Jump to content

Archive:Skype protocol: Difference between revisions

From IdeaWazaWiki
← Older edit

Waza (talk | contribs)

1 user group
1,042 edits
changing adverb "in" and preposition "to" —> preposition "into"—wikt:in—wikt:wikt:to—wikt:into—http://public.wsu.edu/~brians/errors/into.html—User:Wavelength/About English/Expressions "into" and "in to"
m 50 revisions imported: Import with full history
 
(47 intermediate revisions by 35 users not shown)
Line 1: Line 1:
{{Multiple issues|
<!-- Please do not remove or change this AfD message until the discussion has been closed. -->
{{Cleanup rewrite|the article is too technical in its nature (see Talk Page)|date=August 2009}}
{{Article for deletion/dated|page=Skype protocol|timestamp=20261023092959|year=2026|month=October|day=23|substed=yes|help=off|outcome=merging|target=Skype}}
{{original research|date=May 2009}}
<!-- Once discussion is closed, please place on talk page: {{Old AfD multi|page=Skype protocol|date=23 October 2026|result='''keep'''}} -->
{{cleanup|date=May 2009}}
<!-- End of AfD message, feel free to edit beyond this point -->
{{Update|date=May 2016}}
{{Multiple issues|{{original research|date=May 2009}}
}}
{{Update|date=May 2016}}}}
 
{{short description|Proprietary Internet telephony network}}
{{Skype Limited}}
{{Skype Limited}}
The '''Skype protocol''' is a [[proprietary protocol|proprietary]] Internet telephony network based on [[peer-to-peer]] architecture, used by [[Skype]]. The protocol's specifications have not been made publicly available by Skype and official applications using the protocol are [[closed-source]].
The '''Skype protocol''' is a discontinued [[proprietary protocol|proprietary]] network used for Internet telephony. Its specifications are not publicly available, and all official applications based on the protocol are [[closed-source]]. It lacks [[interoperability]] with most [[Voice over IP]] (VoIP) networks, so it would require licensing from [[Skype Technologies|Skype]] for any integration.
 
The Skype network is not [[interoperable]] with most other [[Voice over IP]] (VoIP) networks without proper licensing from Skype. Numerous attempts to study and/or [[reverse engineering|reverse engineer]] the protocol have been undertaken to reveal the protocol, investigate security or to allow unofficial clients.


On June 20, 2014, Microsoft announced the deprecation of the old Skype protocol. Within several months from this date, in order to continue using Skype services, Skype users had to update to Skype applications released in 2014, and users were not able to log into older Skype versions (clients).<ref>{{cite web|url=https://blogs.skype.com/news/2014/06/20/making-way-for-the-next-generation-of-skype-on-desktop/|title=Making Way for the Next Generation of Skype on Desktop|date=20 June 2014|publisher=}}</ref><ref>{{cite web|url=http://www.computerworld.com/s/article/9249275/Update_Skype_to_retire_recent_editions_for_Windows_Mac_upgrades_mandatory|title=Update: Skype to retire recent editions for Windows, Mac; upgrades mandatory|first=Gregg|last=Keizer|publisher=}}</ref> No announcement has been made on whether SmartTV and hardware phones with built-in Skype functionality will continue to work without interruptions. The new Skype protocol - [[Microsoft Notification Protocol#MSNP24|Microsoft Notification Protocol 24]] - promised better offline messaging and better messages synchronization across Skype devices. The deprecation became effective in the second week of August, 2014.<ref>{{cite web|title=Skype stops working on older Android phones leaving Linux users in the dark|url=http://www.theinquirer.net/inquirer/news/2360604/skype-stops-working-on-older-android-phones-leaving-linux-users-in-the-dark|publisher=[[CNET]]|accessdate=2 October 2014|author=Chris Merrimen|date=15 August 2014}}</ref>
Many attempts to [[reverse engineering|reverse-engineer]] the protocol have been made to study its security features or to enable unofficial clients. On June 20, 2014, [[Microsoft]] announced that the old Skype protocol would be deprecated. Users had to upgrade to the 2014 version of Skype to continue accessing services, and older clients could no longer [[Login|log in]].<ref>{{cite web |date=20 June 2014 |title=Making Way for the Next Generation of Skype on Desktop |url=https://blogs.skype.com/news/2014/06/20/making-way-for-the-next-generation-of-skype-on-desktop/}}</ref><ref>{{cite web |last=Keizer |first=Gregg |date=21 June 2014 |title=Update: Skype to retire recent editions for Windows, Mac; upgrades mandatory |work=Computerworld |url=http://www.computerworld.com/s/article/9249275/Update_Skype_to_retire_recent_editions_for_Windows_Mac_upgrades_mandatory |access-date=25 June 2014 |archive-date=8 August 2014 |archive-url=https://web.archive.org/web/20140808064037/http://www.computerworld.com/s/article/9249275/Update_Skype_to_retire_recent_editions_for_Windows_Mac_upgrades_mandatory |url-status=dead }}</ref> As of the second week of August 2014, the new protocol, [[Microsoft Notification Protocol#MSNP24|Microsoft Notification Protocol 24]], was implemented to improve offline messaging and message synchronization across devices.<ref>{{cite web |author=Chris Merrimen |date=15 August 2014 |title=Skype stops working on older Android phones leaving Linux users in the dark |url=http://www.theinquirer.net/inquirer/news/2360604/skype-stops-working-on-older-android-phones-leaving-linux-users-in-the-dark |url-status=unfit |archive-url=https://web.archive.org/web/20140816183820/http://www.theinquirer.net/inquirer/news/2360604/skype-stops-working-on-older-android-phones-leaving-linux-users-in-the-dark |archive-date=August 16, 2014 |access-date=2 October 2014 |publisher=[[CNET]]}}</ref>


