[thom]

we have been testing the new "Zfone" from Phil Zimmerman [ref:PGP], and it works very well with CommuniGate Pro and existing SIP softclient applications.

Zfone is available for download here:
http://www.philzimmermann.com/EN/zfone/index-start.html

Softclients that are reported to work with Zfone include: "Zfone has been tested with these VoIP clients: X-Lite, Gizmo, and SJphone. And these VoIP service providers: Free World Dialup, iptel.org, and SIPphone."
[ref:http://www.philzimmermann.com/EN/zfo...ex-start.html].

Azdio and I just did an encrypted call with me using Zfone with SJphone for Windows XP (in France), and him using Zfone with CounterPath EyeBeam on Mac OSX (in the Bay Area). Integration for both of us was seamless.

SJphone is available here with a free "Basic" version which works fine:
http://www.sjlabs.com/sjp.html

CounterPath EyeBeam and X-Lite (free) are available here:
http://counterpath.com/index.php?men...&smenu=eyeBeam
http://counterpath.com/index.php?men...ts&smenu=xlite

Once you've installed whichever softclient you choose, and configure it for SIP use with your CommuniGate Pro server, you then install Zfone on your laptop/desktop, which installs as a *very* simple application which appears to work by intercepting all call traffic between your softclient and your system's network stack, and encrypts it if the other caller also has Zfone running.

The call by default is encrypted automatically when both sides are using Zfone, with an added layer of identity security by offering a "verbal comparison" of a random string which, once both sides have spoken the same string and both feel they know each other's voices, then both sides permanently exchange public keys, which will guarantee encryption with a known caller for all future calls. (With all public-key encryption methods, both sides must have a way to verify that the certificate the other person says belongs to him/her, really belongs to him/her. In the old days you might have done this through "key signing parties." What is so clever about Zfone is that you are using your voice, a biological trigger to which the human ear is incredibly well attuned to use as a method of personal identification, in order to verify that both people are who they say they are.) Once you've done this once, you have now exchanged public keys and can always thereafter verify with a high level of assurance (similar in the way that SSL-encrypted sites work with browsers).

Anyway, incredibly neat stuff. One of the big holes in the SIP world to date has been the lack of good encryption support for media. Skype filled this whole for a while, but now that they have acknowledged implementing CALEA for the U.S. Government, there is no reasonable assumption of security, and no way to determine whether calls have been intercepted through a Gov't tap (for which they have been granted access far too often, even far outside their legal authority to do so).
[ref:http://www.nytimes.com/2005/12/16/po...ex=1292389200]
[ref:http://www.eff.org/legal/cases/att/]

So, from my perspective, this is a type of "perfect" application - it integrates smoothly and easily, works worth of variety of softclient applications and platforms, runs on Windows/Mac/Linux, and guarantees end-to-end encryption - there can be no intermediate interception of the call once you've verified the keys the first time (note: getting a good verification the first time is incredibly important, however, because if the first time you use Zfone you are actually being spoofed by the remote caller, then you could forever be trusting the wrong person. This is the biggest security concern which Zfone faces.)

Anyway, I would strongly recommending downloading this free, easy, secure, and incredibly clever application immediately if you want to do secure Internet-based SIP calling. It is far more secure than Skype, because it depends on no central authority to handle authentication or encryption for you...the encryption provided is end-to-end across potentially endless Internet hops. With Zfone and a globally-distributed SIP-based, SIPified world, we really are creating the world's biggest secure telephone network, with over 1.4 billion online users and counting...

Cheers,

-t