Identified security issues with ZRTP encryption

[Skretch1974]

Hi. There are several questions about the security and work of the Linphone client application. I recently stumbled upon an article by https://www.sarinay.com/blog/linphone-zrtp-e2e-fail/ in which the author revealed very serious problems in Linphone security. The main problem is that during the installed connection with ZRTP encryption, you can give a command to turn off or switch Linphone to the SRTP or open mode and the attacker gets access to the transmitted audio information and at the same time does not display any indication or sound signal about disconnecting ZRTP in Linphone. In the above article, the author demonstrated several stages of access to audio information on the Linphone client application. Given the foregoing, I consider it very important to analyze the identified ZRTP encryption vulnerability and exclude the possibility of external management of the client program from the server if the "Stream encryption is required" is activated, as well as add an indication and sound beep of the arrival of such a command to switching the encryption during a conversation session.
Respectfully to you and your team.

[Viish]

Hi @Skretch1974,

Yes we are aware of such issue, and we are working on a fix for it, as well as other security improvements (such as the beep to inform ZRTP SAS must be validated).
A PR is currently in review for our master branch (for 5.4.0 release scheduled to be published next month) in our private gitlab repo.

Cheers,