==Peer-to-peer architecture==
==Peer-to-peer architecture==
Skype was the first [[peer-to-peer]] IP telephony network.<ref>Page 11 in {{cite arXiv |eprint=cs/0412017v1 |title= An analysis of the Skype peer-to-peer Internet telephony protocol |class= cs.NI |year= 2004 |version= |accessdate= |author1= Salman A. Baset |author2= Henning Schulzrinne }}</ref> The network contains three types of entities: ''[[Supernode (networking)|supernodes]]'', ordinary nodes, and the login server. Each client maintains a ''host cache'' with the [[IP address]] and port numbers of reachable supernodes. The Skype user directory is decentralized and distributed among the supernodes in the network.
Skype pioneered [[peer-to-peer]] (P2P) technology for IP telephony.<ref>{{cite arXiv |eprint=cs/0412017v1 |author1=Salman A. Baset |author2=Henning Schulzrinne |title=An analysis of the Skype peer-to-peer Internet telephony protocol |year=2004 |page=11}}</ref> Its architecture includes [[Supernode (networking)|supernodes]], ordinary nodes, and a login server. Each client maintains a cache of reachable supernodes, while user directory data is distributed across these supernodes, organized into slots and blocks.{{cn|date=November 2022}}
 
Previously any client with good bandwidth, no restrictions due to [[firewall (networking)|firewall]] or [[network address translation]] (NAT), and adequate processing power could become a supernode. This placed an extra burden on those who connected to the Internet without NAT, as Skype used their computers and Internet connections as third parties for [[UDP hole punching]] (to directly connect two clients both behind NAT) or to completely relay other users' calls. In 2012, Microsoft altered the design of the network, and brought all supernodes under their control as hosted servers in data centres.<ref>{{cite news|last=Branscombe|first=Mary|title=Forget the conspiracy theories: Skype's supernodes belong in the cloud|url=http://www.zdnet.com/forget-the-conspiracy-theories-skypes-supernodes-belong-in-the-cloud-7000001720/|accessdate=17 June 2013|newspaper=500 words into the future (ZDNet)|date=27 July 2012}}</ref>  Microsoft at the time defended the move, saying they "believe this approach has immediate performance, scalability and availability benefits for the hundreds of millions of users that make up the Skype community."<ref>{{cite news|title=Skype replaces P2P supernodes with Linux boxes hosted by Microsoft (updated)|url=http://arstechnica.com/business/2012/05/skype-replaces-p2p-supernodes-with-linux-boxes-hosted-by-microsoft/|accessdate=17 June 2013|newspaper=Ars Technica|date=2 May 2012}}</ref> At the time there was some concern regarding the privacy implications of the change,<ref>{{cite news|last=Kosner|first=Anthony|title=Will Microsoft's Changes To The Architecture Of Skype Make It Easier To Snoop?|url=http://www.forbes.com/sites/anthonykosner/2012/07/18/did-microsoft-change-the-architecture-of-skype-to-make-it-easier-to-snoop/|accessdate=17 June 2013|newspaper=Forbes blog|date=18 July 2012}}</ref> which appear to have been proven true with the revelation of the [[PRISM (surveillance program)|PRISM]] surveillance program in June 2013.<ref>{{cite news|last=Gallagher|first=Ryan|title=Newly Revealed PRISM Snooping Makes Verizon Surveillance Look Like Kids' Stuff|url=http://www.slate.com/blogs/future_tense/2013/06/06/nsa_prism_surveillance_private_data_from_google_microsoft_skype_apple_yahoo.html|accessdate=17 June 2013|newspaper=Slate blog|date=6 June 2013}}</ref><ref>{{cite news|last=Greenwald|first=Glenn|title=NSA Prism program taps in to user data of Apple, Google and others|url=https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data|accessdate=17 June 2013|newspaper=The Guardian|date=7 June 2013}}</ref>
 
Skype does not support the use of the [[IPv6]] protocol,<ref>{{cite web|url=https://twitter.com/SkypeTalks/status/264057558262747136|title=Skype does not support IPv6.|publisher=Skype official Twitter account|date=1 Nov 2012|accessdate=4 Nov 2012}}</ref> which would greatly reduce the complexity associated with the aforementioned IPv4 communication structure.


