doc: Add RFC documents

1 files changed, 2691 insertions, 0 deletions

diff --git a/doc/rfc/rfc7714.txt b/doc/rfc/rfc7714.txt
new file mode 100644
index 0000000..f67912a
--- /dev/null
+++ b/doc/rfc/rfc7714.txt
@@ -0,0 +1,2691 @@
+
+
+
+
+
+
+Internet Engineering Task Force (IETF)                         D. McGrew
+Request for Comments: 7714                           Cisco Systems, Inc.
+Category: Standards Track                                        K. Igoe
+ISSN: 2070-1721                                 National Security Agency
+                                                           December 2015
+
+
+                    AES-GCM Authenticated Encryption
+           in the Secure Real-time Transport Protocol (SRTP)
+
+Abstract
+
+   This document defines how the AES-GCM Authenticated Encryption with
+   Associated Data family of algorithms can be used to provide
+   confidentiality and data authentication in the Secure Real-time
+   Transport Protocol (SRTP).
+
+Status of This Memo
+
+   This is an Internet Standards Track document.
+
+   This document is a product of the Internet Engineering Task Force
+   (IETF).  It represents the consensus of the IETF community.  It has
+   received public review and has been approved for publication by the
+   Internet Engineering Steering Group (IESG).  Further information on
+   Internet Standards is available in Section 2 of RFC 5741.
+
+   Information about the current status of this document, any errata,
+   and how to provide feedback on it may be obtained at
+   http://www.rfc-editor.org/info/rfc7714.
+
+Copyright Notice
+
+   Copyright (c) 2015 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents
+   (http://trustee.ietf.org/license-info) in effect on the date of
+   publication of this document.  Please review these documents
+   carefully, as they describe your rights and restrictions with respect
+   to this document.  Code Components extracted from this document must
+   include Simplified BSD License text as described in Section 4.e of
+   the Trust Legal Provisions and are provided without warranty as
+   described in the Simplified BSD License.
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                    [Page 1]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+Table of Contents
+
+   1. Introduction ....................................................3
+   2. Conventions Used in This Document ...............................4
+   3. Overview of the SRTP/SRTCP AEAD Security Architecture ...........4
+   4. Terminology .....................................................5
+   5. Generic AEAD Processing .........................................6
+      5.1. Types of Input Data ........................................6
+      5.2. AEAD Invocation Inputs and Outputs .........................6
+           5.2.1. Encrypt Mode ........................................6
+           5.2.2. Decrypt Mode ........................................7
+      5.3. Handling of AEAD Authentication ............................7
+   6. Counter Mode Encryption .........................................7
+   7. Unneeded SRTP/SRTCP Fields ......................................8
+      7.1. SRTP/SRTCP Authentication Tag Field ........................8
+      7.2. RTP Padding ................................................9
+   8. AES-GCM Processing for SRTP .....................................9
+      8.1. SRTP IV Formation for AES-GCM ..............................9
+      8.2. Data Types in SRTP Packets ................................10
+      8.3. Handling Header Extensions ................................11
+      8.4. Prevention of SRTP IV Reuse ...............................12
+   9. AES-GCM Processing of SRTCP Compound Packets ...................13
+      9.1. SRTCP IV Formation for AES-GCM ............................13
+      9.2. Data Types in Encrypted SRTCP Compound Packets ............14
+      9.3. Data Types in Unencrypted SRTCP Compound Packets ..........16
+      9.4. Prevention of SRTCP IV Reuse ..............................17
+   10. Constraints on AEAD for SRTP and SRTCP ........................17
+   11. Key Derivation Functions ......................................18
+   12. Summary of AES-GCM in SRTP/SRTCP ..............................19
+   13. Security Considerations .......................................20
+      13.1. Handling of Security-Critical Parameters .................20
+      13.2. Size of the Authentication Tag ...........................21
+   14. IANA Considerations ...........................................21
+      14.1. SDES .....................................................21
+      14.2. DTLS-SRTP ................................................22
+      14.3. MIKEY ....................................................23
+   15. Parameters for Use with MIKEY .................................23
+   16. Some RTP Test Vectors .........................................24
+      16.1. SRTP AEAD_AES_128_GCM ....................................25
+           16.1.1. SRTP AEAD_AES_128_GCM Encryption ..................25
+           16.1.2. SRTP AEAD_AES_128_GCM Decryption ..................27
+           16.1.3. SRTP AEAD_AES_128_GCM Authentication Tagging ......29
+           16.1.4. SRTP AEAD_AES_128_GCM Tag Verification ............30
+      16.2. SRTP AEAD_AES_256_GCM ....................................31
+           16.2.1. SRTP AEAD_AES_256_GCM Encryption ..................31
+           16.2.2. SRTP AEAD_AES_256_GCM Decryption ..................33
+           16.2.3. SRTP AEAD_AES_256_GCM Authentication Tagging ......35
+           16.2.4. SRTP AEAD_AES_256_GCM Tag Verification ............36
+
+
+
+McGrew & Igoe                Standards Track                    [Page 2]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   17. RTCP Test Vectors .............................................37
+      17.1. SRTCP AEAD_AES_128_GCM Encryption and Tagging ............39
+      17.2. SRTCP AEAD_AES_256_GCM Verification and Decryption .......41
+      17.3. SRTCP AEAD_AES_128_GCM Tagging Only ......................43
+      17.4. SRTCP AEAD_AES_256_GCM Tag Verification ..................44
+   18. References ....................................................45
+      18.1. Normative References .....................................45
+      18.2. Informative References ...................................47
+   Acknowledgements ..................................................48
+   Authors' Addresses ................................................48
+
+1.  Introduction
+
+   The Secure Real-time Transport Protocol (SRTP) [RFC3711] is a profile
+   of the Real-time Transport Protocol (RTP) [RFC3550], which can
+   provide confidentiality, message authentication, and replay
+   protection to the RTP traffic and to the control traffic for RTP, the
+   Real-time Transport Control Protocol (RTCP).  It is important to note
+   that the outgoing SRTP packets from a single endpoint may be
+   originating from several independent data sources.
+
+   Authenticated Encryption [BN00] is a form of encryption that, in
+   addition to providing confidentiality for the Plaintext that is
+   encrypted, provides a way to check its integrity and authenticity.
+   Authenticated Encryption with Associated Data, or AEAD [R02], adds
+   the ability to check the integrity and authenticity of some
+   Associated Data (AD), also called "Additional Authenticated Data"
+   (AAD), that is not encrypted.  This specification makes use of the
+   interface to a generic AEAD algorithm as defined in [RFC5116].
