Does Microsoft Lync support Encrpytion for Chat and Videos

Microsoft Lync Server 2010 / 2013 uses TLS and MTLS to encrypt instant messages. All server-to-server traffic requires MTLS, regardless of whether the traffic is confined to the internal network or crosses the internal network perimeter. TLS is optional but strongly recommended between the Mediation Server and media gateway, If TLS is configured on this link, MTLS is required. Therefore, the gateway must be configured with a certificate from a CA that is trusted by the Mediation Server. Requirements for client-to-client traffic depend on whether that traffic crosses the internal corporate firewall. Strictly internal traffic can use either TLS, in which case the instant message is encrypted, or TCP, in which case it is not. The following table summarizes the protocol requirements for each type of traffic. Traffic Protection Traffic type Protected by Server-to-server MTLS Client-to-server TLS Instant messaging and presence TLS (if configured for TLS) Audio and video and desktop sharing of media SRTP Desktop sharing (signaling) TLS Web conferencing TLS Meeting content download, address book download, distribution group expansion HTTPS Media Encryption Media traffic is encrypted using Secure RTP (SRTP), a profile of Real-Time Transport Protocol (RTP) that provides confidentiality, authentication, and replay attack protection to RTP traffic. SRTP uses a session key generated by the media relay authentication service in response to a successful authentication of the server request (on behalf of the media participants). The session key is secured by the negotiated username and password presented to the media relay authentication service by the Front End servers, and sent to the participants over the TLS-secured SIP channel. Decrypting the secured session key with the username and password that the media relay service used, and provided in a secured manner by means of the participant’s TLS certificate and the secured SIP channel, allows the participants to decrypt the SRTP stream. In addition, media flowing in both directions between the Mediation Server and its internal next hop is also encrypted using SRTP. Media flowing in both directions between the Mediation Server and a media gateway is not encrypted. The Mediation Server can support encryption to the media gateway, but the gateway must support MTLS and storage of a certificate.