Supernodes relay communications on behalf of two other  clients, both of which are behind firewalls or "one-to-many" network address translation.
Initially, any client with sufficient bandwidth and processing power could become a supernode. This setup posed challenges for users behind [[firewall (networking)|firewalls]] or [[Network address translation|Network Address Translation]] (NAT) because their connections could be used to facilitate calls between other clients. In 2012, Microsoft transitioned control of supernodes to its data centers to enhance performance and scalability,<ref>{{cite news |last=Branscombe |first=Mary |date=27 July 2012 |title=Forget the conspiracy theories: Skype's supernodes belong in the cloud |url=https://www.zdnet.com/article/forget-the-conspiracy-theories-skypes-supernodes-belong-in-the-cloud/ |access-date=17 June 2013 |newspaper=500 words into the future (ZDNet)}}</ref><ref>{{cite news |date=2 May 2012 |title=Skype replaces P2P supernodes with Linux boxes hosted by Microsoft (updated) |url=https://arstechnica.com/business/2012/05/skype-replaces-p2p-supernodes-with-linux-boxes-hosted-by-microsoft/ |access-date=17 June 2013 |newspaper=Ars Technica}}</ref> raising privacy concerns<ref>{{cite news |last=Kosner |first=Anthony |date=18 July 2012 |title=Will Microsoft's Changes To The Architecture Of Skype Make It Easier To Snoop? |url=https://www.forbes.com/sites/anthonykosner/2012/07/18/did-microsoft-change-the-architecture-of-skype-to-make-it-easier-to-snoop/ |access-date=17 June 2013 |newspaper=Forbes blog}}</ref> that were later highlighted by the [[PRISM (surveillance program)|PRISM]] surveillance revelations in 2013.<ref>{{cite news |last=Gallagher |first=Ryan |date=6 June 2013 |title=Newly Revealed PRISM Snooping Makes Verizon Surveillance Look Like Kids' Stuff |url=http://www.slate.com/blogs/future_tense/2013/06/06/nsa_prism_surveillance_private_data_from_google_microsoft_skype_apple_yahoo.html |access-date=17 June 2013 |newspaper=Slate blog}}</ref><ref>{{cite news |last=Greenwald |first=Glenn |author-link=Glenn Greenwald |date=7 June 2013 |title=NSA Prism program taps in to user data of Apple, Google and others |url=https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data |access-date=17 June 2013 |newspaper=The Guardian}}</ref>
Without relaying by the supernodes, two clients with firewall or NAT difficulties would be unable to make or receive calls from one another. Skype tries to get the two ends to negotiate the connection details directly, but sometimes the sum of problems at both ends can prevent direct conversation being established.


The problems with firewalls and NAT can be:
Skype does not support [[IPv6]],<ref>{{cite web |date=1 Nov 2012 |title=Skype does not support IPv6. |url=https://twitter.com/SkypeTalks/status/264057558262747136 |access-date=4 Nov 2012 |publisher=Skype official Twitter account}}</ref> which could simplify its communication infrastructure.
*  The external port numbers or IP address are not derivable, because NAT rewrites them
*  The firewall and NAT in use prevents the session being received
*  UDP is not usable due to NAT issues, such as timeout
*  Firewalls block many ports
*  TCP through many-to-one NAT is always "outward only" by default – adding port-forwarding  settings to the NAT router can allow reception of TCP sessions


Supernodes are grouped into ''slots'' (9–10 supernodes), and slots are grouped into ''blocks'' (8 slots).
=== Communication challenges ===
Supernodes relay communications for clients that are behind firewalls or NAT, enabling calls that would otherwise be impossible. However, issues may arise, such as:


==Protocol==
* Non-derivable external port numbers or IP addresses due to NAT
Signaling is encrypted using [[RC4]]; however, the method only obfuscates the traffic as the key can be recovered from the packet. Voice data is encrypted with [[Advanced Encryption Standard|AES]].<ref>[http://www.ossir.org/windows/supports/2005/2005-11-07/EADS-CCR_Fabrice_Skype.pdf Introduction Skype analysis Enforcing anti-Skype policies], Skype uncovered Security study of Skype, Desclaux Fabrice, 7/11/2005, EADS CCR/STI/C</ref>
* Firewalls blocking incoming sessions
* UDP issues like timeouts
* Port restrictions


The Skype client's [[application programming interface]] (API) opens the network to software developers. The Skype API allows other programs to use the Skype network to get "[[white pages]]" information and manage calls.
==Protocol details==
Signaling in Skype is encrypted using [[RC4]], but this method is considered weak because the encryption key can be recovered from the traffic. Voice data is protected with [[Advanced Encryption Standard|AES]] encryption.<ref>[http://www.ossir.org/windows/supports/2005/2005-11-07/EADS-CCR_Fabrice_Skype.pdf Introduction Skype analysis Enforcing anti-Skype policies], Skype uncovered Security study of Skype, Desclaux Fabrice, 7/11/2005, EADS CCR/STI/C</ref> The Skype [[API]] allows developers to access the network for user information and call management.