+
+   The Advanced Encryption Standard (AES) is a block cipher that
+   provides a high level of security and can accept different key sizes.
+   AES Galois/Counter Mode (AES-GCM) [GCM] is a family of AEAD
+   algorithms based upon AES.  This specification makes use of the AES
+   versions that use 128-bit and 256-bit keys, which we call "AES-128"
+   and "AES-256", respectively.
+
+   Any AEAD algorithm provides an intrinsic authentication tag.  In many
+   applications, the authentication tag is truncated to less than full
+   length.  In this specification, the authentication tag MUST NOT be
+   truncated.  The authentications tags MUST be a full 16 octets in
+   length.  When used in SRTP/SRTCP, AES-GCM will have two
+   configurations:
+
+      AEAD_AES_128_GCM      AES-128 with a 16-octet authentication tag
+      AEAD_AES_256_GCM      AES-256 with a 16-octet authentication tag
+
+
+
+
+
+McGrew & Igoe                Standards Track                    [Page 3]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   The key size is set when the session is initiated and SHOULD NOT be
+   altered.
+
+   The Galois/Counter Mode of operation (GCM) is an AEAD mode of
+   operation for block ciphers.  GCM uses Counter Mode to encrypt the
+   data, an operation that can be efficiently pipelined.  Further, GCM
+   authentication uses operations that are particularly well suited to
+   efficient implementation in hardware, making it especially appealing
+   for high-speed implementations, or for implementations in an
+   efficient and compact circuit.
+
+   In summary, this document defines how to use an AEAD algorithm,
+   particularly AES-GCM, to provide confidentiality and message
+   authentication within SRTP and SRTCP packets.
+
+2.  Conventions Used in This Document
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
+   "OPTIONAL" in this document are to be interpreted as described in
+   [RFC2119].
+
+3.  Overview of the SRTP/SRTCP AEAD Security Architecture
+
+   SRTP/SRTCP AEAD security is based upon the following principles:
+
+      a) Both privacy and authentication are based upon the use of
+         symmetric algorithms.  An AEAD algorithm such as AES-GCM
+         combines privacy and authentication into a single process.
+
+      b) A secret master key is shared by all participating endpoints --
+         both those originating SRTP/SRTCP packets and those receiving
+         these packets.  Any given master key MAY be used simultaneously
+         by several endpoints to originate SRTP/SRTCP packets (as well
+         as one or more endpoints using this master key to process
+         inbound data).
+
+      c) A Key Derivation Function (KDF) is applied to the shared master
+         key value to form separate encryption keys, authentication
+         keys, and salting keys for SRTP and for SRTCP (a total of six
+         keys).  This process is described in Section 4.3 of [RFC3711].
+         The master key MUST be at least as large as the encryption key
+         derived from it.  Since AEAD algorithms such as AES-GCM combine
+         encryption and authentication into a single process, AEAD
+         algorithms do not make use of separate authentication keys.
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                    [Page 4]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+      d) Aside from making modifications to IANA registries to allow
+         AES-GCM to work with Security Descriptions (SDES), Datagram
+         Transport Layer Security for Secure RTP (DTLS-SRTP), and
+         Multimedia Internet KEYing (MIKEY), the details of how the
+         master key is established and shared between the participants
+         are outside the scope of this document.  Similarly, any
+         mechanism for rekeying an existing session is outside the scope
+         of the document.
+
+      e) Each time an instantiation of AES-GCM is invoked to encrypt and
+         authenticate an SRTP or SRTCP data packet, a new Initialization
+         Vector (IV) is used.  SRTP combines the 4-octet Synchronization
+         Source (SSRC) identifier, the 4-octet Rollover Counter (ROC),
+         and the 2-octet Sequence Number (SEQ) with the 12-octet
+         encryption salt to form a 12-octet IV (see Section 8.1).
+         SRTCP combines the SSRC and 31-bit SRTCP index with the
+         encryption salt to form a 12-octet IV (see Section 9.1).
+
+4.  Terminology
+
+   The following terms have very specific meanings in the context of
+   this RFC:
+
+      Instantiation: In AEAD, an instantiation is an (Encryption_key,
+                     salt) pair together with all of the data structures
+                     (for example, counters) needed for it to function
+                     properly.  In SRTP/SRTCP, each endpoint will need
+                     two instantiations of the AEAD algorithm for each
+                     master key in its possession: one instantiation for
+                     SRTP traffic and one instantiation for SRTCP
+                     traffic.
+
+      Invocation:    SRTP/SRTCP data streams are broken into packets.
+                     Each packet is processed by a single invocation of
+                     the appropriate instantiation of the AEAD
+                     algorithm.
+
+   In many applications, each endpoint will have one master key for
+   processing outbound data but may have one or more separate master
+   keys for processing inbound data.
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                    [Page 5]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+5.  Generic AEAD Processing
+
+5.1.  Types of Input Data
+
+      Associated Data: Data that is to be authenticated but not
+                       encrypted.
+
+      Plaintext:       Data that is to be both encrypted and
+                       authenticated.
+
+      Raw Data:        Data that is to be neither encrypted nor
+                       authenticated.
+
+   Which portions of SRTP/SRTCP packets that are to be treated as
+   Associated Data, which are to be treated as Plaintext, and which are
+   to be treated as Raw Data are covered in Sections 8.2, 9.2, and 9.3.
+
+5.2.  AEAD Invocation Inputs and Outputs
+
+5.2.1.  Encrypt Mode
+
+      Inputs:
+        Encryption_key              Octet string, either 16 or
+                                      32 octets long
+        Initialization_Vector       Octet string, 12 octets long
+        Associated_Data             Octet string of variable length
+        Plaintext                   Octet string of variable length
+
+      Outputs:
+        Ciphertext*                 Octet string, length =
+                                      length(Plaintext) + tag_length
+
+      (*): In AEAD, the authentication tag in embedded in the
+           ciphertext.  When GCM is being used, the ciphertext
+           consists of the encrypted Plaintext followed by the
+           authentication tag.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                    [Page 6]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+5.2.2.  Decrypt Mode
+
+      Inputs:
+        Encryption_key              Octet string, either 16 or
+                                      32 octets long
+        Initialization_Vector       Octet string, 12 octets long
+        Associated_Data             Octet string of variable length
+        Ciphertext                  Octet string of variable length
+
+      Outputs:
+        Plaintext                   Octet string, length =
+                                      length(Ciphertext) - tag_length
+        Validity_Flag               Boolean, TRUE if valid,
+                                      FALSE otherwise
+
+5.3.  Handling of AEAD Authentication
+
+   AEAD requires that all incoming packets MUST pass AEAD authentication
+   before any other action takes place.  Plaintext and Associated Data
+   MUST NOT be released until the AEAD authentication tag has been
+   validated.  Further, the ciphertext MUST NOT be decrypted until the
+   AEAD tag has been validated.
