Secure voice/video over IP communications today and tomorrow thanks to post-quantum encryption!

Primary tabs

Current developments in the field of quantum computer science represent a growing threat to existing cryptographic algorithms, which are used, for example, in secure voice over IP and instant messaging applications. As a quantum computer could soon see the light of day, most governments recommend protecting highly sensitive data from this kind of attack. The encrypted data that are shared today could be stored and decrypted in the near future thanks to breakthroughs in quantum computing.

In 2017, the National Institute of Standards and Technology (NIST) launched an international competition to standardise ‘post-quantum algorithms’. Such algorithms are expected to be resilient to an attack made by a general post-quantum computer. They are meant to replace, in the long term, the algorithms that are used today in many secure protocols that rely on cryptographic key exchange mechanisms (https://csrc.nist.gov/Projects/post-quantum-cryptography/post-quantum-cr...).

On July 5th, the NIST announced the first winners of this six-year competition. The algorithm selected for general encryption was CRYSTALS-Kyber: ‘For general encryption, used when we access secure websites, NIST has selected the CRYSTALS-Kyber algorithm. Among its advantages are comparatively small encryption keys that two parties can exchange easily, as well as its speed of operation’ (https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-...).

The Linphone application is most likely the first open-source software in the world to have implemented the CRYSTALS-Kyber algorithm to provide secure voice and video communications. For this purpose, the Linphone team developed a modified version of the well-known encryption protocol ZRTP.

We have taken on the following challenges:

  • ensuring that the algorithm reaches the same level of effectiveness even if the cryptographic keys are much larger;
  • ensuring that the algorithm remains resilient to classic attacks;
  • ensuring that the algorithm is interoperable with encryption features offered by previous versions.

How does it work?

You can download our technical documentation from our website.

The following steps have been carried out:

  • Integration of KEM in ZRTP protocol: We created a modified version of ZRTP that accepts a key exchange algorithm of the ‘key encapsulation mechanism’ type;
  • Hybridisation: We created an encryption engine that combines classic ECDH and post-quantum encryption. The ZRTP protocol was modified so that it can handle two different key exchange algorithms at the same time and securely combine the results;
  • Fragmentation: We added a mechanism to fragment ZRTP packets;
  • We integrated this new ZRTP library with post-quantum capacities into Linphone and added configuration settings that can be used to activate/deactivate the post-quantum mode;
  • We created performance tests. 

How can I see that post-quantum encryption is being used in the Linphone app?

Post-quantum encryption can be activated via the app settings. It can be set as ‘mandatory’ or ‘not mandatory’. If it is set to mandatory, the call will be established only if the app being called supports post-quantum encryption.

During an encrypted audio or video call, the media encryption algorithm in use will be shown in the call statistics window.

How can I integrate this feature into my app?

This feature is available in linphone-ios, linphone-android 4.7, linphone-desktop 4.5, and linphone-sdk 5.X.

The source code of our post-quantum encryption engine has been shared publicly on our Gitlab.

A large part of the source code has also been written directly in the Liblinphone library.

Developers who develop their app on top of Linphone must activate the feature in their app. This can be done directly in the source code or via remote provisioning.

For developers who leverage the Liblinphone library (linphone-sdk) to develop their apps, it is necessary to activate the post-quantum encryption module at compilation time. Our pre-compiled SDK binaries do not include this module.

For more information, see our wiki article.

From a licensing point of view, the post-quantum encryption engine is dual-licensed: it can be integrated either under the terms of the GNU/GPLv3 open-source licence or via the purchase of a closed-source licence. It is sold as an extension of the Linphone and Liblinphone licence.

Contact us for more information!