Want to know what's happening as your information flows from your computer across the internet? Here we detail some of the technical wizardry – get your geek head on...
The following section provides detailed information on some of Skype's security controls, such as our use of cryptography and how it is used to protect your digital identity and conversations.
Jump to a section
Encryption overview
The internet, like any network, can be monitored by criminals and hackers at any number of points. This is one of the reasons why email and many internet chat programs are not secure. As there are so many ways for unknown persons to monitor your communications, you must take positive steps to protect yourself from these malicious third parties.
Encryption is the process of converting information, using principles of mathematics, in such a way that it is readable only by the intended recipient after they have converted the information back. Many kinds of encryption techniques have been developed over the centuries. This process is called encryption and decryption and forms part of the security discipline called cryptography.
As far back as 1900 BC the Egyptians utilized non standard hieroglyphs to protect a message; whilst the Greeks in 490 BC used strips of leather wrapped around a specific length and width of staff. This process of disguising a message is called cryptography. Julius Caesar possibly created and used the world’s first substitution cipher. Through shifting each letter a fixed amount, for example 'a' becoming 'e', 'b' becoming 'f' and so on, resulted in unintelligible words and messages. The approach of applying rules to a message and the result of a separate encoded message is called a cipher. The key to unlocking the hidden message was knowing the offset of which to shift the letters; forward to encode and backwards to decode.
These ciphers, whilst primitive now, were at the forefront of cryptography at their time but as with any advancement greater technological resources and knowledge can be used both to further a subject but also to work against it. As past ciphers can now be defeated trivially, modern ciphers must also continue to evolve.
Here at Skype we use standard internationally recognized and accepted encryption algorithms that have withstood the test of time over many years of analysis and attacks. This protects your communications from falling into the hands of hackers and criminals. In so doing, we help ensure your privacy as well as the integrity of the data being sent from you to your contacts.
Digital Identity and Encryption in Skype
One of Skype's main goals is to protect you from malicious attackers eavesdropping on your communications. In addition, we want to prevent the kind of impersonation that fraudsters often use over email (for instance phishing) to trick users into giving up valuable personal information.
To achieve these goals, Skype issues everyone a "digital certificate" which is used to establish and confirm both the identity of the person placing and receiving a Skype call or chat.
What is a Digital Certificate?
A digital certificate is an electronic credential that can be used to establish the identity of a Skype user, wherever that user may be located. Just like a physical identity document, such as a driving license, a digital certificate must have certain properties in order to be used as a form of identification. In particular, it must:
- Name the specific account being identified.
- Be issued by an authority that can revoke the certificate at any time.
- Be difficult to counterfeit.
- Contain the countersignature of the issuing authority, which, in this case, is Skype.
Authentication
As each Skype user possesses a digital credential, it is possible for any Skype user to verify the identity of any other Skype user. This process is called authentication, the proving of each party's identity to the other. In order to gain access to this digital certificate your Skype Name and password is confirmed. It is therefore imperative that you follow our guidelines for keeping your Skype Name and password secure.
Authentication is a critical step in ensuring secure communications. Imagine having a conversation with someone who claimed to be a business partner, but who is actually an impostor. The conversation could be strongly encrypted as normal yet the divulging of private information could still occur.
Encryption
Communications networks, such as the internet, can be monitored by criminals and hackers at any number of points. This is one of the reasons why email and many internet chat programs are considered unsafe from a security point of view. In other words, because there are so many ways for unknown persons to monitor users' communications, users must take positive steps to protect themselves from this type of intrusion.
Encryption is the process of encoding a message, using principles of mathematics, in such a way that it is readable only by the intended recipient. Many kinds of encryption techniques have been developed over the centuries, but they all tend to resemble a lockbox and key; once a secret message is put into the lockbox and secured with the key, it can only be read again by someone possessing the same key. The key can be something known or even a physical object, such as the length and width staff as mentioned above. For Skype your key is your Skype Name and password, hence the criticality of keeping that safe.
Skype uses well-known standards-based encryption algorithms to protect Skype users' communications from falling into the hands of hackers and criminals. In so doing, Skype helps ensure user's privacy as well as the integrity of the data being sent from one user to another.
What is VoIP?
Check out this page for information on VoIP calls. And if you’d like to know a little about how VoIP calls happen, check out the P2P telephony explained article.
Independent security review
This review of Skype’s encryption provides a detailed review of the security framework that is incorporated into Skype products. Skype provides its users with protections against a wide range of possible attacks, such as impersonation, eavesdropping, man-in-the-middle attacks and the modification of data while in transit.
The report describes the general protective mechanisms that are in use throughout Skype’s infrastructure as well as the general security policy that defines the basis for all designs within Skype’s operational framework.