+
+   Should the AEAD tag prove to be invalid, the packet in question is to
+   be discarded and a Validation Error flag raised.  Local policy
+   determines how this flag is to be handled and is outside the scope of
+   this document.
+
+6.  Counter Mode Encryption
+
+   Each outbound packet uses a 12-octet IV and an encryption key to form
+   two outputs:
+
+   o  a 16-octet first_key_block, which is used in forming the
+      authentication tag, and
+
+   o  a keystream of octets, formed in blocks of 16 octets each
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                    [Page 7]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   The first 16-octet block of the key is saved for use in forming the
+   authentication tag, and the remainder of the keystream is XORed to
+   the Plaintext to form the cipher.  This keystream is formed one block
+   at a time by inputting the concatenation of a 12-octet IV (see
+   Sections 8.1 and 9.1) with a 4-octet block to AES.  The pseudocode
+   below illustrates this process:
+
+    def GCM_keystream( Plaintext_len, IV, Encryption_key ):
+        assert Plaintext_len <= (2**36) - 32 ## measured in octets
+        key_stream = ""
+        block_counter = 1
+        first_key_block = AES_ENC( data=IV||block_counter,
+                                   key=Encryption_key )
+        while len(key_stream) < Plaintext_len:
+            block_counter = block_counter + 1
+            key_block = AES_ENC( data=IV||block_counter,
+                                 key=Encryption_key )
+            key_stream = key_stream||key_block
+        key_stream = truncate( key_stream, Plaintext_len )
+        return( first_key_block, key_stream )
+
+   In theory, this keystream generation process allows for the
+   encryption of up to (2^36) - 32 octets per invocation (i.e., per
+   packet), far longer than is actually required.
+
+   With any counter mode, if the same (IV, Encryption_key) pair is used
+   twice, precisely the same keystream is formed.  As explained in
+   Section 9.1 of [RFC3711], this is a cryptographic disaster.  For GCM,
+   the consequences are even worse, since such a reuse compromises GCM's
+   integrity mechanism not only for the current packet stream but for
+   all future uses of the current encryption_key.
+
+7.  Unneeded SRTP/SRTCP Fields
+
+   AEAD Counter Mode encryption removes the need for certain existing
+   SRTP/SRTCP mechanisms.
+
+7.1.  SRTP/SRTCP Authentication Tag Field
+
+   The AEAD message authentication mechanism MUST be the primary message
+   authentication mechanism for AEAD SRTP/SRTCP.  Additional SRTP/SRTCP
+   authentication mechanisms SHOULD NOT be used with any AEAD algorithm,
+   and the optional SRTP/SRTCP authentication tags are NOT RECOMMENDED
+   and SHOULD NOT be present.  Note that this contradicts Section 3.4 of
+   [RFC3711], which makes the use of the SRTCP authentication tag field
+   mandatory, but the presence of the AEAD authentication renders the
+   older authentication methods redundant.
+
+
+
+
+McGrew & Igoe                Standards Track                    [Page 8]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+      Rationale: Some applications use the SRTP/SRTCP authentication tag
+      as a means of conveying additional information, notably [RFC4771].
+      This document retains the authentication tag field primarily to
+      preserve compatibility with these applications.
+
+7.2.  RTP Padding
+
+   AES-GCM does not require that the data be padded out to a specific
+   block size, reducing the need to use the padding mechanism provided
+   by RTP.  It is RECOMMENDED that the RTP padding mechanism not be used
+   unless it is necessary to disguise the length of the underlying
+   Plaintext.
+
+8.  AES-GCM Processing for SRTP
+
+8.1.  SRTP IV Formation for AES-GCM
+
+                   0  0  0  0  0  0  0  0  0  0  1  1
+                   0  1  2  3  4  5  6  7  8  9  0  1
+                 +--+--+--+--+--+--+--+--+--+--+--+--+
+                 |00|00|    SSRC   |     ROC   | SEQ |---+
+                 +--+--+--+--+--+--+--+--+--+--+--+--+   |
+                                                         |
+                 +--+--+--+--+--+--+--+--+--+--+--+--+   |
+                 |         Encryption Salt           |->(+)
+                 +--+--+--+--+--+--+--+--+--+--+--+--+   |
+                                                         |
+                 +--+--+--+--+--+--+--+--+--+--+--+--+   |
+                 |       Initialization Vector       |<--+
+                 +--+--+--+--+--+--+--+--+--+--+--+--+
+
+          Figure 1: AES-GCM SRTP Initialization Vector Formation
+
+   The 12-octet IV used by AES-GCM SRTP is formed by first concatenating
+   2 octets of zeroes, the 4-octet SSRC, the 4-octet rollover counter
+   (ROC), and the 2-octet sequence number (SEQ).  The resulting 12-octet
+   value is then XORed to the 12-octet salt to form the 12-octet IV.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                    [Page 9]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+8.2.  Data Types in SRTP Packets
+
+   All SRTP packets MUST be both authenticated and encrypted.  The data
+   fields within the RTP packets are broken into Associated Data,
+   Plaintext, and Raw Data, as follows (see Figure 2):
+
+      Associated Data: The version V (2 bits), padding flag P (1 bit),
+                       extension flag X (1 bit), Contributing Source
+                       (CSRC) count CC (4 bits), marker M (1 bit),
+                       Payload Type PT (7 bits), sequence number
+                       (16 bits), timestamp (32 bits), SSRC (32 bits),
+                       optional CSRC identifiers (32 bits each), and
+                       optional RTP extension (variable length).
+
+      Plaintext:       The RTP payload (variable length), RTP padding
+                       (if used, variable length), and RTP pad count (if
+                       used, 1 octet).
+
+      Raw Data:        The optional variable-length SRTP Master Key
+                       Identifier (MKI) and SRTP authentication tag
+                       (whose use is NOT RECOMMENDED).  These fields are
+                       appended after encryption has been performed.
