Secure Communication - Systems Offering Partial Security - Programs Offering More Security

Programs Offering More Security

• Skype – secure voice over Internet, secure chat. Uses 128-bit AES (256-bit is the standard) and 1024-bit asymmetrical protocols to exchange initial keys (which is considered relatively weak by NIST). Proprietary. No information on backdoors. An article in 2004 suggested that Skype has relatively weak encryption, but more recent analyses, one by invitation and one by reverse engineering presented at DEF CON 2005, both conclude that Skype uses encryption effectively. Criticism focuses upon its proprietary "black box" design, its relatively short (1536 bit) keys, excessive bandwidth use of user supernodes, and excessive trust of other computers able to "speak Skype". (See Skype#Security)
• Zfone is an open source secure voice over Internet program implementing the ZRTP encryption protocol, by Phil Zimmermann, the creator of PGP.
• Jitsi is another open source voice and chat client implementing ZRTP and STRP encryption for calls, as well as OTR security for chat.
• I2P-Messenger is a simple secure (end-to-end encrypted), anonymous, and serverless instant messenger with file transfer support.
• pbxnsip is a SIP-based PBX that uses TLS and SRTP to encrypt the voice traffic. In contrast to other proprietary protocols, the protocol is open so that devices from independent vendors can be used. The encryption includes the relay of instant messaging, presence information, and the management interface.
• Secure IRC and web chat – Some IRC clients and systems use security such as SSL. This is not standardised. Likewise some web chat clients such as Yahoo Messenger use secure communications on their web based program. Again the security of these is unverified, and it is likely the communication is not secured other than to and from the client.
• Trillian – offers secure IM facility, however appears to have weaknesses in key exchange which would enable a "man in the middle" attack with ease. Proprietary, no information on backdoors.
• Off-the-Record Messaging (OTR) is a plugin which adds end-to-end encryption, authentication and perfect forward secrecy (PFS) to instant messaging. It is not a separate protocol but runs under most every instant messaging (IM) protocol.
• WASTE – open source secure IM, high strength "end to end" encryption, within an anonymised network.
• Secure email – some email networks such as "hushmail" or Opolis Secure Mail, are designed to provide encrypted and/or anonymous communication. They authenticate and encrypt on the users own computer, to prevent transmission of plain text, and mask the sender and recipient. Mixminion and I2P-Bote provide a higher level of anonymity by using a network of anonymizing intermediaries, (similar to how Tor and crowds work above, but at a higher latency).
• Cryptocat is a simple, open source, online encrypted chat service and software project supporting encrypted file transfers and up to 10 users in a room. The service can be used any modern browser, including those on mobile devices. A local app for Chrome exists, with more platforms in development.
• AESpad.com – open source online encrypted secure chat. Uses 256-bit AES symmetrical encryption. Relies on a pre-shared key between chat participants.
• ChatCrypt.com – another online encrypted secure chat. It uses the 256-bit AES symmetrical encryption in CTR mode.