Internet Protocol - Research by Kirils Solovjovs

Skype protocol 78
password is used as a shared secret with the login server. The plain session key is hashed into a 256-bit AES key that
is used to encrypt the session's public RSA key and the shared secret. The encrypted session key and the AES
encrypted value are sent to the login server.
On the login server side, the plain session key is obtained by decrypting the encrypted session key using the login
server's private RSA key. The plain session key is then used to decrypt the session's public RSA key and the shared
secret. If the shared secret match, the login server will sign the user's public RSA key with its private key. The
signed data is dispatched to the super nodes.
Upon searching for a buddy, a super node will return the buddy's public key signed by Skype. The SC will
authenticate the buddy and agree on a session key by using the mentioned RSA key.
UDP
UDP packets:
IP
UDP
Skype SoF
Skype Crypted Data01
The Start of Frame (SoF) consists of:
1. frame ID number (2 bytes)
2. payload type (1 byte)
• obfuscated payload
• Ack/NAck packet
• payload forwarding packet
• payload resending packet
• other
Obfuscation Layer
The RC4 encryption algorithm is used to obfuscate the payload of datagrams.
1. The CRC32 of public source and destination IP, Skype's packet ID are taken
2. Skype obfuscation layer's initialization vector (IV).
The XOR of these two 32-bit values is transformed to an 80-byte RC4 key using an unknown key engine.
A notable misuse of RC4 in Skype can be found on TCP streams (UDP is unaffected). The first 14 bytes (10 of
which are known) are XOR-ed with the RC4 stream. Then, the cipher is reinitialized to encrypt the rest of the TCP
stream. [8]