+
+        0                   1                   2                   3
+        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |V=2|P|X|  CC   |M|     PT      |       sequence number         |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |                           timestamp                           |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |           synchronization source (SSRC) identifier            |
+       +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+    A  |      contributing source (CSRC) identifiers (optional)        |
+    A  |                               ....                            |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |                   RTP extension (OPTIONAL)                    |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    P  |                          payload  ...                         |
+    P  |                               +-------------------------------+
+    P  |                               | RTP padding   | RTP pad count |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+                P = Plaintext (to be encrypted and authenticated)
+                A = Associated Data (to be authenticated only)
+
+   Figure 2: Structure of an RTP Packet before Authenticated Encryption
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 10]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Since the AEAD ciphertext is larger than the Plaintext by exactly the
+   length of the AEAD authentication tag, the corresponding
+   SRTP-encrypted packet replaces the Plaintext field with a slightly
+   larger field containing the cipher.  Even if the Plaintext field is
+   empty, AEAD encryption must still be performed, with the resulting
+   cipher consisting solely of the authentication tag.  This tag is to
+   be placed immediately before the optional variable-length SRTP MKI
+   and SRTP authentication tag fields.
+
+        0                   1                   2                   3
+        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |V=2|P|X|  CC   |M|     PT      |       sequence number         |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |                           timestamp                           |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |           synchronization source (SSRC) identifier            |
+       +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+    A  |      contributing source (CSRC) identifiers (optional)        |
+    A  |                               ....                            |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |                   RTP extension (OPTIONAL)                    |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    C  |                             cipher                            |
+    C  |                               ...                             |
+    C  |                                                               |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    R  :                     SRTP MKI (OPTIONAL)                       :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    R  :           SRTP authentication tag (NOT RECOMMENDED)           :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+                C = Ciphertext (encrypted and authenticated)
+                A = Associated Data (authenticated only)
+                R = neither encrypted nor authenticated, added
+                    after Authenticated Encryption completed
+
+   Figure 3: Structure of an SRTP Packet after Authenticated Encryption
+
+8.3.  Handling Header Extensions
+
+   RTP header extensions were first defined in [RFC3550].  [RFC6904]
+   describes how these header extensions are to be encrypted in SRTP.
+
+   When RFC 6904 is in use, a separate keystream is generated to encrypt
+   selected RTP header extension elements.  For the AEAD_AES_128_GCM
+   algorithm, this keystream MUST be generated in the manner defined in
+   [RFC6904], using the AES Counter Mode (AES-CM) transform.  For the
+
+
+
+McGrew & Igoe                Standards Track                   [Page 11]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   AEAD_AES_256_GCM algorithm, the keystream MUST be generated in the
+   manner defined for the AES_256_CM transform.  The originator must
+   perform any required header extension encryption before the AEAD
+   algorithm is invoked.
+
+   As with the other fields contained within the RTP header, both
+   encrypted and unencrypted header extensions are to be treated by the
+   AEAD algorithm as Associated Data (AD).  Thus, the AEAD algorithm
+   does not provide any additional privacy for the header extensions,
+   but it does provide integrity and authentication.
+
+8.4.  Prevention of SRTP IV Reuse
+
+   In order to prevent IV reuse, we must ensure that the (ROC,SEQ,SSRC)
+   triple is never used twice with the same master key.  The following
+   two scenarios illustrate this issue:
+
+      Counter Management: A rekey MUST be performed to establish a new
+                          master key before the (ROC,SEQ) pair cycles
+                          back to its original value.  Note that this
+                          scenario implicitly assumes that either
+                          (1) the outgoing RTP process is trusted to not
+                          attempt to repeat a (ROC,SEQ) value or (2) the
+                          encryption process ensures that both the SEQ
+                          and ROC numbers of the packets presented to it
+                          are always incremented in the proper fashion.
+                          This is particularly important for GCM, since
+                          using the same (ROC,SEQ) value twice
+                          compromises the authentication mechanism.  For
+                          GCM, the (ROC,SEQ) and SSRC values used MUST
+                          be generated or checked by either the SRTP
+                          implementation or a module (e.g., the RTP
+                          application) that can be considered equally
+                          trustworthy.  While [RFC3711] allows the
+                          detection of SSRC collisions after they
+                          happen, SRTP using GCM with shared master keys
+                          MUST prevent an SSRC collision from happening
+                          even once.
+
+      SSRC Management:    For a given master key, the set of all SSRC
+                          values used with that master key must be
+                          partitioned into disjoint pools, one pool for
+                          each endpoint using that master key to
+                          originate outbound data.  Each such
+                          originating endpoint MUST only issue SSRC
+                          values from the pool it has been assigned.
+                          Further, each originating endpoint MUST
+                          maintain a history of outbound SSRC
+
+
+
+McGrew & Igoe                Standards Track                   [Page 12]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+                          identifiers that it has issued within the
+                          lifetime of the current master key, and when a
+                          new SSRC requests an SSRC identifier it
+                          MUST NOT be given an identifier that has been
+                          previously issued.  A rekey MUST be performed
+                          before any of the originating endpoints using
+                          that master key exhaust their pools of SSRC
+                          values.  Further, the identity of the entity
+                          giving out SSRC values MUST be verified, and
+                          the SSRC signaling MUST be integrity
+                          protected.
+
+9.  AES-GCM Processing of SRTCP Compound Packets
+
+   All SRTCP compound packets MUST be authenticated, but unlike SRTP,
+   SRTCP packet encryption is optional.  A sender can select which
+   packets to encrypt and indicates this choice with a 1-bit
+   Encryption flag (located just before the 31-bit SRTCP index).
+
+9.1.  SRTCP IV Formation for AES-GCM
+
+   The 12-octet IV used by AES-GCM SRTCP is formed by first
+   concatenating 2 octets of zeroes, the 4-octet SSRC identifier,
+   2 octets of zeroes, a single "0" bit, and the 31-bit SRTCP index.
+   The resulting 12-octet value is then XORed to the 12-octet salt to
+   form the 12-octet IV.
