Security in Skype

1
Security in Skype
2
What is Skype?

• P2P based VOIP software
• Service
• PC to PC communication
• PC to phone communication
• Text/Voice message
• Etc

3
Skype Architecture

• Central Skype authentication server is for
  registration and certification distribution
  services

Skype Architecture Normal peers, super nodes,
and centralized Skype server Super node perform
the somewhat limited functions of connecting
nodes together, providing a distributed database
and choosing appropriate nodes to act as "relay
nodes" when necessary.
4
Skype Security Services

• Everything is encrypted in Skype communication,
  including protocol message headers
• Voice data is encrypted with AES
• Provides
• Confidentiality
• User authentication

5
Security Phases

• User registration
• - Register username at Skype server
• User login
• - Get the one time public key for the user
  certified by Skype Server
• User to User authentication
• User to User communication key establishment
• Session cryptography

6
User Registration

• User selects a unique username (over the Skype
  domain) and a password
• Sends username and SHA -1 hash of password to the
  Skype Login Server, encrypted with the public key
  of the Skype Server
• Skype server extracts username, hash of password
  using its private key
• Public Key of Skype Server known to client during
  Skype installation

7
User Registration
1. Ks ( Username, H(pwd) )
Skype Server
Alice
2. Ks-(Ks ( Username, H(pwd) )) ? Username,
H(pwd) Finally, H(H(pwd)) is stored in Skypes
database.

• Username unique over Skypes domain
• Ks public key for Skype Server
• Ks- private key for Skype Server
• H() SHA -1
• H(pwd) stored securely in the client

8
Security Phases

• User registration
• - Register username at Skype server
• User login
• - Get the one time public key for the user
  certified by Skype Server
• User to User authentication
• User to User communication key establishment
• Session cryptography

9
User Login

• User (lets say Alice here) generates 1024-bits
  public and private key pair (KA, KA-)? One time
  key pair for the user for this login session
• User generates 256-bits AES symmetric key (K)
• Encrypts KA, username and SHA-1 hash of password
  using K.
• Encrypts K using public key of Skype Server

10
User Login

• Encrypted KA, username and password hash and
  encrypted session key K are sent to the Skype
  Server
• Login Server extracts K using its private key and
  decrypts username, password hash and KA using K.
• If username and password hash match, user is
  authenticated. Skype Server signs username and
  KA pair to give certificate (CA).
• CA sent to user

11
User Login
3. Ks (K), K (KA, Username, H(pwd) )
Alice
8. CA
Skype Server

• 4. Ks-(Ks (K)) ? K
• K(K(KA, Username, H(pwd))) ? KA, Username,
  H(pwd)
• Verify Username and H(pwd)
• Ks-(Username, KA) ? CA

• Generate one-time key pair (KA, KA-) and K
• 2. Store KA- securely

12
Security Phases

• User registration
• - Register username at Skype server
• User login
• - Get the one time public key for the user
  certified by Skype Server
• User to User authentication
• User to User communication key establishment
• Session cryptography

13
User-to-User Authentication

• Users Alice (A) and Bob (B) want to authenticate
  and communicate to each other
• Users get each others certificates
• Alice sends Bob her certificate (that she
  obtained from Skype Server) and vice-versa
• 3. Each uses 8 bytes challenge-response method
  to authenticate each other

14
User-to-User Authentication
1. R1 (8 bytes)
2. KB- (R1)
Bob
Alice
3. KB(KB- (R1)) R1
4. KA- (R1)
5. KA(KA- (R1)) R1
6. OK
15
Security Phases

• User registration
• - Register username at Skype server
• User login
• - Get the one time public key for the user
  certified by Skype Server
• User to User authentication
• User to User communication key establishment
• Session cryptography

16
Encrypted P2P Communication

• After mutual authentication, Alice and Bob
  establish a 256-bits common session key Ks (AES)
  for encryption
• Each side contributes 128-bits for the 256-bits
  long Ks
• Each side sends its contribution to the other
  side, encrypted with the latters public key
• Two 128-bits contributions combined in some way
  to generate the 256-bits secret session key Ks
• All traffic (voice, video and text) is encrypted

17
Encrypted P2P Communication
KB(K1, n1)
KA(K2, n2)
Bob
Alice

• KB-(KB(K1, n1)) ? K1, n1
• K1 K2 ? Ks
• n1 n2 ? n

• KA-(KA(K2, n2)) ? K2, n2
• K1 K2 ? Ks
• n1 n2 ? n

18
Security Phases

• User registration
• - Register username at Skype server
• User login
• - Get the one time public key for the user
  certified by Skype Server
• User to User authentication
• User to User communication key establishment
• Session cryptography

19
Session cryptography

• All traffic in a session is encrypted using the
  AES algorithm running in Integer Counter

20
Summary

• Some part of Skype security protocol has been
  deciphered
• Skype uses standard cryptographic techniques
• RSA
• AES
• SHA-1