PGP to Sign VoIP Calls: How It Works

Updated 14 November 2026 · Standard formula, shown below

Yes, you can use PGP to sign VoIP calls, but not in the way you might think—PGP itself doesn’t handle real-time audio. Instead, you can sign the cryptographic keys or fingerprints used by secure calling protocols (like ZRTP or DTLS-SRTP), which lets you verify that the person you’re talking to is who they claim to be. This article explains how PGP fits into VoIP security, what it can and can’t do, and how to set it up.

What PGP Actually Does

PGP (Pretty Good Privacy) is a data encryption and signing program. It uses a pair of keys—a private key you keep secret and a public key you share. When you sign something (a file, an email, or a key), you create a digital signature that anyone with your public key can verify. This proves the data hasn’t been tampered with and that it came from you.

For VoIP, the challenge is that voice is a continuous stream of packets, not a static file. PGP isn’t designed to sign or encrypt real-time streams directly. The signing process is too slow and the packet loss would break the signature. So PGP is used indirectly, to authenticate the keys that secure the actual call.

How VoIP Security Normally Works

Most secure VoIP calls use SRTP (Secure Real-time Transport Protocol) to encrypt audio. The encryption keys for SRTP are negotiated at the start of the call using a key exchange protocol. The two most common are:

ZRTP – used by apps like Signal (historically) and Jitsi. It generates a short authentication string (SAS) that both parties can read aloud to each other.
DTLS-SRTP – used by WebRTC and many SIP clients. It uses certificates to authenticate the key exchange.

In both cases, the security hinges on whether the keys or certificates are authentic. If an attacker can intercept the key exchange (a man-in-the-middle attack), they can decrypt and even modify the call. PGP can help prevent that by signing those keys or certificates.

Using PGP to Sign VoIP Keys

The practical method is to sign the public key or certificate that your VoIP client uses. Here’s the general process:

Export your VoIP key – Most clients that support ZRTP or DTLS-SRTP can export the public key or certificate.
Sign it with PGP – Use your PGP software (like GnuPG) to create a detached signature of that key file.
Publish the signature – Upload the signed key to a public keyserver, your website, or a DNS record (like a CERT record).
Verify before calling – Before a call, retrieve the other party’s key and verify the PGP signature. If it matches, you know the key is authentic.

Some VoIP clients have built-in support for this. For example, Jitsi allows you to manually verify a peer’s ZRTP fingerprint, and you can cross-check that fingerprint against a PGP-signed copy published on a website. But it’s not automatic—you still have to do the verification step yourself.

What PGP Can’t Do for VoIP

PGP cannot sign the audio stream in real time. The signature would be invalid the moment a packet is lost or reordered, which happens constantly on the internet. So you can’t get per-packet signatures with PGP.

Also, PGP doesn’t protect against an attacker who has already compromised your device or your VoIP client. If malware is capturing audio before encryption, no amount of key signing will help.

Another limitation: PGP only verifies the key, not the person. If someone steals your private key, they can sign keys in your name. So key security is paramount.

Practical Setup: Signing a ZRTP Fingerprint

Here’s a concrete example using a hypothetical VoIP client that supports ZRTP:

Start a call and note the ZRTP fingerprint (a string like 1234 5678 90AB CDEF ...).
End the call and create a text file containing that fingerprint.
Sign it with GnuPG: gpg --detach-sign fingerprint.txt
Upload fingerprint.txt and fingerprint.txt.sig to your website.
Before a call, the other party downloads your fingerprint and signature, then runs gpg --verify fingerprint.txt.sig fingerprint.txt. If the signature is valid, they know the fingerprint is yours.

This is a manual process, but it’s the most reliable way to use PGP with VoIP today. Some clients automate parts of this, but none do it fully.

Alternatives to PGP for VoIP Authentication

If PGP seems clunky, there are other ways to authenticate VoIP keys:

SAS verification – ZRTP’s short authentication string. Both parties read it aloud; if it matches, the call is secure. This is simpler than PGP but only works in real time.
Web of Trust – PGP itself can be used to build a web of trust for VoIP keys, but it requires a community of people signing each other’s keys.
Certificate Authorities – For DTLS-SRTP, you can use certificates issued by a CA, but that’s expensive and not practical for most individuals.
Key Transparency – Some modern systems use public logs to detect key changes, but this is not widely deployed for VoIP.

For most people, the simplest approach is to use a VoIP app that has good SAS verification built in, and only use PGP if you need stronger, out-of-band verification.

Security Considerations and Limitations

When using PGP to sign VoIP keys, keep these points in mind:

Key compromise – If your PGP private key is stolen, an attacker can sign fake VoIP keys. Use a strong passphrase and consider a hardware token.
Fingerprint mismatch – Always compare the actual fingerprint from the call with the signed one. Don’t just trust the signature; verify the content.
Out-of-band verification – PGP signatures are only as secure as the channel you use to publish them. If an attacker can modify your website, they can replace both the key and the signature.
Metadata leakage – PGP doesn’t hide who you’re calling or when. For that, you need a system like Tor or a mesh VPN.

Remember: PGP signing of VoIP keys is a best-effort method. It’s not a standardized feature of most VoIP clients, so you’ll likely need to do manual steps each time.

Frequently Asked Questions

Can PGP encrypt VoIP calls directly?

No. PGP is not designed for real-time encryption. It works on complete files or messages. For VoIP, you need a protocol like SRTP, which can encrypt the audio stream. PGP can only be used to sign the keys that SRTP uses.

Is there a VoIP app that natively supports PGP signing?

As of now, no mainstream VoIP app has full PGP integration. Some, like Jitsi, allow manual verification of fingerprints, but you have to do the PGP signing yourself. There are experimental projects, but nothing widely used.

What’s the difference between PGP signing and a digital certificate?

PGP signing is done by an individual using their private key. A digital certificate is issued by a certificate authority (CA) and contains the public key plus identity information. Both can be used to authenticate a VoIP key, but PGP is decentralized while certificates rely on a trusted third party.

Does PGP protect against eavesdropping?

No. PGP only provides authentication (proving who signed the key). The actual encryption of the call is done by SRTP. If the key exchange is secure (thanks to PGP), then SRTP encryption will prevent eavesdropping.

How often should I re-sign my VoIP key?

You should re-sign whenever your VoIP key changes (e.g., after reinstalling your client). It’s also good practice to periodically re-sign to ensure your PGP key hasn’t been revoked. There’s no fixed schedule, but a yearly check is reasonable.

Can I use PGP to sign a SIP URI or phone number?

Not directly. PGP signs data, not identities. You can sign a file that maps a SIP URI to a public key, but the signature only proves that the file was created by the key holder. It doesn’t verify the phone number itself.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.