+
+                   0  1  2  3  4  5  6  7  8  9 10 11
+                 +--+--+--+--+--+--+--+--+--+--+--+--+
+                 |00|00|    SSRC   |00|00|0+SRTCP Idx|---+
+                 +--+--+--+--+--+--+--+--+--+--+--+--+   |
+                                                         |
+                 +--+--+--+--+--+--+--+--+--+--+--+--+   |
+                 |         Encryption Salt           |->(+)
+                 +--+--+--+--+--+--+--+--+--+--+--+--+   |
+                                                         |
+                 +--+--+--+--+--+--+--+--+--+--+--+--+   |
+                 |       Initialization Vector       |<--+
+                 +--+--+--+--+--+--+--+--+--+--+--+--+
+
+              Figure 4: SRTCP Initialization Vector Formation
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 13]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+9.2.  Data Types in Encrypted SRTCP Compound Packets
+
+        0                   1                   2                   3
+        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |V=2|P|   RC    |  Packet Type  |            length             |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |           synchronization source (SSRC) of sender             |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    P  |                         sender info                           :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    P  |                        report block 1                         :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    P  |                        report block 2                         :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    P  |                              ...                              :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    P  |V=2|P|   SC    |  Packet Type  |              length           |
+       +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+    P  |                          SSRC/CSRC_1                          |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    P  |                           SDES items                          :
+       +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+    P  |                              ...                              :
+       +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+    A  |1|                         SRTCP index                         |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    R  |                  SRTCP MKI (optional) index                   :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    R  :           SRTCP authentication tag (NOT RECOMMENDED)          :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+                P = Plaintext (to be encrypted and authenticated)
+                A = Associated Data (to be authenticated only)
+                R = neither encrypted nor authenticated, added after
+                    encryption
+
+           Figure 5: AEAD SRTCP Inputs When Encryption Flag = 1
+                   (The fields are defined in RFC 3550.)
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 14]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   When the Encryption flag is set to 1, the SRTCP packet is broken into
+   Plaintext, Associated Data, and Raw (untouched) Data (as shown above
+   in Figure 5):
+
+      Associated Data: The packet version V (2 bits), padding flag P
+                       (1 bit), reception report count RC (5 bits),
+                       Packet Type (8 bits), length (2 octets), SSRC
+                       (4 octets), Encryption flag (1 bit), and SRTCP
+                       index (31 bits).
+
+      Raw Data:        The optional variable-length SRTCP MKI and SRTCP
+                       authentication tag (whose use is
+                       NOT RECOMMENDED).
+
+      Plaintext:       All other data.
+
+   Note that the Plaintext comes in one contiguous field.  Since the
+   AEAD cipher is larger than the Plaintext by exactly the length of the
+   AEAD authentication tag, the corresponding SRTCP-encrypted packet
+   replaces the Plaintext field with a slightly larger field containing
+   the cipher.  Even if the Plaintext field is empty, AEAD encryption
+   must still be performed, with the resulting cipher consisting solely
+   of the authentication tag.  This tag is to be placed immediately
+   before the Encryption flag and SRTCP index.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 15]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+9.3.  Data Types in Unencrypted SRTCP Compound Packets
+
+        0                   1                   2                   3
+        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |V=2|P|   RC    |  Packet Type  |            length             |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |           synchronization source (SSRC) of sender             |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |                         sender info                           :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |                        report block 1                         :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |                        report block 2                         :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |                              ...                              :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |V=2|P|   SC    |  Packet Type  |              length           |
+       +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+    A  |                          SSRC/CSRC_1                          |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    A  |                           SDES items                          :
+       +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+    A  |                              ...                              :
+       +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+    A  |0|                         SRTCP index                         |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    R  |                  SRTCP MKI (optional) index                   :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+    R  :              authentication tag (NOT RECOMMENDED)             :
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+                A = Associated Data (to be authenticated only)
+                R = neither encrypted nor authenticated, added after
+                    encryption
+
+           Figure 6: AEAD SRTCP Inputs When Encryption Flag = 0
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 16]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   When the Encryption flag is set to 0, the SRTCP compound packet is
+   broken into Plaintext, Associated Data, and Raw (untouched) Data, as
+   follows (see Figure 6):
+
+      Plaintext:       None.
+
+      Raw Data:        The variable-length optional SRTCP MKI and SRTCP
+                       authentication tag (whose use is
+                       NOT RECOMMENDED).
+
+      Associated Data: All other data.
+
+   Even though there is no ciphertext in this RTCP packet, AEAD
+   encryption returns a cipher field that is precisely the length of the
+   AEAD authentication tag.  This cipher is to be placed before the
+   Encryption flag and the SRTCP index in the authenticated SRTCP
+   packet.
+
+9.4.  Prevention of SRTCP IV Reuse
+
+   A new master key MUST be established before the 31-bit SRTCP index
+   cycles back to its original value.  Ideally, a rekey should be
+   performed and a new master key put in place well before the SRTCP
+   index cycles back to the starting value.
+
+   The comments on SSRC management in Section 8.4 also apply.
+
+10.  Constraints on AEAD for SRTP and SRTCP
+
+   In general, any AEAD algorithm can accept inputs with varying
+   lengths, but each algorithm can accept only a limited range of
+   lengths for a specific parameter.  In this section, we describe the
+   constraints on the parameter lengths that any AEAD algorithm must
+   support to be used in AEAD-SRTP.  Additionally, we specify a complete
+   parameter set for one specific family of AEAD algorithms, namely
+   AES-GCM.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 17]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   All AEAD algorithms used with SRTP/SRTCP MUST satisfy the five
+   constraints listed below:
+
+   Parameter  Meaning                  Value
+   ---------------------------------------------------------------------
+   A_MAX      maximum Associated       MUST be at least 12 octets.
+              Data length
+
+   N_MIN      minimum nonce (IV)       MUST be 12 octets.
+              length
+
+   N_MAX      maximum nonce (IV)       MUST be 12 octets.
+              length
+
+   P_MAX      maximum Plaintext        GCM: MUST be <= 2^36 - 32 octets.
+              length per invocation
+
+   C_MAX      maximum ciphertext       GCM: MUST be <= 2^36 - 16 octets.
+              length per invocation
+
+   For the sake of clarity, we specify three additional parameters:
+
+      AEAD authentication tag length   MUST be 16 octets
+
+      Maximum number of invocations    SRTP: MUST be at most 2^48
+         for a given instantiation     SRTCP: MUST be at most 2^31
+
+      Block Counter size               GCM: MUST be 32 bits
+
+   The reader is reminded that the ciphertext is longer than the
+   Plaintext by exactly the length of the AEAD authentication tag.
+
+11.  Key Derivation Functions
+
+   A Key Derivation Function (KDF) is used to derive all of the required
+   encryption and authentication keys from a secret value shared by the
+   endpoints.  The AEAD_AES_128_GCM algorithm MUST use the (128-bit)
+   AES_CM PRF KDF described in [RFC3711].  AEAD_AES_256_GCM MUST use the
+   AES_256_CM_PRF KDF described in [RFC6188].
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 18]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+12.  Summary of AES-GCM in SRTP/SRTCP
+
+   For convenience, much of the information about the use of the AES-GCM
+   family of algorithms in SRTP is collected in the tables contained in
+   this section.
