Untappable secure phonecalls with no back door. Ever.
A conversation with Szabolcs Kun, CEO of Crypttalk
It’s late June 2015. Though the headquarters of CryptTalk are in Stockholm, Sweden, the conversation with Szabolcs Kun is in his native Budapest. Recently spotlighted by Forbes Magazine, the Hungarian capital is a hotbed of engineering expertise, especially in the area of telecom security. “This small Eastern European country turns out to have a pool of brilliant telecom security experts — as well as being a healthy sceptical market for anything as disruptive as this. But then, we love a tough challenge”.
The growing erosion of personal privacy enters a new phase.
In February 2015, fresh revelations by US whistle-blower Edward Snowden renewed a global discussion about cell phone privacy. The breach, detailed in a secret 2010 GCHQ document, claimed the surveillance agencies had the potential to secretly monitor a large portion of the world’s cellular communications, including both voice and data. They did it by hacking into the internal computer network of the largest manufacturer of SIM cards in the world and stealing encryption keys. Gemalto, the company being targeted responded with a statement that they were attacked but none of the keys were stolen.
In May 2015, a new French law designed to strengthen intelligence-gathering gained a comfortable majority as it was fast-tracked through the French National Assembly.
It is being opposed by an alliance of internet operators, defenders of civil liberties, journalists and non-governmental organisations (NGOs). They say it is a dangerous extension of government power that authorises mass surveillance and threatens the independence of the digital economy.
Confusing implications for Citizens
As BBC journalist Hugh Schofield reported recently, the main provisions of the new law include the authorization of “new methods” in which France’s six different security agencies may act. Some are not controversial, such as “prevention of terrorism” and “national defence”.
But what, say critics, of “major foreign policy interests”? Does that allow spying on opposition movements in other countries? Or what about “industrial and scientific interests”? Would that allow agents to eavesdrop on journalists investigating major French companies? It is all extremely unclear.
Industrial Espionage on an exponential rise
Just as people have the right to buy a virus scanner to keep out the bad guys attacking your home computer, a high-tech European start-up believes you have the right to ensure your phone calls cannot be eavesdropped by anyone. But they also have answers when quizzed if such technology could be misused.
“We believe that personal privacy matters a lot”, says Szabolcs. “The more someone knows about you, the more power they can have over you. Knowledge of personal information can affect reputations, influence life-changing decisions and shape your behaviour. Whilst the mainstream media has focused on the importance of encrypting offline technologies, like USB sticks or email, very little attention has been given to keeping live voice calls secure. Yet the demand from our 5000 initial customers for a secure phone system, secure from eavesdroppers, has never been greater. So we've made it so much easier to make fully secure, encrypted calls on both mobile and tablets.”
“We've heard too many accounts of business situations where important information leaked because the conversation happened over an unencrypted mobile phone. One client said he’d been participating in a very large international request for proposals. He had been discussing a final bidding offer with internal colleagues over a cellphone — and was astonished to discover later that what he thought was a “secret bid” was being leaked to their direct competitors. There’s plenty of cellphone monitoring equipment available if you do a simple Google search on the web. And just look at the live maps of Internet attacks going on right this minute, and you see the urgent need for a secure solution.”
Building a secure answer
“For the last year we've been validating our end-to-end system called CryptTalk, winning national awards as well as recognition from international industry bodies such as the Wireless Association (CTIA). We were also spotted by EIT-Digital, a leading European innovation network. They have been assisting as we scale up our operations.
At the end of June 2015, we received the results of an independent security assessment from one of the world’s most authoritative information assurance specialists, the NCC Group based in the UK. They found no practically exploitable vulnerabilities and concluded that our application was secured to a very good standard. The NCC security specialists said there was clear evidence of proactive security measures and the product’s design is very well thought-out. This extensive report clearly shows that CryptTalk is really doing what it is supposed to be doing. So now we've reached the phase where it’s time to scale-up our young company to provide secure communications for the rest of the world.”
“Our team has spent the last 15 years on securing live data for telecom companies all around the European Union. We've been working with the largest call centres and IP-telecom companies, developing a secure Voice-Over-IP engine to process voice calls. So when we decided to form a company to create the CryptTalk solution, we already had 90% of the technology needed for a secure calling and messaging solution.”
