ZRTP Frequently Asked Questions (FAQ)

**Q: What prevents a Man-in-the-Middle (MitM) attack?** A: ZRTP utilizes a Short Authentication String (SAS). After executing an ephemeral Diffie-Hellman exchange, both endpoints compute a cryptographic hash over the session state. The first 16 bits of this hash are converted into a two-word phonetic string (from the PGP word list) or four alphanumeric characters. Because an attacker would have to compute two distinct Diffie-Hellman exchanges to intercept both legs of the conversation, their hash values will not match. When the human callers speak the SAS words aloud, any interception is instantly exposed.

**Q: What if the attacker impersonates the caller's voice?** A: Real-time human vocal biometric synthesis in the middle of a live conversation is extraordinarily difficult, particularly when the words to be spoken are randomized and only revealed after the connection is established. Callers who know each other's voices will immediately recognize unfamiliar cadence, delay, or robotic synthesis.

**Q: What is "Key Continuity" and why does it matter?** A: ZRTP caches a shared cryptographic secret (retained secret) generated during the initial authenticated call. On all subsequent calls between those same two endpoints, the cached secret is blended into the new Diffie-Hellman key derivation. Even if callers fail to check the SAS on later calls, a MitM attacker who was not present during the very first call cannot decrypt the session.