Please find how Cryptify Call meet NCSC’s Secure Communications Principles
1 – Protect data in transit
Data is protected using end-to-end encryption, i.e from the sender to the receiver. This applies for both key exchange and media, including multi-party conferencing.
Before the user accepts a call or the host of a conference admits a participant the identity of the other party is cryptographically authenticated, including which Security Domain that attested the identity.
2 – Protect network nodes with access to sensitive data
The architecture divides the central functions in a security domain where the offline Cryptify Management System (CMS) is handling all sensitive information, and an open domain for VoIP traffic, where no sensitive information is exposed unencrypted, handled by the “network node” Cryptify Rendezvous Server (CRS).
This architecture serves two critical functions
- No network nodes will have access to un-encrypted data
- No network nodes will manage cryptographic key material
3 – Protect against unauthorised user access to the service
Users must be provisioned with an enrolment code issued by the CMS in order to access the service.
Customers are encouraged to follow the Device Security Guidance published by NCSC
4 – Provision for secure audit of the service
The CRS administrator can monitor connectivity events, e.g. failed login attempts.
In the offline CMS it is possible to configure the Cryptify Call system to use the MIKEY-SAKKE key exchange scheme, which enables the CMS operator to perform secure auditing.
5 – Allow administrators to securely manage users and systems
The offline CMS controls which users can access the system and with which other systems they are permitted to communicate.
6 – Use metadata only for its necessary purpose
Cryptify AB provide its customer with software and licenses in order for them to deploy their own on-premises Cryptify Call system. Hence, any metadata produced by that system is owned and controlled by the customer.
The Cryptify Call systems only collects metadata necessary to operate. Please read more in the privacy statement https://www.cryptify.com/privacy
7 – Assess supply chain for trust and resilience
Cryptify use a certified development process to manages third party products as well as internal development to ensure customers can trust the products we supply.
Subject to authorization by the CMS administrator of the respective organization, users can communicate with users belonging to other organizations in an end-to-end encrypted and authenticated manner.
Cryptify Call is built on reliable, open standards and protocols enabling multi-vendor interoperability. The comprehensive security of the solution is based on government approved, well-proven standard algorithms and protocols such as Advanced Encryption Standard (AES), MIKEY-SAKKE, and Secure Real-time Transport Protocol (SRTP).