The Skype code is [[closed source]], and the protocol is not standardized.<ref>http://support.skype.com/en_US/faq/FA153/Which-protocols-does-Skype-use {{webarchive |url=https://web.archive.org/web/20090303112252/http://support.skype.com/en_US/faq/FA153/Which-protocols-does-Skype-use |date=March 3, 2009 }}</ref> Parts of the client use [[Internet Direct (Indy)]], an open source socket communication library.{{Citation needed|date=December 2008}}
The code remains closed-source,<ref>{{cite web |title=Which protocols does Skype use? |url=http://support.skype.com/en_US/faq/FA153/Which-protocols-does-Skype-use |archive-url=https://web.archive.org/web/20090303112252/http://support.skype.com/en_US/faq/FA153/Which-protocols-does-Skype-use |archive-date=March 3, 2009 |website=Help |publisher=Skype}}</ref> and parts of the client utilize an open-source socket communication library called  [[Internet Direct (Indy)]].{{Citation needed|date=December 2008}}


On July 8, 2012, a researcher from Benin, Ouanilo Medegan, released articles and proof of concept code, results of his reverse engineering the Skype client.<ref>http://www.oklabs.net/category/skype-reverse/ http://www.oklabs.net/skype-reverse-engineering-the-long-journey/</ref>
In July 2012, a researcher revealed insights gained from reverse-engineering the Skype client.<ref>{{cite web |title=Posts under Skype Reverse Category |url=http://www.oklabs.net/category/skype-reverse/ |website=oKLabs}}<br />{{cite web |title=Skype Reverse Engineering: The (long) journey ;).. |url=http://www.oklabs.net/skype-reverse-engineering-the-long-journey/ |website=oKLabs}}</ref>


===Protocol detection===
===Protocol detection===
Various networking and security firms claim to have methods for detecting Skype's protocol. While their specific methods are proprietary, some published techniques include [[Pearson's chi-squared test]] and stochastic characterization using [[Naive Bayes classifier]]s.<ref>{{cite journal |author=Dario Bonfiglio |display-authors=etal |title=Revealing Skype Traffic: When Randomness Plays with You |url=https://www.dpacket.org/articles/revealing-skype-traffic-when-randomness-plays-you |url-status=dead |journal=ACM SIGCOMM Computer Communication Review |volume=37 |issue=SIGCOMM 2007 |pages=37–48 |archive-url=https://web.archive.org/web/20110430074127/https://www.dpacket.org/articles/revealing-skype-traffic-when-randomness-plays-you |archive-date=2011-04-30}}</ref>


Many networking and security companies claim to detect and control Skype's protocol for enterprise and carrier applications. While the specific detection methods used by these companies are often proprietary, [[Pearson's chi-squared test]] and stochastic characterization with [[Naive Bayes classifier]]s are two approaches that were published in 2007.<ref>[https://www.dpacket.org/articles/revealing-skype-traffic-when-randomness-plays-you Dario Bonfiglio et al. “Revealing Skype Traffic: When Randomness Plays with You,” ACM SIGCOMM Computer Communication Review, Volume 37:4 (SIGCOMM 2007), p. 37–48]</ref>
==Obfuscation layer==
Skype employs [[RC4]] to obfuscate the payload of data packets. The [[initialization vector]] (IV) is derived from a combination of the public source and destination IPs and a packet ID, transformed into an RC4 key.


====Preliminaries====
Notably, the misuse of RC4 can occur on TCP streams, where the first 14 bytes of a stream are XOR-ed with the RC4 stream, impacting data security.<ref>{{cite conference |author1=Fabrice Desclaux |author2=Kostya Kortchinsky |date=2006-06-17 |title=Vanilla Skype part 2 |url=http://www.recon.cx/en/f/vskype-part2.pdf |book-title=RECON2006}}</ref>


Abbreviations that are used:
== Packet structure and compression ==
* SN: Skype network
Most Skype traffic is encrypted, with commands and their parameters organized in an object list that can be compressed using a variant of [[arithmetic coding|arithmetic compression]].
* SC: Skype client
* HC: host cache


====Skype client====
==Legal considerations==
The terms of Skype's license agreement prohibit reverse engineering. However, [[European Union|EU]] law allows for reverse engineering for interoperability purposes,<ref>[http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:111:0016:01:EN:HTML Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs]</ref> and the U.S. [[Digital Millennium Copyright Act]] provides similar protections.<ref>17 U.S.C. Sec. 1201(f).</ref><ref>[[WIPO Copyright and Performances and Phonograms Treaties Implementation Act]]</ref><ref>{{cite journal |author=Pamela Samuelson |author-link=Pamela Samuelson |author2=Suzanne Scotchmer |name-list-style=amp |date=May 2002 |title=The Law and Economics of Reverse Engineering |url=http://www.yalelawjournal.org/pdf/111-7/SamuelsonFINAL.pdf |url-status=dead |journal=Yale Law Journal |volume=111 |issue=7 |pages=1575–1663 |doi=10.2307/797533 |jstor=797533 |archive-url=https://web.archive.org/web/20110716095222/http://www.yalelawjournal.org/pdf/111-7/SamuelsonFINAL.pdf |archive-date=2011-07-16 |access-date=2015-03-17}}</ref> Certain countries also permit copying for reverse engineering.<ref>In the French "intellectual property" law set, there is an exception that allows any software user to reverse engineer it. See [http://legifrance.gouv.fr/affichCodeArticle.do?cidTexte=LEGITEXT000006069414&idArticle=LEGIARTI000006278920&dateTexte=20080329&categorieLien=cid ''code de la propriété intellectuelle''] {{in lang|fr}}. This law is the national implementation of a piece of EU legislation: [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31991L0250:EN:NOT Council Directive 91/250/EEC], since then repealed by [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32009L0024:EN:NOT Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs] which also has a very similar provision allowing reverse engineering/decompilation for the purposes of development and testing of independent but inter-operating programs).</ref> (See also [[Sega v. Accolade]] and [[Sony Computer Entertainment, Inc. v. Connectix Corp.|Sony v. Connectix]].)


