RFC 3711 - The Secure Real-time Transport Protocol (SRTP)

• Status: Proposed Standard
• Published: March 2004
• Stream: IETF
• Errata: No Errata

---

Abstract

This document describes the Secure Real-time Transport Protocol (SRTP), a profile of the Real-time Transport Protocol (RTP), which can provide confidentiality, message authentication, and replay protection to the RTP traffic and to the control traffic for RTP, the Real-time Transport Control Protocol (RTCP).

Contents

• 1. Introduction
  • 1.1. Notational Conventions
• 2. Goals and Features
  • 2.1. Features
• 3. SRTP Framework
  • 3.1. Secure RTP
  • 3.2. SRTP Cryptographic Contexts
    • 3.2.1. Transform-independent parameters
    • 3.2.2. Transform-dependent parameters
    • 3.2.3. Mapping SRTP Packets to Cryptographic Contexts
  • 3.3. SRTP Packet Processing
    • 3.3.1. Packet Index Determination, and ROC, s_l Update
    • 3.3.2. Replay Protection
  • 3.4. Secure RTCP
• 4. Pre-Defined Cryptographic Transforms
  • 4.1. Encryption
    • 4.1.1. AES in Counter Mode
    • 4.1.2. AES in f8-mode
    • 4.1.3. NULL Cipher
  • 4.2. Message Authentication and Integrity
    • 4.2.1. HMAC-SHA1
  • 4.3. Key Derivation
    • 4.3.1. Key Derivation Algorithm
    • 4.3.2. SRTCP Key Derivation
    • 4.3.3. AES-CM PRF
• 5. Default and mandatory-to-implement Transforms
  • 5.1. Encryption: AES-CM and NULL
  • 5.2. Message Authentication/Integrity: HMAC-SHA1
  • 5.3. Key Derivation: AES-CM PRF
• 6. Adding SRTP Transforms
• 7. Rationale
  • 7.1. Key derivation
  • 7.2. Salting key
  • 7.3. Message Integrity from Universal Hashing
  • 7.4. Data Origin Authentication Considerations
  • 7.5. Short and Zero-length Message Authentication
• 8. Key Management Considerations
  • 8.1. Re-keying
    • 8.1.1. Use of the <From, To> for re-keying
  • 8.2. Key Management parameters
• 9. Security Considerations
  • 9.1. SSRC collision and two-time pad
  • 9.2. Key Usage
  • 9.3. Confidentiality of the RTP Payload
  • 9.4. Confidentiality of the RTP Header
  • 9.5. Integrity of the RTP payload and header
    • 9.5.1. Risks of Weak or Null Message Authentication
    • 9.5.2. Implicit Header Authentication
• 10. Interaction with Forward Error Correction mechanisms
• 11. Scenarios
  • 11.1. Unicast
  • 11.2. Multicast (one sender)
  • 11.3. Re-keying and access control
  • 11.4. Summary of basic scenarios
• 12. IANA Considerations
• 13. Acknowledgements
• 14. References
  • 14.1. Normative References
  • 14.2. Informative References
• Appendix A. Pseudocode for Index Determination
• Appendix B. Test Vectors
  • B.1. AES-f8 Test Vectors
  • B.2. AES-CM Test Vectors
  • B.3. Key Derivation Test Vectors
• Authors' Addresses