At 07:20 -0400 on 09/03/2011, John C Klensin wrote about Re:
Recipient is offline:
Having worked for a couple of phone companies, I think they (and
lots of others, of course) are deluding themselves when they
assume that the PSTN is inherently more secure than a
properly-set-up IP-based arrangement, especially with
distributed routing. Too many people (including some at the
ITU) still have a model of PSTN routing and security that worked
only with uninterrupted, non-multiplexed, copper between the
call endpoints (and with the only real security risk being
eavesdropping by the operator in the middle with the plug
cords). But, no, I have no trouble believing it at all.
The simple solution to that is to encrypt the data at the sending
location and decrypt it upon receipt at the receiving location. The
data on-the-wire (ie: The actual data send during the phone call) is
thus secure since any wire-tappers would get data that is useless.
Using SSL over the Internet is basically the same idea.