The main functions of a Skype client are:
==References==
* login
* user search
* start and end calls
* media transfer
* presence messages
* video conference
 
===Login===
A Skype client [[authentication|authenticates]] the user with the login server, advertises its presence to other peers, determines the type of NAT and firewall it is behind and discovers nodes that have public IP addresses.
 
To connect to the Skype network, the host cache must contain a valid entry. A [[Transmission Control Protocol|TCP]] connection must be established (i.e. to a supernode) otherwise the login will fail.
Here hc means host cache i.e. the information that a skype client stores about the list of supernodes(sc)
  1.  start
  2.  send [[User Datagram Protocol|UDP]] packet(s) to HC
  3.  if no response within 5 seconds then
  4.    attempt TCP connection with HC
  5.    if not connected then
  6.      attempt TCP connection with HC on port 80 (HTTP)
  7.      if not connected then
  8.        attempt TCP connection with HC on port 443 (HTTPS)
  9.        if not connected then
10.          attempts++
11.          if attempts == 5 then
12.            fail
13.          else
14.            wait 6 seconds
15.            goto step 2
16.  Success
 
After a Skype client is connected it must authenticate the username and password with the Skype login server. There are many different Skype login servers using different [[Computer port (software)|ports]]. An [[obfuscate]]d list of servers is hardcoded in the Skype executable.
 
Skype servers are:
{{colbegin|4}}
* dir1.sd.skype.net:9010
* dir2.sd.skype.net:9010
* dir3.sd.skype.net:9010
* dir4.sd.skype.net:9010
* dir5.sd.skype.net:9010
* dir6.sd.skype.net:9010
* dir7.sd.skype.net:9010
* dir8.sd.skype.net:9010
* http1.sd.skype.net:80
* http2.sd.skype.net:80
* http3.sd.skype.net:80
* http4.sd.skype.net:80
* http5.sd.skype.net:80
* http6.sd.skype.net:80
* http7.sd.skype.net:80
* http8.sd.skype.net:80
{{colend}}
 
Skype-SW connects randomly to 1–8.
 
On each login session, Skype generates a session key from 192 random bits. The session key is encrypted with the hard-coded login server's 1536-bit public [[RSA (algorithm)|RSA]] key to form an encrypted session key. Skype also generates a 1024-bit private/public RSA key pair. An [[MD5]] hash of a concatenation of the user name, constant string ("\nSkyper\n") and password is used as a shared secret with the login server. The plain session key is hashed into a 256-bit AES key that is used to encrypt the session's public RSA key and the shared secret. The encrypted session key and the AES encrypted value are sent to the login server.
 
On the login server side, the plain session key is obtained by decrypting the encrypted session key using the login server's private RSA key. The plain session key is then used to decrypt the session's public RSA key and the shared secret. If the shared secret match, the login server will sign the user's public RSA key with its private key. The signed data is dispatched to the super nodes.
 
Upon searching for a buddy, a super node will return the buddy's public key signed by Skype. The SC will authenticate the buddy and agree on a session key by using the mentioned RSA key.
 
==UDP==
UDP packets:
IP
UDP
Skype SoF
Skype Crypted Data01
The Start of Frame (SoF) consists of:
# frame ID number (2 bytes)
# payload type (1 byte)
#* obfuscated payload
#* Ack/NAck packet
#* payload forwarding packet
#* payload resending packet
#* other
 
==Obfuscation Layer==
The [[RC4]] encryption algorithm is used to obfuscate the payload of datagrams.
# The [[Cyclic redundancy check|CRC32]] of public source and destination IP, Skype's packet ID are taken
# Skype obfuscation layer's [[initialization vector]] (IV).
The XOR of these two 32-bit values is transformed to an 80-byte RC4 key using an unknown key engine.
 
