RedPhone

RedPhone. It was a pioneering secure voice calling application for Android smartphones, developed by the security research team at Whisper Systems. Founded by Moxie Marlinspike and Stuart Anderson, the company focused on creating accessible cryptography tools for mobile devices. The application provided end-to-end encrypted voice calls, aiming to protect user privacy against wiretapping and surveillance.

Overview

RedPhone was designed as a straightforward application that integrated seamlessly with a phone's existing dialer, allowing users to place secure calls as easily as standard ones. When both parties had the app installed, calls would be automatically routed through its encrypted channel. The service operated by using a unique callback system; initiating a call would cause the RedPhone servers to ring both participants and bridge the connection. This approach was distinct from other Voice over IP services like Skype or Google Voice, as its sole design imperative was privacy. The project was closely associated with Whisper Systems' other major product, TextSecure, which provided similar security for SMS and later instant messaging.

Technical details

The core of RedPhone's security relied on the ZRTP protocol, a cryptographic key-agreement protocol for SRTP media streams. This protocol, developed by Phil Zimmermann of PGP fame, provided perfect forward secrecy and included a verbal short authentication string to guard against man-in-the-middle attacks. Audio was encoded using the Silk codec, developed by Skype, before being encrypted and transmitted. The application's architecture involved central servers, operated by Whisper Systems, to facilitate the initial connection and perform key exchange, but these servers could not decrypt the call audio. This setup required a constant Internet connection, typically via Wi-Fi or mobile data networks.

Development and history

Whisper Systems launched RedPhone in May 2010, amidst growing public concern over digital surveillance following revelations by figures like Edward Snowden. The development was part of a broader movement to democratize strong encryption. In November 2011, Whisper Systems was acquired by Twitter. The acquisition initially raised concerns within the free software community about the future of the projects. However, in 2012, the company announced it would open-source the code for both RedPhone and TextSecure. Further development of RedPhone as a standalone application eventually ceased as its functionality was merged into the unified Signal app, created by Moxie Marlinspike and the newly formed Open Whisper Systems.

Security and encryption

RedPhone's security model was considered robust by contemporary standards. Its use of ZRTP, which does not rely on a PKI, avoided the complexities and vulnerabilities associated with certificate authorities. The protocol's built-in "SAS" verification allowed users to confirm a call's security by reading a short phrase of words to each other. The servers, while necessary for routing, were designed to be minimal and untrusted regarding call content. Independent audits and the subsequent adoption of its protocols in widely used apps like Signal and WhatsApp validated its cryptographic approach. Its architecture explicitly defended against threats from powerful adversaries like the NSA or other Five Eyes intelligence agencies.

Reception and impact

RedPhone received positive recognition from the digital rights and security communities. Organizations like the Electronic Frontier Foundation praised it for making strong encryption user-friendly. It was frequently recommended alongside tools like Tor and PGP for at-risk users such as journalists, activists, and lawyers operating in repressive regimes. Its most significant impact was arguably its role as a direct precursor to the Signal Protocol, which now underpins encryption for billions of users through its integration into Facebook Messenger, WhatsApp, and Google Messages. The project demonstrated that seamless, default end-to-end encryption for real-time communication was not only possible but could achieve mainstream adoption.

Category:Android software Category:Cryptography software Category:Secure communication Category:Voice over IP