MobCryption: Zero-Knowledge E2EE for Enterprise Voice

Why Enterprise Voice Needs E2EE

Most enterprise VoIP platforms encrypt calls in transit using TLS/SRTP, but the provider can still access the media stream at the server. For industries handling PHI, PCI, or attorney-client privileged communications, this is insufficient. True end-to-end encryption ensures that only the two endpoints can decrypt the audio.

The MobCryption Protocol

MobCryption is built on three cryptographic primitives from our packages/crypto module:

ECDH P-256 Key Agreement -- Each endpoint generates an ephemeral key pair at call setup. The shared secret is derived via Elliptic Curve Diffie-Hellman, ensuring forward secrecy for every call.

HKDF Key Derivation -- The raw shared secret is expanded using HMAC-based Key Derivation Function into separate encryption and authentication keys.

AES-256-GCM Encryption -- Each audio frame is encrypted with a unique nonce derived from the frame sequence number. GCM provides both confidentiality and integrity in a single pass.

Zero-Knowledge Architecture

The MobDial server never sees plaintext keys. During call setup:

Endpoints exchange public keys via the signaling channel (which is TLS-encrypted but server-visible)

Each endpoint independently computes the shared secret

The server relays encrypted media frames without the ability to decrypt them

Even if our infrastructure were fully compromised, historical and future calls remain protected.

Maintaining Call Quality

Encryption adds overhead. We measured the impact:

Latency: +0.3ms per frame (negligible against the 20ms frame interval)

CPU: ~2% increase on modern devices using AES-NI hardware acceleration

Bandwidth: +16 bytes per frame for the GCM authentication tag

MOS scores remained above 4.0 in all test configurations, well above our 3.5 SLO threshold.

Compliance Implications

With MobCryption enabled, MobDial customers can truthfully attest to:

HIPAA technical safeguard requirements for ePHI in transit

PCI DSS Requirement 4 for encryption of cardholder data across open networks

SOC 2 Type II encryption controls

Zero-knowledge means we cannot be compelled to produce call content we do not possess.