A notable misuse of RC4 in Skype can be found on TCP streams (UDP is unaffected). The first 14 bytes (10 of which are known to the user, since they consist of a hash of the username and password) are XOR-ed with the RC4 stream. Then, the cipher is reinitialized to encrypt the rest of the TCP stream.<ref>{{cite conference |author1=Fabrice Desclaux |author2=Kostya Kortchinsky |date=2006-06-17 |title=Vanilla Skype part 2 |booktitle=RECON2006 |url=http://www.recon.cx/en/f/vskype-part2.pdf }}</ref>
 
==TCP==
TCP packets:
TCP
Skype Init TCP packet
 
The Skype Init TCP packet contains
* the seed (4 bytes)
* init_str string 00 01 00 00 01 00 00 00 01/03
 
==Low-level datagrams==
Almost all traffic is ciphered. Each command has its parameters appended in an object list. The object list can be compressed.
                                  / Object List    ... -|
        Enc      -> Cmd -> Encod
                      ^          \ Compressed List ... -|
        Frag        |                                  |
                      |------------------<---------------|
        Ack
 
        NAck
 
        Forward  -> Forwarded..Message
 
===Object Lists===
An object can be a number, string, an IP:port, or even another object list.  Each object has an ID.  This ID identifies which command parameter the object is.
 
  Object:
          Number
          IP:Port
          List of numbers
          String
          RSA key
 
  Object List
          List Size (n)
          Object 1
          .
          .
          Object n
 
===Packet compression===
Packets can be compressed. The algorithm is a variation of [[arithmetic coding|arithmetic compression]] that uses reals instead of bits.
 
==Legal issues==
 
[[Reverse engineering#Legality|Reverse engineering]] of the Skype protocol by inspecting/disassembling binaries is prohibited by the terms and conditions of Skype's license agreement. However European Union law allows reverse-engineering a computer program without getting a permission from an author for inter-operability purposes.<ref>[http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:111:0016:01:EN:HTML Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs]</ref> In the United States, the [[Digital Millennium Copyright Act]] provides protections for reverse engineering software for the purposes of interoperability with other software.<ref>17 U.S.C. Sec. 1201(f).</ref><ref>[[WIPO Copyright and Performances and Phonograms Treaties Implementation Act]]</ref> There are also legal precedents in the United States when the reverse-engineering is aimed at interoperability of file formats and protocols.<ref>Sega vs Accolade, 1992</ref><ref>Sony vs Connectix, 2000</ref><ref>[[Pamela Samuelson]] and Suzanne Scotchmer, "The Law and Economics of Reverse Engineering", 111 ''Yale Law Journal'' 1575-1663 (May 2002) [http://www.yalelawjournal.org/pdf/111-7/SamuelsonFINAL.pdf]</ref>
 
In addition, some countries specifically permit a program to be copied for the purposes of reverse engineering.<ref>In the French "intellectual property" law set, there is an exception that allows any software user to reverse engineer it. See [http://legifrance.gouv.fr/affichCodeArticle.do?cidTexte=LEGITEXT000006069414&idArticle=LEGIARTI000006278920&dateTexte=20080329&categorieLien=cid ''code de la propriété intellectuelle''] {{fr}}. This law is the national implementation of a piece of EU legislation: [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31991L0250:EN:NOT Council Directive 91/250/EEC], since then repealed by [http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32009L0024:EN:NOT Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs] which also has a very similar provision allowing reverse engineering/decompilation for the purposes of development and testing of independent but inter-operating programs).</ref>
 