+
+   The AES-GCM family of AEAD algorithms is built around the AES block
+   cipher algorithm.  AES-GCM uses AES-CM for encryption and Galois
+   Message Authentication Code (GMAC) for authentication.  A detailed
+   description of the AES-GCM family can be found in [RFC5116].  The
+   following members of the AES-GCM family may be used with SRTP/SRTCP:
+
+     Name                 Key Size      AEAD Tag Size      Reference
+     ================================================================
+     AEAD_AES_128_GCM     16 octets     16 octets          [RFC5116]
+     AEAD_AES_256_GCM     32 octets     16 octets          [RFC5116]
+
+                Table 1: AES-GCM Algorithms for SRTP/SRTCP
+
+   Any implementation of AES-GCM SRTP MUST support both AEAD_AES_128_GCM
+   and AEAD_AES_256_GCM.  Below, we summarize parameters associated with
+   these two GCM algorithms:
+
+     +--------------------------------+------------------------------+
+     | Parameter                      | Value                        |
+     +--------------------------------+------------------------------+
+     | Master key length              | 128 bits                     |
+     | Master salt length             | 96 bits                      |
+     | Key Derivation Function        | AES_CM PRF [RFC3711]         |
+     | Maximum key lifetime (SRTP)    | 2^48 packets                 |
+     | Maximum key lifetime (SRTCP)   | 2^31 packets                 |
+     | Cipher (for SRTP and SRTCP)    | AEAD_AES_128_GCM             |
+     | AEAD authentication tag length | 128 bits                     |
+     +--------------------------------+------------------------------+
+
+                Table 2: The AEAD_AES_128_GCM Crypto Suite
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 19]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+     +--------------------------------+------------------------------+
+     | Parameter                      | Value                        |
+     +--------------------------------+------------------------------+
+     | Master key length              | 256 bits                     |
+     | Master salt length             | 96 bits                      |
+     | Key Derivation Function        | AES_256_CM_PRF [RFC6188]     |
+     | Maximum key lifetime (SRTP)    | 2^48 packets                 |
+     | Maximum key lifetime (SRTCP)   | 2^31 packets                 |
+     | Cipher (for SRTP and SRTCP)    | AEAD_AES_256_GCM             |
+     | AEAD authentication tag length | 128 bits                     |
+     +--------------------------------+------------------------------+
+
+                Table 3: The AEAD_AES_256_GCM Crypto Suite
+
+13.  Security Considerations
+
+13.1.  Handling of Security-Critical Parameters
+
+   As with any security process, the implementer must take care to
+   ensure that cryptographically sensitive parameters are properly
+   handled.  Many of these recommendations hold for all SRTP
+   cryptographic algorithms, but we include them here to emphasize their
+   importance.
+
+   - If the master salt is to be kept secret, it MUST be properly erased
+     when no longer needed.
+
+   - The secret master key and all keys derived from it MUST be kept
+     secret.  All keys MUST be properly erased when no longer needed.
+
+   - At the start of each packet, the Block Counter MUST be reset to 1.
+     The Block Counter is incremented after each block key has been
+     produced, but it MUST NOT be allowed to exceed 2^32 - 1 for GCM.
+     Note that even though the Block Counter is reset at the start of
+     each packet, IV uniqueness is ensured by the inclusion of
+     SSRC/ROC/SEQ or the SRTCP index in the IV.  (The reader is reminded
+     that the first block of key produced is reserved for use in
+     authenticating the packet and is not used to encrypt Plaintext.)
+
+   - Each time a rekey occurs, the initial values of both the 31-bit
+     SRTCP index and the 48-bit SRTP packet index (ROC||SEQ) MUST be
+     saved in order to prevent IV reuse.
+
+   - Processing MUST cease if either the 31-bit SRTCP index or the
+     48-bit SRTP packet index (ROC||SEQ) cycles back to its initial
+     value.  Processing MUST NOT resume until a new SRTP/SRTCP session
+     has been established using a new SRTP master key.  Ideally, a rekey
+     should be done well before any of these counters cycle.
+
+
+
+McGrew & Igoe                Standards Track                   [Page 20]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+13.2.  Size of the Authentication Tag
+
+   We require that the AEAD authentication tag be 16 octets, in order to
+   effectively eliminate the risk of an adversary successfully
+   introducing fraudulent data.  Though other protocols may allow the
+   use of truncated authentication tags, the consensus of the authors
+   and the working group is that risks associated with using truncated
+   AES-GCM tags are deemed too high to allow the use of truncated
+   authentication tags in SRTP/SRTCP.
+
+14.  IANA Considerations
+
+14.1.  SDES
+
+   "Session Description Protocol (SDP) Security Descriptions for Media
+   Streams" [RFC4568] defines SRTP "crypto suites".  A crypto suite
+   corresponds to a particular AEAD algorithm in SRTP.  In order to
+   allow security descriptions to signal the use of the algorithms
+   defined in this document, IANA has registered the following crypto
+   suites in the "SRTP Crypto Suite Registrations" subregistry of the
+   "Session Description Protocol (SDP) Security Descriptions" registry.
+   The ABNF [RFC5234] syntax is as follows:
+
+      srtp-crypto-suite-ext = "AEAD_AES_128_GCM"    /
+                              "AEAD_AES_256_GCM"    /
+                              srtp-crypto-suite-ext
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 21]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+14.2.  DTLS-SRTP
+
+   DTLS-SRTP [RFC5764] defines DTLS-SRTP "SRTP protection profiles".
+   These profiles also correspond to the use of an AEAD algorithm in
+   SRTP.  In order to allow the use of the algorithms defined in this
+   document in DTLS-SRTP, IANA has registered the following SRTP
+   protection profiles:
+
+         SRTP_AEAD_AES_128_GCM    = {0x00, 0x07}
+         SRTP_AEAD_AES_256_GCM    = {0x00, 0x08}
+
+   Below, we list the SRTP transform parameters for each of these
+   protection profiles.  Unless separate parameters for SRTP and SRTCP
+   are explicitly listed, these parameters apply to both SRTP and SRTCP.
