proliferation of voicesystems

It's really great that there are all these voice transmission/encryption
programs out there, the problem is, none of them will talk to each other.
If I have a unix box, I have to use product X, if I have a PC, product Y,
and a Mac, product Z, and X,Y, and Z all speak different protocols. The
issue is more frustrating with web clients. I like to use Netscape, but
if I want to view RealAudio, I have to switch to Windows, etc. Rather 
than have one "successful" product set a defacto standard and lock the 
rest of the market into one algorithm, cypherpunks who are working on
voice products should collaborate to product an open standard, which
specifies base level functionality, and drop in algorithm improvements.
Perhaps even video should be considered as that too will eventually be
a reality. Sooner or later, there must be a shakeout and a 
"standard" (defacto) will emerge. The question is, do you want this to be
an extensible open standard that can cope with changing hardware and
network capability, or do you want, say, InternetPhone, to win
and set the standard by shear market share like Netscape is doing 
now and like Microsoft has been doing?

Just something to consider.

-Ray

>   It's really great that there are all these voice transmission/encryption
> programs out there, the problem is, none of them will talk to each other.

Maybe someone could start writing an internet draft about "encrypted
voice transmission on the internet".  It should address several
issues:
  - compression methods, sampling rate differencies, encoding methods
  - encryption methods used for bulk data: at least IDEA, 3DES, DES
    (3DES and DES required, IDEA optional but recommended (for patent reasons))
  - key exchange and authentication methods.  One good model could be
    that used in Photuris (see the internet draft
    draft-ietf-ipsec-photuris-02.txt at e.g. www.ietf.cnri.reston.va.us).
    Photuris is essentially Diffie-Hellman followed by authenticating
    the other party via signing the exchange.  (Authentication is
    important to avoid man-in-the-middle attacks).
  - specification of the protocol for modem-to-modem connections

Provided that the compression method is patent-free, all of the
related crypto patents expire within about two years (assuming
something other than RSA can be used for the signatures - see the
Photurs draft).  (IDEA should be optional because its patent will not
expire in near future).

I think it would be a good idea to set up a mailing list for this.

    Tatu Ylonen <ylo@cs.hut.fi>

Tatu Ylonen writes:
> >   It's really great that there are all these voice transmission/encryption
> > programs out there, the problem is, none of them will talk to each other.
> 
> Maybe someone could start writing an internet draft about "encrypted
> voice transmission on the internet".

Well, we already have standards for how to send audio in general over
the internet (the RTP standards that are used in the MBONE among other
places.) Presumably if you take IPSEC and cross it with RTP...

The real issue to me is setting such things up so that they work
nicely even on point to point modem connections without too much
protocol overhead.

> I think it would be a good idea to set up a mailing list for this.

Probably...

Perry

On Sun, 27 Aug 1995, Tatu Ylonen wrote:

> Maybe someone could start writing an internet draft about "encrypted
> voice transmission on the internet".  It should address several
> issues:
>   - compression methods, sampling rate differencies, encoding methods

BTW - does anyone actually know what the voice compression is in 
PGPfone?

-Thomas

Note that most of the MBone tools already has encrypted sessions
built in them, and have had that for at least a year, and that the
MICE project in Europe has tried to put encryption into the last ones.

There is also a lot of standardization efforts going on within the
IETF community, for example within the MMUSIC group, chaired by
Mark Handley from UCL, London <M.Handley@cs.ucl.ac.uk>. They are
standardizing the session control protocol, for example, using one
called CCCP. They are also concerned about security, thats for sure.

/Christian