==Notes==
{{Reflist|30em}}
{{Reflist|30em}}


==References==
==Other sources==
{{Refbegin}}
{{Refbegin}}
* {{cite arXiv |eprint=cs/0412017v1 |title= An analysis of the Skype peer-to-peer Internet telephony protocol |class= cs.NI |year= 2004 |version= |accessdate= |author1= Salman A. Baset |author2= Henning Schulzrinne }}
* {{Cite web|author1=P. Biondi  |author2=F. Desclaux  |name-list-style=amp | title = Silver Needle in the Skype | url = https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf | date = March 3, 2006}}
* {{Cite web|author1=P. Biondi  |author2=F. Desclaux  |lastauthoramp=yes | title = Silver Needle in the Skype | url = https://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf | date = March 3, 2006}}
* {{Cite web|author1=F. Desclaux  |author2=K. Kortchinsky  |name-list-style=amp | title = Vanilla Skype - part 1 | url = http://www.recon.cx/en/f/vskype-part1.pdf| date = June 6, 2006}}
* {{Cite web|author1=F. Desclaux  |author2=K. Kortchinsky  |lastauthoramp=yes | title = Vanilla Skype - part 1 | url = http://www.recon.cx/en/f/vskype-part1.pdf| date = June 6, 2006}}
* {{Cite web|author1=F. Desclaux  |author2=K. Kortchinsky  |name-list-style=amp | title = Vanilla Skype - part 2 | url = http://www.recon.cx/en/f/vskype-part2.pdf| date = June 17, 2006}}
* {{Cite web|author1=F. Desclaux  |author2=K. Kortchinsky  |lastauthoramp=yes | title = Vanilla Skype - part 2 | url = http://www.recon.cx/en/f/vskype-part2.pdf| date = June 17, 2006}}
* {{Cite web|author1=L. De Cicco |author2=S. Mascolo |author3=V. Palmisano | title = An Experimental Investigation of the Congestion Control Used by Skype VoIP. | work = WWIC 07 | publisher = Springer | date = May 2007 | url = http://c3lab.poliba.it/images/d/d2/Skype_wwic07.pdf}}
* {{Cite web|author1=L. De Cicco |author2=S. Mascolo |author3=V. Palmisano | title = An Experimental Investigation of the Congestion Control Used by Skype VoIP. | work = WWIC 07 | publisher = Springer | date = May 2007 | url = http://c3lab.poliba.it/images/d/d2/Skype_wwic07.pdf}}
* {{Cite web|author1=L. De Cicco |author2=S. Mascolo |author3=V. Palmisano | title = A Mathematical Model of the Skype VoIP Congestion Control Algorithm. | work = Proc. of IEEE Conference on Decision and Control 2008 | date = December 9–11, 2008 | url = http://c3lab.poliba.it/images/2/22/Skype_voip_model.pdf }}
* {{Cite web|author1=L. De Cicco |author2=S. Mascolo |author3=V. Palmisano | title = A Mathematical Model of the Skype VoIP Congestion Control Algorithm. | work = Proc. of IEEE Conference on Decision and Control 2008 | date = December 9–11, 2008 | url = http://c3lab.poliba.it/images/2/22/Skype_voip_model.pdf }}
Line 202: Line 63:
* [http://kirils.org/skype/ Website containing articles and tools related to Skype protocol and behaviour analysis ]
* [http://kirils.org/skype/ Website containing articles and tools related to Skype protocol and behaviour analysis ]
* [http://www1.cs.columbia.edu/~salman/skype/ Repository of articles on Skype analysis]
* [http://www1.cs.columbia.edu/~salman/skype/ Repository of articles on Skype analysis]
* [https://translate.google.com.ua/translate?sl=ru&tl=en&js=y&prev=_t&hl=ru&ie=UTF-8&u=https%3A%2F%2Fmarakew.github.io%2Fskype_research.html&edit-text= Skype Architecture Inside]


{{Instant messaging}}
{{Instant messaging}}

Latest revision as of 21:41, 28 October 2026

Template:Error:wrong namespace

This article is being considered for deletion in accordance with Wikipedia's deletion policy.
Please share your thoughts on the matter at this article's entry on the Articles for deletion page.
Feel free to edit the article, but the article must not be blanked, and this notice must not be removed, until the discussion is closed. For more information, particularly on merging or moving the article during the discussion, read the Guide to deletion.

Template:Multiple issues Template:Short description Template:Skype Limited The Skype protocol is a discontinued proprietary network used for Internet telephony. Its specifications are not publicly available, and all official applications based on the protocol are closed-source. It lacks interoperability with most Voice over IP (VoIP) networks, so it would require licensing from Skype for any integration.

Many attempts to reverse-engineer the protocol have been made to study its security features or to enable unofficial clients. On June 20, 2014, Microsoft announced that the old Skype protocol would be deprecated. Users had to upgrade to the 2014 version of Skype to continue accessing services, and older clients could no longer log in.[1][2] As of the second week of August 2014, the new protocol, Microsoft Notification Protocol 24, was implemented to improve offline messaging and message synchronization across devices.[3]

Peer-to-peer architecture

Skype pioneered peer-to-peer (P2P) technology for IP telephony.[4] Its architecture includes supernodes, ordinary nodes, and a login server. Each client maintains a cache of reachable supernodes, while user directory data is distributed across these supernodes, organized into slots and blocks.Template:Cn

Initially, any client with sufficient bandwidth and processing power could become a supernode. This setup posed challenges for users behind firewalls or Network Address Translation (NAT) because their connections could be used to facilitate calls between other clients. In 2012, Microsoft transitioned control of supernodes to its data centers to enhance performance and scalability,[5][6] raising privacy concerns[7] that were later highlighted by the PRISM surveillance revelations in 2013.[8][9]

Skype does not support IPv6,[10] which could simplify its communication infrastructure.

Communication challenges

Supernodes relay communications for clients that are behind firewalls or NAT, enabling calls that would otherwise be impossible. However, issues may arise, such as:

  • Non-derivable external port numbers or IP addresses due to NAT
  • Firewalls blocking incoming sessions
  • UDP issues like timeouts
  • Port restrictions

Protocol details

Signaling in Skype is encrypted using RC4, but this method is considered weak because the encryption key can be recovered from the traffic. Voice data is protected with AES encryption.[11] The Skype API allows developers to access the network for user information and call management.

The code remains closed-source,[12] and parts of the client utilize an open-source socket communication library called Internet Direct (Indy).

In July 2012, a researcher revealed insights gained from reverse-engineering the Skype client.[13]

Protocol detection

Various networking and security firms claim to have methods for detecting Skype's protocol. While their specific methods are proprietary, some published techniques include Pearson's chi-squared test and stochastic characterization using Naive Bayes classifiers.[14]

Obfuscation layer

Skype employs RC4 to obfuscate the payload of data packets. The initialization vector (IV) is derived from a combination of the public source and destination IPs and a packet ID, transformed into an RC4 key.

