IAX encryption

As of asterisk version 1.2.4 (maybe before) there is a rather undocumented channel encryption feature included in chan_iax2. After successful authentication the whole channel including control data and voice data is encrypted with AES128. The encryption can be activated by adding the line

  encryption=aes128
or
  encryption=yes

respectively to your iax.conf. For the encryption to be functional you have to use MD5 authentication since one is based upon the other in this particular implementation!

Note: The calling/called numbers are still passed in the clear over encrypted IAX, so you are still vulnerable to traffic analysis.
If you also care about concealing the dialed number you can do it just fine. The simplest way is to have a single exten that takes all encrypted calls, then once the call is up, dial 'onwards' with DTMF, the DTMF frames would be encrypted.

The IAX encryption scheme is documented in the draft RFC at:
http://mirror.switch.ch/ftp/mirror/internet-drafts/draft-guy-iax-03.txt

Example

For example, consider the following scenario:
alice (192.168.25.10) <-----> bob (192.168.25.11)

iax.conf on alice:


iax.conf on bob:

Debugging

In order to verify the correct configuration you could use the following CLI command:

The "(E)" indicates our encryption feature. Unfortunately the "(E)" also appears when using other authentication methods than MD5, however the actual encryption is NOT operational in this case.

If you would like to see the encryption in action, try the debug output in "logger.conf" and issue the following CLI commands:


the debug output of our control data looks like this:


... and the voice data:

See also

• IAX_OpenVPN
• Asterisk encryption