Peer-to-peer key agreement
For each call, Skype creates a session with a 256-bit session key. This session exists as long as communication continues and for a fixed time afterward. As part of connecting a call, Skype securely transmits the session key to the call recipient. That session key is then used to encrypt messages in both directions.
Session cryptography

All traffic in a session is encrypted using the AES algorithm running in Integer Counter Mode (ICM). Skype encrypts the current counter and a salt with the session key using the 256 bit AES algorithm. This returns the key stream, which is then XORed with the message content. This produces encrypted ciphertext, which is then transmitted to the recipient. Skype sessions contain multiple streams. The ICM counter depends on the stream, and the location within the stream.
Random number generation

Skype uses random numbers for several cryptographic purposes, for instance as a protection against playback attacks, creation of RSA key pairs, and creation of AES key-halves for content encryption. The security of a Skype peer-to-peer session depends significantly on the quality of the random numbers generated by both ends of the Skype session. Random number generation varies by operating system.
Cryptographic primitives

Skype uses standard cryptographic primitives to achieve its security goals. The cryptographic primitives used in Skype are: the AES block cipher, the RSA public-key cryptosystem, the ISO 9796-2 signature padding scheme, the SHA-1 hash function, and the RC4 stream cipher.
Key agreement protocol

Key-agreement is achieved using a proprietary, symmetric protocol. To protect against a playback attack, the peers challenge each other with random 64-bit nonces. The challenge response is to customize the challenge in a proprietary way and returned it signed with the responder’s private key.

The peers exchange Identity Certificates and confirm that these certificates are legitimate. Because an Identity Certificate contains a public key, each end can then confirm signatures created by the other peer. Each peer contributes 128 random bits to the 256-bit session key.