The secret lies in telecom not in encryption
“Most people outside the industry don’t realize that 80% of the work involved in building a secure telecom service is understanding and implementing the right telecom infrastructure. The encryption part is also important, but we decided not to claim our encryption was more secure than what is already out there. In fact, we’re using tried and tested encryption technology and IT best practices that have never failed. The industry of IT security, including telecom, banks and governments already trust these encryption systems. It’s pointless to reinvent the wheel.”
“The real problem is that most IT encryption systems are far too complicated for most people to use.”
“So our approach was the other way round. We've focused on putting proven encryption technology into an application which gives you end-to-end secure communication in an easy and affordable way. It sounds easy. But it is actually very difficult to do well.”
Customer Validation completed in toughest market
“Hungary is a country where many telecom companies run their tests. You can run pilots under the radar because few people speak Hungarian. So, even if they are successful, the word doesn't spread across the border! The Hungarian economy is not as advanced as other European countries. With the exception of the startups, the general public is conservative, so it’s a country of “late-adopters”. So if you can set your pricing and services so that Hungarians will buy it, then you have validated your business case for much more affluent economies. Now, all that hard work is starting to bear fruit.”
“We’re now ready to scale-up our technology to other, larger countries. And, strange as it may appear at first, we've decided what we’re NOT going to do. For a lean late-stage start-up company, currently with 20 people, selling globally would require major local resources that are not yet in place. So we’re in the process of building various partnerships. And we’re focussing on specific types of clients for whom privacy and confidentiality are paramount. For example, in order to reach some customers with our solution, we’re looking at telecom partners. They can provide us with access to potential customers, customer support and, of course, billing services — after all, they know who does what and for how long on their network. We’re also working with communications security specialists and advisors, some of whom have approached us for a white label solution. They would market our secure CryptTalk technology service under their own brand. ”
We’ve already sparked interest in specific professions including lawyers, accountants, financial advisors, stockmarket traders, analysts and several different branches of both state and private banking. CryptTalk was also discussed at the recent Global Editors Network summit in Barcelona. Secure communication is vital to both journalists and the news agencies, especially those operating from fragile states.
A Common Misconception: Wiretaps work
“Many people believe that security agencies like the NSA or GCHQ are able to overhear conversations because they tap into the open network and intercept the data packets. Actually, this turns out to be nonsense.”
“If I am a government hacker, I know that decoding an encrypted data package without the keys is nearly impossible. You’re going to need a large amount of computing power and maybe a million years to crack the sophisticated encryption systems already in use today. So what hackers do is to steal the encryption keys by attacking the end device. That’s why you should change the encryption keys after every call. So, once the call is over, you wipe the encryption key from the memory.”
“But imagine that some of that incomprehensible data is being recorded anyway — as leaked NSA documents confirm the agency is now doing at a giant facility the Utah desert. An eavesdropper who gets the secret key at any time in the future — even years later — could use it to decrypt all of the stored data! That means that the encrypted data, once stored, is only as secure as the secret key, which may be vulnerable to compromised server security or disclosure by the service provider.”
“We’re using the Elliptic Curve Diffie-Hellman key exchange that provides what’s called “perfect forward secrecy”. In nutshell: the key is generated as a shared secret, it is never sent over the network (not even in encrypted format). Once the call is over, the key is destroyed. It can never be recovered by anyone.”
“This is important in the case that, for example, a curious government agency has recorded your encrypted calls and then seizes your mobile phone when you’re going through customs. Even in this case, they cannot get anything out of the phone which they could use to decrypt the recorded calls made in the past. That’s because the actual decryption key is generated inside the phone and never leaves the device. So without the encryption keys, the contents of the call will always remain encrypted.”
So how does CryptTalk work?
“When you open the CryptTalk app, you have to authenticate yourself with a six-digit passcode. The app needs to know the right user is accessing the phone — and it hasn't been stolen.”
“Once you have proved you’re the user, you get access to your special personal phone book. Each of the people on that list have also installed the CryptTalk app on their smart phone. All you do is select the person you want to call and press the button. When the other party answers, CryptTalk takes just a few seconds to generate the encryption keys and set up an end-to-end secure peer-to-peer link between both parties. That’s it.”
“Our telecom background means we've designed a system which is completely network independent. I could be making the call through a LTE mobile phone network. The other party could be taking the call on a handset connected to a WiFi-network. The only requirement is that both parties need access to the Internet, although it doesn’t need to be a very fast connection.”
“We can provide a high-quality voice call without any latency in the call. Some competing systems have anything up to 3–5 seconds delay, while the system is encrypting and decrypting. We have spent more than two years finding a solution for fast data transmission over networks, so that our latency is actually better than an average GSM call — that means it is imperceptible.”
