Skype protocol

Skype was the first peer-to-peer IP telephony network.[4] The network contains three types of entities: supernodes, ordinary nodes, and the login server. Each client maintains a host cache with the IP address and port numbers of reachable supernodes. The Skype user directory is decentralized and distributed among the supernodes in the network. Supernodes are grouped into slots (9–10 supernodes), and slots are grouped into blocks (8 slots).

Previously any client with good bandwidth, no restrictions due to firewall or network address translation (NAT), and adequate processing power could become a supernode. This placed an extra burden on those who connected to the Internet without NAT, as Skype used their computers and Internet connections as third parties for UDP hole punching (to directly connect two clients both behind NAT) or to completely relay other users' calls. In 2012, Microsoft altered the design of the network, and brought all supernodes under their control as hosted servers in data centres.[5] Microsoft at the time defended the move, saying they "believe this approach has immediate performance, scalability and availability benefits for the hundreds of millions of users that make up the Skype community."[6] At the time there was some concern regarding the privacy implications of the change,[7] which appear to have been proven true with the revelation of the PRISM surveillance program in June 2013.[8][9]

Skype does not support the use of the IPv6 protocol,[10] which would greatly reduce the complexity associated with the aforementioned IPv4 communication structure.

Supernodes relay communications on behalf of two other clients, both of which are behind firewalls or "one-to-many" network address translation. Without relaying by the supernodes, two clients with firewall or NAT difficulties would be unable to make or receive calls from one another. Skype tries to get the two ends to negotiate the connection details directly, but sometimes the sum of problems at both ends can prevent direct conversation being established.

The problems with firewalls and NAT can be:

• The external port numbers or IP address are not derivable, because NAT rewrites them
• The firewall and NAT in use prevents the session being received
• UDP is not usable due to NAT issues, such as timeout
• Firewalls block many ports
• TCP through many-to-one NAT is always "outward only" by default – adding port-forwarding settings to the NAT router can allow reception of TCP sessions

Signaling is encrypted using RC4; however, the method only obfuscates the traffic as the key can be recovered from the packet. Voice data is encrypted with AES.[11]

The Skype client's application programming interface (API) opens the network to software developers. The Skype API allows other programs to use the Skype network to get "white pages" information and manage calls.

The Skype code is closed source, and the protocol is not standardized.[12] Parts of the client use Internet Direct (Indy), an open source socket communication library.

On July 8, 2012, a researcher from Benin, Ouanilo Medegan, released articles and proof of concept code, results of his reverse engineering the Skype client.[13]

The RC4 encryption algorithm is used to obfuscate the payload of datagrams.

1. The CRC32 of public source and destination IP, Skype's packet ID are taken
2. Skype obfuscation layer's initialization vector (IV).

The XOR of these two 32-bit values is transformed to an 80-byte RC4 key using an unknown key engine.

A notable misuse of RC4 in Skype can be found on TCP streams (UDP is unaffected). The first 14 bytes (10 of which are known to the user, since they consist of a hash of the username and password) are XOR-ed with the RC4 stream. Then, the cipher is reinitialized to encrypt the rest of the TCP stream.[15]

TCP packets:

TCP
Skype Init TCP packet

The Skype Init TCP packet contains

• the seed (4 bytes)
• init_str string 00 01 00 00 01 00 00 00 01/03

Almost all traffic is ciphered. Each command has its parameters appended in an object list. The object list can be compressed.

                                 / Object List     ... -|
        Enc      -> Cmd -> Encod
                     ^           \ Compressed List ... -|
        Frag         |                                  |
                     |------------------<---------------|
        Ack

        NAck

        Forward  -> Forwarded..Message

 Object:
         Number
         IP:Port
         List of numbers
         String
         RSA key

 Object List
         List Size (n)
         Object 1
         .
         .
         Object n

Reverse engineering of the Skype protocol by inspecting/disassembling binaries is prohibited by the terms and conditions of Skype's license agreement. However European Union law allows reverse-engineering a computer program without getting a permission from an author for inter-operability purposes.[16] In the United States, the Digital Millennium Copyright Act provides protections for reverse engineering software for the purposes of interoperability with other software.[17][18] There are also legal precedents in the United States when the reverse-engineering is aimed at interoperability of file formats and protocols.[19][20][21]

In addition, some countries specifically permit a program to be copied for the purposes of reverse engineering.[22]

• Website containing articles and tools related to Skype protocol and behaviour analysis
• Repository of articles on Skype analysis
• Skype Architecture Inside