Skype is a Voice over Internet Protocol (VoIP) system developed by Skype Technologies S.A. It is a peer-to-peer network where voice calls pass over the Internet rather than through a special-purpose network. Skype users can search for other users and send them messages.
Skype reports that it uses 256 bit Advanced Encryption Standard (AES)/ Rijnadel encryption to communicate between Skype clients; although when calling a telephone or mobile, the part of the call over the public switched telephone network (PSTN) is not encrypted. User public keys are certified by the Skype server at login with 1536-bit or 2048-bit RSA certificates. Skype's encryption is inherent in the Skype Protocol and is transparent to callers. Some private conversations through Skype such as audio calls, text messages, and file sending (image, audio, or video) can make use of end-to-end encryption, but it may have to be manually turned on.
Security policy
The company's security policy states that:
Usernames are unique. Callers must present a username and password or another authentication credential. Each caller provides the other with proof of identity and privileges whenever a session is established. Each verifies the other's evidence before the session can carry messages. Messages transmitted between Skype users (with no PSTN users included) are encrypted from caller to caller. No intermediate node (router) has access to the meaning of these messages. This claim was undermined in May 2013 by evidence that Microsoft (owner of Skype) has pinged unique URLs embedded in a Skype conversation; this could only happen if Microsoft has access to the unencrypted form of these messages.
Implementation and protocols
Registration
Skype holds registration information both on the caller's computer and on a Skype server. Skype uses this information to authenticate call recipients and assure that callers seeking authentication access a Skype server rather than an impostor. Skype says that it uses public-key encryption as defined by RSA to accomplish this.
The Skype server has a private key and distributes that key's public counterpart with every copy of the software. As part of user registration, the user selects a desired username and password. Skype locally generates public and private keys. The private key and a password hash are stored on the user's computer.
Then a 256-bit AES-encrypted session is established with the Skype server. The client creates a session key using its random number generator.
The Skype server verifies that the selected username is unique and follows Skype's naming rules. The server stores the username and a hash of the user's password [ H ( H ( P ) ) ] { \displaystyle [H(H(P))]} in its database.
The server now forms and signs an identity certificate for the username that binds the username, verification key, and key identifier.
Peer-to-peer key agreement
For each call, Skype creates a session with a 256-bit session key. This session exists as long as communication continues and for a fixed time afterward. Skype securely transmits the session key to the call recipient as part of connecting a call. That session key is then used to encrypt messages in both directions.
Session cryptography
Session cryptography
All traffic in a session is encrypted using the AES algorithm running in Integer Counter Mode (ICM). Skype encrypts the current counter and salt with the session key using the 256 bit AES algorithm. This algorithm returns the keystream, then XORed with the message content. Skype sessions contain multiple streams. The ICM counter depends on the stream and the location within the stream.
Random number generation
Skype uses random numbers for several cryptographic purposes. Purposes include protection against playback attacks, creation of RSA key pairs, and creation of AES key-halves for content encryption. The security of a Skype peer-to-peer session depends significantly on the quality of the random numbers generated by both ends of the Skype session. Random number generation varies by the operating system.
Cryptographic primitives
Skype uses standard cryptographic primitives to achieve its security goals. The cryptographic primitives used in Skype are the AES block cipher, the RSA public-key cryptosystem, the ISO 9796-2 signature padding scheme, the SHA-1 hash function, and the RC4 stream cipher.