+
+    SRTP_AEAD_AES_128_GCM
+         cipher:                 AES_128_GCM
+         cipher_key_length:      128 bits
+         cipher_salt_length:     96 bits
+         aead_auth_tag_length:   16 octets
+         auth_function:          NULL
+         auth_key_length:        N/A
+         auth_tag_length:        N/A
+         maximum lifetime:       at most 2^31 SRTCP packets and
+                                   at most 2^48 SRTP packets
+
+    SRTP_AEAD_AES_256_GCM
+         cipher:                 AES_256_GCM
+         cipher_key_length:      256 bits
+         cipher_salt_length:     96 bits
+         aead_auth_tag_length:   16 octets
+         auth_function:          NULL
+         auth_key_length:        N/A
+         auth_tag_length:        N/A
+         maximum lifetime:       at most 2^31 SRTCP packets and
+                                   at most 2^48 SRTP packets
+
+   Note that these SRTP protection profiles do not specify an
+   auth_function, auth_key_length, or auth_tag_length, because all
+   of these profiles use AEAD algorithms and thus do not use a
+   separate auth_function, auth_key, or auth_tag.  The term
+   "aead_auth_tag_length" is used to emphasize that this refers to
+   the authentication tag provided by the AEAD algorithm and that
+   this tag is not located in the authentication tag field provided by
+   SRTP/SRTCP.
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 22]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+14.3.  MIKEY
+
+   In accordance with "MIKEY: Multimedia Internet KEYing" [RFC3830],
+   IANA maintains several subregistries under "Multimedia Internet
+   KEYing (MIKEY) Payload Name Spaces".  Per this document, additions
+   have been made to two of the MIKEY subregistries.
+
+   In the "MIKEY Security Protocol Parameters" subregistry, the
+   following has been added:
+
+      Type | Meaning                         | Possible Values
+      --------------------------------------------------------
+        20 | AEAD authentication tag length  | 16 octets
+
+   This list is, of course, intended for use with GCM.  It is
+   conceivable that new AEAD algorithms introduced at some point in the
+   future may require a different set of authentication tag lengths.
+
+   In the "Encryption algorithm (Value 0)" subregistry (derived from
+   Table 6.10.1.b of [RFC3830]), the following has been added:
+
+        SRTP Encr. | Value | Default Session   |  Default Auth.
+        Algorithm  |       | Encr. Key Length  |   Tag Length
+      -----------------------------------------------------------
+        AES-GCM    |    6  |    16 octets      |  16 octets
+
+   The encryption algorithm, session encryption key length, and AEAD
+   authentication tag sizes received from MIKEY fully determine the AEAD
+   algorithm to be used.  The exact mapping is described in Section 15.
+
+15.  Parameters for Use with MIKEY
+
+   MIKEY specifies the algorithm family separately from the key length
+   (which is specified by the Session Encryption key length) and the
+   authentication tag length (specified by the AEAD authentication tag
+   length).
+
+                           +------------+-------------+-------------+
+                           | Encryption | Encryption  |  AEAD Auth. |
+                           | Algorithm  | Key Length  |  Tag Length |
+                           +============+=============+=============+
+      AEAD_AES_128_GCM     |  AES-GCM   | 16 octets   | 16 octets   |
+                           +------------+-------------+-------------+
+      AEAD_AES_256_GCM     |  AES-GCM   | 32 octets   | 16 octets   |
+                           +============+=============+=============+
+
+           Table 4: Mapping MIKEY Parameters to AEAD Algorithms
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 23]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Section 11 of this document restricts the choice of KDF for AEAD
+   algorithms.  To enforce this restriction in MIKEY, we require that
+   the SRTP Pseudorandom Function (PRF) has value AES-CM whenever an
+   AEAD algorithm is used.  Note that, according to Section 6.10.1 of
+   [RFC3830], the input key length of the KDF (i.e., the SRTP master key
+   length) is always equal to the session encryption key length.  This
+   means, for example, that AEAD_AES_256_GCM will use AES_256_CM_PRF as
+   the KDF.
+
+16.  Some RTP Test Vectors
+
+   The examples in this section are all based upon the same RTP packet
+
+            8040f17b 8041f8d3 5501a0b2 47616c6c
+            69612065 7374206f 6d6e6973 20646976
+            69736120 696e2070 61727465 73207472
+            6573
+
+   consisting of a 12-octet header (8040f17b 8041f8d3 5501a0b2) and a
+   38-octet payload (47616c6c 69612065 7374206f 6d6e6973 20646976
+   69736120 696e2070 61727465 73207472 6573), which is just the ASCII
+   string "Gallia est omnis divisa in partes tres".  The salt used
+   (51756964 2070726f 2071756f) comes from the ASCII string "Quid pro
+   quo".  The 16-octet (128-bit) key is 00 01 02 ... 0f, and the
+   32-octet (256-bit) key is 00 01 02 ... 1f.  At the time this document
+   was written, the RTP payload type (1000000 binary = 64 decimal) was
+   an unassigned value.
+
+   As shown in Section 8.1, the IV is formed by XORing two 12-octet
+   values.  The first 12-octet value is formed by concatenating two
+   zero octets, the 4-octet SSRC (found in the ninth through 12th octets
+   of the packet), the 4-octet rollover counter (ROC) maintained at each
+   end of the link, and the 2-octet sequence number (SEQ) (found in the
+   third and fourth octets of the packet).  The second 12-octet value is
+   the salt, a value that is held constant at least until the key is
+   changed.
+
+              | Pad |   SSRC    |    ROC    | SEQ |
+               00 00 55 01 a0 b2 00 00 00 00 f1 7b
+        salt   51 75 69 64 20 70 72 6f 20 71 75 6f
+               ------------------------------------
+          IV   51 75 3c 65 80 c2 72 6f 20 71 84 14
+
+   All of the RTP examples use this IV.
