 |
This article or section has multiple issues. Please help improve the article or discuss these issues on the talk page.
|
 |
This article may need to be rewritten entirely to comply with Wikipedia's quality standards, as the article is too technical in its nature (see Talk Page). You can help. The discussion page may contain suggestions. (August 2009) |
| part of a series on Skype |
|
|---|---|
| Features | |
| Skype Limited | |
| Protocol | |
| Security | |
Skype uses a proprietary Internet telephony (VoIP) network. The protocol has not been made publicly available by Skype and official applications using the protocol are closed-source. The main difference between Skype and other VoIP networks is that Skype operates on a peer-to-peer model, rather than the more traditional server-client model. The Skype user directory is entirely decentralized and distributed among the nodes in the network, which means the network can scale very easily to large sizes (currently about 405 million users)[1] without a complex and costly centralized infrastructure.
The Skype network is not interoperable with other VoIP networks. Numerous attempts to study and/or reverse engineer the protocol have been undertaken to reveal the protocol, investigate security or to allow unofficial clients.
Contents |
Protocol
A Skype network is a peer-to-peer network with three main entities: supernodes, ordinary nodes and the login server. It is an overlay network: each client builds and refreshes a list of reachable nodes known as the host cache. The host cache contains IP address and port numbers of supernodes. Signaling is encrypted using RC4, however the method only obfuscates the traffic as the key can be recovered from the packet. Voice data is encrypted with AES.[2]
Supernodes relay communications to other clients behind a firewall. Any skype client can become a supernode if it has good bandwidth, no firewall, and adequate processing power. Supernodes are grouped into slots (9-10 supernodes). Slots are grouped into blocks (8 slots).
Skype also routes calls through other Skype peers on the network to ease the crossing of Symmetric NATs and firewalls. This, however, puts an extra burden on those who connect to the Internet without NAT, as their computers and network bandwidth may be used to route the calls of other users.
The Skype client's application programming interface (API) opens the network to software developers. The Skype API allows other programs to use the Skype network to get "white pages" information and manage calls.
The Skype code is closed source, and the protocol is not standardized[3]. Parts of the client use Internet Direct (Indy), an open source socket communication library.[citation needed]
Protocol Detection
Many Networking and security companies claim to detect and control Skype's protocol for enterprise and carrier applications. While the specific detection methods used by these companies are often proprietary, Pearson's Chi-Square Test and stochastic characterization with Naïve Bayesian Classifiers are two approaches that were published in 2007.[4]
Preliminaries
Abbreviations that are used:
- SN: Skype network
- SC: Skype client
- HC: host cache
Skype client
The main functions of a Skype client are:
- login
- user search
- start and end calls
- media transfer
- presence messages
Login
A Skype client authenticates the user with the login server, advertises its presence to other peers, determines the type of NAT and firewall it is behind and discovers nodes that have public IP addresses.
To connect to the Skype network, the host cache must contain a valid entry. A TCP connection must be established (i.e. to a supernode) otherwise the login will fail.
1. start 2. send UDP packet(s) to HC 3. if no response within 5 seconds then 4. attempt TCP connection with HC 5. if not connected then 6. attempt TCP connection with HC on port 80 (HTTP) 7. if not connected then 8. attempt TCP connection with HC on port 443 (HTTPS) 9. if not connected then 10. attempts++ 11. if attempts==5 then 12. fail 13. else 14. wait 6 seconds 15. goto step 2 16. Success
After a Skype client is connected it must authenticate the username and password with the Skype login server. There are many different Skype login servers using different ports. An obfuscated list of servers is hardcoded in the Skype executable.
Skype servers are: "dir1.sd.skype.net:9010", "dir2.sd.skype.net:9010", "dir3.sd.skype.net:9010", "dir4.sd.skype.net:9010", "dir5.sd.skype.net:9010", "dir6.sd.skype.net:9010", "dir7.sd.skype.net:9010", "dir8.sd.skype.net:9010" "http1.sd.skype.net:80", "http2.sd.skype.net:80", "http3.sd.skype.net:80", "http4.sd.skype.net:80", "http5.sd.skype.net:80", "http6.sd.skype.net:80", "http7.sd.skype.net:80", "http8.sd.skype.net:80" Skype-SW connects randomly to 1-8.
On each login session, Skype generates a session key from 192 random bits. The session key is encrypted with the hard-coded login server's 1536-bit RSA key to form an encrypted session key. Skype also generates a 1024-bit private/public RSA key pair. An MD5 hash of a concatenation of the user name, constant string ("\nSkyper\n") and password is used as a shared secret with the login server. The plain session key is hashed into a 256-bit AES key that is used to encrypt the session's public RSA key and the shared secret. The encrypted session key and the AES encrypted value are sent to the login server.
On the login server side, the plain session key is obtained by decrypting the encrypted session key using the login server's private RSA key. The plain session key is then used to decrypt the session's public RSA key and the shared secret. If the shared secret match, the login server will sign the user's public RSA key with its private key. The signed data is dispatched to the super nodes.
Upon searching for a buddy, a super node will return the buddy's public key signed by Skype. The SC will authenticate the buddy and agree on a session key by using the mentioned RSA key.
