ZSipOs
Open hardware for telephony encryption
ZSIPOs is a fully open source based encryption solution for internet telephony. It takes the shape of a little dedicated gadget you connect with a desktop phone. At its core the device does not have a normal chip capable of running regular software (including malware) but a so called FPGA (Field Programmable Gate Array). This means the device cannot be remotely updated (secure by design): the functionality is locked down into the chip, and the system is technically incapable of executing anything else. This means no risk of remote takeover by an attacker like with a normal computer or mobile phone connected to a network like the internet. The whole system is open hardware, and the full design is available for introspection. Normal users and security specialists get transparent access to the whole system and can easily check, what functionality is realized by the FPGA. This means anyone can verify the absence of both backdoors and bugs. ZSIPOs is designed to be fully compatible with the standard internet telephony system (SIP) which is the one used with traditional telephony numbers. The handling is done in principal by a regular internet phone (Dial, Confirm once – done). The cryptographic system is based on the standard RFC 6189 - ZRTP (with “Z” like Phil Zimmermann, the father of PGP), meaning it can also be used when using internet telephony on a laptop or mobile phone - of course without the additional guarantee of hardware isolation. There is no need to trust in an external service provider to establish the absolute privacy of speech communication. The exchange and verification of a secure key between the parties ensures end-to-end encryption, meaning that no third party can listen into the call. To that extent the device has a display to exchange security codes. The same approach can also also used for secure VPN Bridgeheads, secure storage devices and secure IoT applications and platforms. The ZSipOS approach is an appropriate answer on today security risks: it is completely decentralized, and has no dependency on central instances. It has a fully transparent design from encryption hardware to software. And it is easy to use with hundreds of millions of existing phones.
- The project's own website: https://www.vipcomag.de/
Why does this actually matter to end users?
Consumers and businesses overpay for computer hardware, because the market is not working well. When you go to a store to buy a laptop or mobile phone, you may see different brands on the outside but choice in terms of what is inside the box (in particular the most expensive component, the processor technology) is pretty much limited to the same core technologies and large vendors that have been in the market for decades. This has a much bigger effect on the users than just the hefty price tag of the hardware, because the technologies at that level impact all other technologies and insecurity at that level break security across the board.
In the field of software, open source has already become the default option in the market for any new setup. In hardware, the situation is different. Users - even very big users such as governments - have very little control over the actual hardware security of the technology they critically depend on every day. Security experts continue to uncover major security issues, and users are rightly concerned about the security of their private data as well as the continuity of their operations. But in a locked-down market there is little anyone can do, because the lack of alternatives. European companies are locked out of the possibility to contribute solutions and start new businesses that can change the status quo.
The issue of insecure hardware becomes even more important when you think of fast and widespread the use of smartphones has grown. The device that we carry with us every single day and use to call each other, do our personal banking, maintain our social life and manage a host of other online services with is frustratingly opaque and riddled with security vulnerabilities and backdoors. And because most smartphones are produced by a select number of massive companies, the entry to market for more secure and private alternative smartphone hardware is practically impossible.
One way to circumvent the status quo of smartphones is to go around the phone itself. Instead of designing a secure and private smartphone from scratch, the ZsipOS adds a plugin device to your phone that handles encoded internet telephony completely on its own. A user only has to connect the gadget to their phone and call someone. The program on the device will establish a cryptographic tunnel, basically a secure channel, that ensures no one can listen in or in anyway modify the call. Users also do not need to trust an external service provider to handle the call. Because the device is designed to only establish encrypted calls and because it handles everything instead of the smartphone it is connected to, there is little to no risk of an attacker getting in through some forgotten backdoor. The design of the device and the program it runs is completely transparent so security experts can test and verify everything that ZsipOS does and promises to do. Ultimately ZsipOS is an accessible, surefire and fully transparent solution for encrypted internet telephony that fits with any smartphone out there.
Run by VIPcom GmbH
This project was funded through the NGI0 PET Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.
