Checking the data packets from many VoIP applications shows that SIP packets are encrypted with TLS. So the captured session shows no SIP signals at all, just simple TCP and TLS/SSL packets. But surprisingly, RTP packets are well visible, with (dynamic) payload type, SSRC and data. In many cases where RTP is encapsulated with STUN, wireshark can dissect RTP from it. Of course, encrypting signalling packets hides the attacker to see which codec, bit rate is used, but does it protect from RTP packet being decoded, if somebody captured the session ? Applications used for example: LINE and KakaoTalk.
You are right in the fact that securing SIP communication is not sufficient.
RTP has got SRTP as his secured counterpart, so you may use
- SIP over TLS to secure the control channel communication,
- SRTP to encrypt the data channel communication (SRTP will need to rely on another protocol, like ZRTP, to securely exchange the keys/ More information can be found on SRTP Wikipedia page).
Of course you need your software/devices to be compatible with these protocols. Wikipedia also maintains a comparison chart between SIP software including the support of these security protocol.
protected by Community♦ Jun 7 '15 at 22:25
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?