a shared secret in a very simple way from the users's point of view. Indeed under SFLphone no special configuration is needed, appart from enabling the option itself. + + If you want to use ZRTP, please take note that if you are connecting to a PBX, this one must have been configured to support ZRTP. Unfortunately, security for VoIP communications is still young and chances are that your PBX software won't support it. + + This does not mean that you want be able to benefit from ZRTP ! In fact, it turns out that you will be able to use it, as long as the server does not need to decode the RTP stream. This is often the case when the person you are calling to uses a codec that you don't support. In that case, the server will need to transcode the RTP packets and obviously need to be able to handle the ZRTP stream. + + Obviously, if you are calling another user (for example by prefixing the number with "sip:") directly, then this one will have to support ZRTP as well if you want to use it. + + + + Enabling SRTP/ZRTP + To enable ZRTP per account basis, perform the following steps: + + Choose EditManage accounts. + Select in the list the account you would like to edit, then click on the Edit button. + Select the Security tab. + Select ZRTP from the select box named SRTP Key Exchange. + + +
+ Enabling SRTP + + + + + + + +
+ + + + + Configuration options + + After enabling SRTP, click the Preferences button. + For basic usage, one don't have to worry about that. + + +
+ ZRTP configuration panel + + + + + + + +
+ + + + + + Send Hello Hash in SDP + Selecting this option will cause the program to compute an hash function over the "Hello" packet and send it as an SDP field "zrtp-hash:". The remote end might be interested in getting this value to add an additional layer of protection based on another communication channel. Upon receiving this value, the remote point can compute the hash function on the received hello packet and compare it. + Take note that for 0.9.7, SFLPhone does not perform the comparasion on its side. + + + + Ask user to confirm SAS + The short authentication mechanism is at the heart of the ZRTP protocol. Not requirering the user to manually check the SAS value presents a security risk over Man in the Middle type of attacks. + + Disabling this option will stop the program from prompting the user with the SAS. + + Such an option was motivated to be developped at that time by the the state of the libzrtpcpp library that SFLPhone was making use of. It is only from version x.x that this library can cache results of SAS computation between two peers. + + + + + Display SAS once for hold event + When call is put on hold, the RTP stream is stopped and reinitiated later. From the ZRTP point of view, this appears as a "new call". Therefore, the SAS will be redisplayed unless this option is selected. + + + ZRTP for direct peer-to-peer calls + If you want to use ZRTP for calls that are placed directly to a user (without an intervening PBX), you must enable the option under the "Direct IP Calls" tab in the "configuration" window, available from the "edit" menu. + + Configuration instruction from that point are the same as for configured accounts. + + + + + + + TLS + + + + + Audio configuration diff --git a/sflphone-client-gnome/doc/Makefile.am b/sflphone-client-gnome/doc/Makefile.am index f258a20f3..6727048ed 100644 --- a/sflphone-client-gnome/doc/Makefile.am +++ b/sflphone-client-gnome/doc/Makefile.am @@ -24,8 +24,11 @@ DOC_FIGURES = figures/addressbook-button.png \ figures/systemtray-settings.png \ figures/voicemail-notif.png \ figures/account_advanced.png \ + figures/accounts_security.png \ figures/drag_n_drop.png \ figures/conference.png \ figures/conference_detached.png \ - figures/conference_attached.png + figures/conference_attached.png \ + figures/srtp_enabled.png \ + figures/zrtp_options.png DOC_LINGUAS = fr es