Notably, the misuse of RC4 can occur on TCP streams, where the first 14 bytes of a stream are XOR-ed with the RC4 stream, impacting data security.[15]

Packet structure and compression

Most Skype traffic is encrypted, with commands and their parameters organized in an object list that can be compressed using a variant of arithmetic compression.

The terms of Skype's license agreement prohibit reverse engineering. However, EU law allows for reverse engineering for interoperability purposes,[16] and the U.S. Digital Millennium Copyright Act provides similar protections.[17][18][19] Certain countries also permit copying for reverse engineering.[20] (See also Sega v. Accolade and Sony v. Connectix.)

References

  1. ↑ "Making Way for the Next Generation of Skype on Desktop". 20 June 2014. https://blogs.skype.com/news/2014/06/20/making-way-for-the-next-generation-of-skype-on-desktop/. 
  2. ↑ Keizer, Gregg (21 June 2014). "Update: Skype to retire recent editions for Windows, Mac; upgrades mandatory". Computerworld. http://www.computerworld.com/s/article/9249275/Update_Skype_to_retire_recent_editions_for_Windows_Mac_upgrades_mandatory. 
  3. ↑ Chris Merrimen (15 August 2014). "Skype stops working on older Android phones leaving Linux users in the dark". CNET. http://www.theinquirer.net/inquirer/news/2360604/skype-stops-working-on-older-android-phones-leaving-linux-users-in-the-dark. 
  4. ↑ Template:Cite arXiv
  5. ↑ Branscombe, Mary (27 July 2012). "Forget the conspiracy theories: Skype's supernodes belong in the cloud". 500 words into the future (ZDNet). https://www.zdnet.com/article/forget-the-conspiracy-theories-skypes-supernodes-belong-in-the-cloud/. 
  6. ↑ "Skype replaces P2P supernodes with Linux boxes hosted by Microsoft (updated)". Ars Technica. 2 May 2012. https://arstechnica.com/business/2012/05/skype-replaces-p2p-supernodes-with-linux-boxes-hosted-by-microsoft/. 
  7. ↑ Kosner, Anthony (18 July 2012). "Will Microsoft's Changes To The Architecture Of Skype Make It Easier To Snoop?". Forbes blog. https://www.forbes.com/sites/anthonykosner/2012/07/18/did-microsoft-change-the-architecture-of-skype-to-make-it-easier-to-snoop/. 
  8. ↑ Gallagher, Ryan (6 June 2013). "Newly Revealed PRISM Snooping Makes Verizon Surveillance Look Like Kids' Stuff". Slate blog. http://www.slate.com/blogs/future_tense/2013/06/06/nsa_prism_surveillance_private_data_from_google_microsoft_skype_apple_yahoo.html. 
  9. ↑ Greenwald, Glenn (7 June 2013). "NSA Prism program taps in to user data of Apple, Google and others". The Guardian. https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data. 
  10. ↑ "Skype does not support IPv6.". Skype official Twitter account. 1 Nov 2012. https://twitter.com/SkypeTalks/status/264057558262747136. 
  11. ↑ Introduction Skype analysis Enforcing anti-Skype policies, Skype uncovered Security study of Skype, Desclaux Fabrice, 7/11/2005, EADS CCR/STI/C
  12. ↑ "Which protocols does Skype use?". Skype. http://support.skype.com/en_US/faq/FA153/Which-protocols-does-Skype-use. 
  13. ↑ "Posts under Skype Reverse Category". http://www.oklabs.net/category/skype-reverse/. 
    "Skype Reverse Engineering: The (long) journey ;)..". http://www.oklabs.net/skype-reverse-engineering-the-long-journey/. 
  14. ↑ Dario Bonfiglio. "Revealing Skype Traffic: When Randomness Plays with You". ACM SIGCOMM Computer Communication Review 37 (SIGCOMM 2007): 37–48. https://www.dpacket.org/articles/revealing-skype-traffic-when-randomness-plays-you. 
  15. ↑ Template:Cite conference
  16. ↑ Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs
  17. ↑ 17 U.S.C. Sec. 1201(f).
  18. ↑ WIPO Copyright and Performances and Phonograms Treaties Implementation Act
  19. ↑ Pamela Samuelson; Suzanne Scotchmer (May 2002). "The Law and Economics of Reverse Engineering". Yale Law Journal 111 (7): 1575–1663. doi:10.2307/797533. http://www.yalelawjournal.org/pdf/111-7/SamuelsonFINAL.pdf. Retrieved on 2015-03-17. 
  20. ↑ In the French "intellectual property" law set, there is an exception that allows any software user to reverse engineer it. See code de la propriété intellectuelle Template:In lang. This law is the national implementation of a piece of EU legislation: Council Directive 91/250/EEC, since then repealed by Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs which also has a very similar provision allowing reverse engineering/decompilation for the purposes of development and testing of independent but inter-operating programs).

Other sources

Template:Refbegin

Template:Refend

Template:Instant messaging

it:Protocollo Skype sk:Skype Protocol

Retrieved from "https://ideawaza.com/index.php?title=Archive:Skype_protocol&oldid=104680"