Expand description
SRTP (RFC 3711): the default transform, AES-128 counter mode with HMAC-SHA1.
What SRTP protects and what it does not is worth being exact about, because the gap is where people are surprised. It encrypts the payload and authenticates the whole packet including the header. So the sequence number, timestamp and SSRC travel in the clear and cannot be altered; the audio travels encrypted. That is deliberate — a relay has to read the header to do its job.
Three things here are easy to get wrong and each has a test against the RFC’s own published numbers rather than against this implementation’s opinion of them:
Key derivation (§4.3.1) turns one master key into six session keys through AES counter mode. Getting the label or the salt alignment wrong produces keys that are perfectly self-consistent — two endpoints running the same wrong code interoperate happily and neither interoperates with anything else.
The packet index (§3.3.1) is 48 bits: a 32-bit rollover counter above the 16-bit sequence number. It is not sent. Both ends infer it, and an implementation that guesses differently decrypts to noise at the first wrap — twenty minutes into a call, at speech packet rates.
Replay (§3.3.2) is rejected by a sliding window rather than by remembering everything. Without it, a captured packet can be replayed into a call for as long as the key lives.
Structs§
- Context
- One direction of one SRTP stream.
Enums§
- Srtp
Error - What can go wrong protecting or unprotecting a packet.
Constants§
- MASTER_
KEY_ LEN - The master key length of the default transform.
- MASTER_
SALT_ LEN - The master salt length of the default transform.
- TAG_LEN
- The authentication tag length of
AES_CM_128_HMAC_SHA1_80, in octets.