Editing P2p mobile carriers (section)

== 10.4.3. Higher level protocol encryption ==

If a secure channel cannot be established during authentication, then there is always the option of enabling encryption at a higher layer in the protocol stack. To understand where this can happen its worthwhile to go over calling in the various networks.

* 2G / GSM uses a circuit-switched network for calls.
* 3G / UMTS switches between 2G for calls and GPRS for data services. GPRS is a packet-switched network that provides IP services for GSM.
* 4G / LTE uses VoLTE (voice over LTE) for calls and falls back to 3G if VoLTE is too busy. 4G is a packet-switched network, so everything is IP-based.
* 5G is still being standardised, and there are a number of options that might be used for calling. For the moment, VoLTE will be compatible. Needless to say, 5G is a packet-switched network.

To start with the obvious: GPRS [voip-gprs], 4G, and 5G can support any regular Internet VOIP application, and end-to-end encryption will prevent packet sniffing between the mobile and the MsC.

Then there is VoLTE. With VoLTE, IPSec can be optionally enabled [4g-link-security] to setup an encrypted tunnel for voice traffic [volte-ipsec]. The IPSec standard uses a protocol called IKE (Internet Key Exchange) for authentication and key exchange [ike-5g].

The way keys are exchanged in IKE is with the Diffie-Hellman-Merkle key exchange algorithm– and guess what that is? Public key cryptography. So even if the owner is sniffing radio packets and sees this exchange they won’t be able to decrypt anything.

<span id="plan-e-a-less-naive-protocol-with-location-checks"></span>