UDP
UDP packets:
IP UDP Skype SoF Skype Crypted Data01
The Start of Frame (SoF) consists of:
- frame ID number (2 bytes)
- payload type (1 byte)
- obfuscated payload
- Ack/NAck packet
- payload forwarding packet
- payload resending packet
- other
Obfuscation Layer
The RC4 encryption algorithm is used to obfuscate the payload of datagrams.
- The CRC32 of public source and destination IP, Skype's packet ID are taken
- Skype obfuscation layer's initialization vector (IV).
The XOR of these two 32 bit values is transformed to a 80-byte RC4 key using an unknown key engine.
A notable misuse of RC4 in skype can be found on TCP streams (UDP is unaffected). The first 14 bytes (10 of which are known) are xored with the RC4 stream. Then, the cipher is reinitialized to encrypt the rest of the TCP stream.[5]
TCP
TCP packets:
TCP Skype Init TCP packet
The Skype Init TCP packet contains
- the seed (4 bytes)
- init_str string 00 01 00 00 01 00 00 00 01/03
Low-level Datagrams
Almost all traffic is ciphered. Each command has its parameters appended in an object list. The object list can be compressed.
/ Object List ... -|
Enc -> Cmd -> Encod
^ \ Compressed List ... -|
Frag | |
|------------------<---------------|
Ack
NAck
Forward -> Forwarded..Message===Object Lists===
An object can be a number, string, an IP:port, or even another object list. Each object has an ID. This ID identifies which command parameter the object is.
Object:
Number
IP:Port
List of numbers
String
RSA key
Object List
List Size (n)
Object 1
.
.
Object n
Packet compression
Packets can be compressed. The algorithm is a variation of arithmetic compression that uses reals instead of bits.
Legal Issues
- Reverse engineering of the Skype protocol by inspecting/disassembling binaries is prohibited by the terms and conditions of Skype's license agreement. However there are legal precedents when the reverse-engineering is aimed at interoperability of file formats and protocols.[6][7][8] In the United States, the Digital Millennium Copyright Act grants a safe harbor to reverse engineer software for the purposes of interoperability with other software.[9][10] In addition, many countries specifically permit a program to be copied for the purposes of reverse engineering.[11]
References
- S.A Baset, H. Schulzrinne (September 14, 2004). "An Analysis of the Skype Peer-to-Peer Internet Telephony Protocol" (PDF). Technical Report. Columbia University. http://www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf.
- P. Biondi and F. Desclaux (March 3, 2006). "Silver Needle in the Skype" (PDF). http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf.
- F. Desclaux and K. Kortchinsky (June 6, 2006). "Vanilla Skype - part 1" (PDF). http://www.recon.cx/en/f/vskype-part1.pdf.
- F. Desclaux and K. Kortchinsky (June 17, 2006). "Vanilla Skype - part 2" (PDF). http://www.recon.cx/en/f/vskype-part2.pdf.
- L. De Cicco, S. Mascolo, V. Palmisano (May 2007). "An Experimental Investigation of the Congestion Control Used by Skype VoIP." (PDF). WWIC 07. Springer. http://c3lab.poliba.it/images/d/d2/Skype_wwic07.pdf.
- L. De Cicco, S. Mascolo, V. Palmisano (9-11 Dec 2008). "A Mathematical Model of the Skype VoIP Congestion Control Algorithm.". Proc. of IEEE Conference on Decision and Control 2008. http://c3lab.poliba.it/images/2/22/Skype_voip_model.pdf.
- Dario Bonfiglio, Marco Melia, Michela Meo, Dario Rossi, Paolo Tofanelli (August 27-31 2007). "Revealing Skype Traffic: When Randomness Plays With You". ACM SIGCOMM Computer Communication Review. https://www.dpacket.org/articles/revealing-skype-traffic-when-randomness-plays-you.
Notes
- ^ 2008 eBay Annual Report
- ^ http://www.ossir.org/windows/supports/2005/2005-11-07/EADS-CCR_Fabrice_Skype.pdf
- ^ http://support.skype.com/en_US/faq/FA153/Which-protocols-does-Skype-use<
- ^ Dario Bonfiglio et al. “Revealing Skype Traffic: When Randomness Plays with You,” ACM SIGCOMM Computer Communication Review, Volume 37:4 (SIGCOMM 2007), p. 37-48
- ^ Fabrice Desclaux, Kostya Kortchinsky (2006-06-17). "Vanilla Skype part 2". RECON2006. http://www.recon.cx/en/f/vskype-part2.pdf.
- ^ Sega vs Accolade, 1992
- ^ Sony vs Connectix, 2000
- ^ Pamela Samuelson and Suzanne Scotchmer, "The Law and Economics of Reverse Engineering", 111 Yale Law Journal 1575-1663 (May 2002) [1]
- ^ 17 U.S.C. Sec. 1201(f).
- ^ WIPO Copyright and Performances and Phonograms Treaties Implementation Act
- ^ In the French "intellectual property" law set, there is an exception that allows any software user to reverse engineer it. See The official code (in French). This law came from a European rule (European Union directive #91-250 dated May 14, 1991, in the JOCE dated May 17, 1991, article 6, L.122, page 42)
External links
This entry is from Wikipedia, the leading user-contributed encyclopedia. It may not have been reviewed by professional editors (see full disclaimer)