Roll out on IoS — Android on standby
“At the moment, we are supporting both iPhone and iPad. But the technology is also platform independent. So we are ready to use it on Windows Phone and Android. But we chose Apple IOS because, for the moment, it’s the most secure.”
“Of course, we’re under pressure to create an Android version, but we’re not releasing it until Android solves a number of security issues. The problem with Android is that mobile devices using it are often using out of date versions of the operating software, something which is less prevalent on iOS. Our customers want secure communications from the moment they use CryptTalk. We’re taking an active part to tell the Android developers what’s missing and hopefully get that the remaining issues fixed.”
“Our existing customers are in all kinds of businesses where security is paramount; e.g. people buying energy on world markets. Large companies can survive a security scare, just look at the recent news around Gemalto for example, but a security breach for a startup like us would be fatal. Fortunately, the NCC Group report is clear in its assessment.”
“The underpinning cryptographic protocol had been well conceived, and no faults were found within its implementation. It was confirmed that an attacker with no knowledge of the user’s PIN is not able to gain access to any sensitive information, either by intercepting traffic or analysing data held on the device’s storage. All such data is suitably encrypted, and extraction of sensitive data from a lost or stolen device (such as messages and contacts) would be entirely dependent on knowledge of the user’s PIN (or at least seizing an unlocked device while the app is active and logged in). NCC Group Assessment of CryptTalk June 2015”
So won’t your technology be used by the really bad guys?
“The CryptTalk service is unlikely to be of interest to the bad guys for several reasons. It is a paid subscription service for which you have to register. You need to provide bank account or credit card details. We always reserve the right to withdraw the service from those users who engage in illegal activities. Their subscription is cancelled and the app simply doesn't work anymore. In short, we have a zero-tolerance policy towards the bad guys. We created the product in good faith because we believe personal privacy is important.”
“In fact I think everyone has the right to protect themselves from the bad guys. If you look at many offices today, there’s an elaborate virus scanner needed on many PC’s in order to protect them from malware from being installed on the outside. In addition, companies spend huge amounts of money building firewalls to prevent hackers breaking in and gaining access to confidential data exchanged on internal, private networks.
Secure international private networks
International private enterprise has its own special requirements. Let’s say you are a major multinational corporation with several offices and factories spread all over the world — in Europe, the Americas, but also operating in fragile states. You need to establish a highly-secure network between all those different sites and exchange private information (including encrypted voice data) over those channels. We have designed a custom solution for the international private enterprises. ”
Why should customers trust your development team in Budapest?
“There is a fast yet transparent process you need to follow in order to subscribe to CryptTalk.”
“As a private individual, you need to enter your Apple ID, which is connected to a credit card. As CryptTalk all we know is that this person is an authorized Apple subscriber — and we have a contact email address. At the start of each encrypted call we simply authenticate that you have a valid CryptTalk subscription. But, that’s all. We don’t know the frequency of the calls, where they originate, or anything about the encryption keys.”
“But we know our customers don’t just want to take our word for it. So we have been getting independent third-party security assessments, like the one just completed by the NCC Group. But we are also working with “ethical hackers” who also independently create audit reports. They get full documentation and a working “sand box” system for them to hack and find possible exploits. We've been working with the best — and so we can show our customers independent evidence to back our claims.”
“In the case of large corporate clients, we've also opened our documentation to other investigative agencies paid for by the client. Provided the client signs an NDA, we're happy to support any audit process. We've taken part in three extensive technical audits — and passed each with flying colours.”
There is NEVER any backdoor
“It is ironic that some governments have enquired about using our solution, but their laws require that public servants’ communication be monitored by the security agencies. It’s true that some of them lose interest when we reveal that our system can never provide a backdoor. Secure means that the contents of a call are secure from anybody outside that particular CryptTalk conversation. However, we have also met some government clients in the last few weeks who think differently, saying that everyone has a right to privacy — government officials will be judged by observing their actions not by monitoring their words over the phone.”
Subscriptions to CryptTalk start at US$9.99 a month for a personal subscription with up to 15 contacts. Recipients of encrypted calls need to install a free app available in the Apple App Store.
The app is currently available with interfaces that work in English, Chinese, Hungarian and Portuguese.
From left to right: Attila Megyeri Chief Technical Officer and co-founder & Szabolcs Kun, CEO and co-founder CryptTalk.