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 24]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+16.1.  SRTP AEAD_AES_128_GCM
+
+16.1.1.  SRTP AEAD_AES_128_GCM Encryption
+
+   Encrypting the following packet:
+
+        8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573
+
+   Form the IV
+          | Pad |   SSRC    |    ROC    | SEQ |
+           00 00 55 01 a0 b2 00 00 00 00 f1 7b
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+   AAD: 8040f17b 8041f8d3 5501a0b2
+    PT: 47616c6c 69612065 7374206f 6d6e6973
+        20646976 69736120 696e2070 61727465
+        73207472 6573
+    IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+     H: c6a13b37878f5b826f4f8162a1c8d879
+
+   Encrypt the Plaintext
+     block # 0
+       IV||blk_cntr: 51753c6580c2726f2071841400000002
+          key_block: b5 2c 8f cf 92 55 fe 09 df ce a6 73 f0 10 22 b9
+        plain_block: 47 61 6c 6c 69 61 20 65 73 74 20 6f 6d 6e 69 73
+       cipher_block: f2 4d e3 a3 fb 34 de 6c ac ba 86 1c 9d 7e 4b ca
+     block # 1
+       IV||blk_cntr: 51753c6580c2726f2071841400000003
+          key_block: 9e 07 52 a3 64 5a 2f 4f 2b cb d4 0a 30 b5 a5 fe
+        plain_block: 20 64 69 76 69 73 61 20 69 6e 20 70 61 72 74 65
+       cipher_block: be 63 3b d5 0d 29 4e 6f 42 a5 f4 7a 51 c7 d1 9b
+     block # 2
+       IV||blk_cntr: 51753c6580c2726f2071841400000004
+          key_block: 45 fe 4e ad ed 40 0a 5d 1a f3 63 f9 0c e1 49 3b
+        plain_block: 73 20 74 72 65 73
+       cipher_block: 36 de 3a df 88 33
+
+   Cipher before tag appended
+        f24de3a3 fb34de6c acba861c 9d7e4bca
+        be633bd5 0d294e6f 42a5f47a 51c7d19b
+        36de3adf 8833
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 25]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Compute the GMAC tag
+
+     Process the AAD
+           AAD word: 8040f17b8041f8d35501a0b200000000
+       partial hash: bcfb3d1d0e6e3e78ba45403377dba11b
+
+     Process the cipher
+        cipher word: f24de3a3fb34de6cacba861c9d7e4bca
+       partial hash: 0ebc0abe1b15b32fedd2b07888c1ef61
+        cipher word: be633bd50d294e6f42a5f47a51c7d19b
+       partial hash: 438e5797011ea860585709a2899f4685
+        cipher word: 36de3adf883300000000000000000000
+       partial hash: 336fb643310d7bac2aeaa76247f6036d
+
+     Process the length word
+        length word: 00000000000000600000000000000130
+       partial hash: 1b964067078c408c4e442a8f015e5264
+
+   Turn GHASH into GMAC
+              GHASH: 1b 96 40 67 07 8c 40 8c 4e 44 2a 8f 01 5e 52 64
+                 K0: 92 0b 3f 40 b9 3d 2a 1d 1c 8b 5c d1 e5 67 5e aa
+          full GMAC: 89 9d 7f 27 be b1 6a 91 52 cf 76 5e e4 39 0c ce
+
+   Cipher with tag
+        f24de3a3 fb34de6c acba861c 9d7e4bca
+        be633bd5 0d294e6f 42a5f47a 51c7d19b
+        36de3adf 8833899d 7f27beb1 6a9152cf
+        765ee439 0cce
+
+   Encrypted and tagged packet:
+        8040f17b 8041f8d3 5501a0b2 f24de3a3
+        fb34de6c acba861c 9d7e4bca be633bd5
+        0d294e6f 42a5f47a 51c7d19b 36de3adf
+        8833899d 7f27beb1 6a9152cf 765ee439
+        0cce
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 26]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+16.1.2.  SRTP AEAD_AES_128_GCM Decryption
+
+   Decrypting the following packet:
+
+        8040f17b 8041f8d3 5501a0b2 f24de3a3
+        fb34de6c acba861c 9d7e4bca be633bd5
+        0d294e6f 42a5f47a 51c7d19b 36de3adf
+        8833899d 7f27beb1 6a9152cf 765ee439
+        0cce
+
+   Form the IV
+          | Pad |   SSRC    |    ROC    | SEQ |
+           00 00 55 01 a0 b2 00 00 00 00 f1 7b
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+   AAD: 8040f17b 8041f8d3 5501a0b2
+    CT: f24de3a3 fb34de6c acba861c 9d7e4bca
+        be633bd5 0d294e6f 42a5f47a 51c7d19b
+        36de3adf 8833899d 7f27beb1 6a9152cf
+        765ee439 0cce
+    IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+     H: c6a13b37878f5b826f4f8162a1c8d879
+
+   Verify the received tag
+      89 9d 7f 27 be b1 6a 91 52 cf 76 5e e4 39 0c ce
+
+     Process the AAD
+           AAD word: 8040f17b8041f8d35501a0b200000000
+       partial hash: bcfb3d1d0e6e3e78ba45403377dba11b
+
+     Process the cipher
+        cipher word: f24de3a3fb34de6cacba861c9d7e4bca
+       partial hash: 0ebc0abe1b15b32fedd2b07888c1ef61
+        cipher word: be633bd50d294e6f42a5f47a51c7d19b
+       partial hash: 438e5797011ea860585709a2899f4685
+        cipher word: 36de3adf883300000000000000000000
+       partial hash: 336fb643310d7bac2aeaa76247f6036d
+
+     Process the length word
+        length word: 00000000000000600000000000000130
+       partial hash: 1b964067078c408c4e442a8f015e5264
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 27]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Turn GHASH into GMAC
+              GHASH: 1b 96 40 67 07 8c 40 8c 4e 44 2a 8f 01 5e 52 64
+                 K0: 92 0b 3f 40 b9 3d 2a 1d 1c 8b 5c d1 e5 67 5e aa
+          full GMAC: 89 9d 7f 27 be b1 6a 91 52 cf 76 5e e4 39 0c ce
+
+        Received tag = 899d7f27 beb16a91 52cf765e e4390cce
+        Computed tag = 899d7f27 beb16a91 52cf765e e4390cce
+     Received tag verified.
+
+   Decrypt the cipher
+     block # 0
+       IV||blk_cntr: 51753c6580c2726f2071841400000002
+          key_block: b5 2c 8f cf 92 55 fe 09 df ce a6 73 f0 10 22 b9
+       cipher_block: f2 4d e3 a3 fb 34 de 6c ac ba 86 1c 9d 7e 4b ca
+        plain_block: 47 61 6c 6c 69 61 20 65 73 74 20 6f 6d 6e 69 73
+     block # 1
+       IV||blk_cntr: 51753c6580c2726f2071841400000003
+          key_block: 9e 07 52 a3 64 5a 2f 4f 2b cb d4 0a 30 b5 a5 fe
+       cipher_block: be 63 3b d5 0d 29 4e 6f 42 a5 f4 7a 51 c7 d1 9b
+        plain_block: 20 64 69 76 69 73 61 20 69 6e 20 70 61 72 74 65
+     block # 2
+       IV||blk_cntr: 51753c6580c2726f2071841400000004
+          key_block: 45 fe 4e ad ed 40 0a 5d 1a f3 63 f9 0c e1 49 3b
+       cipher_block: 36 de 3a df 88 33
+        plain_block: 73 20 74 72 65 73
+
+   Verified and tagged packet:
+        47616c6c 69612065 7374206f 6d6e6973
+        20646976 69736120 696e2070 61727465
+        73207472 6573
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 28]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+16.1.3.  SRTP AEAD_AES_128_GCM Authentication Tagging
+
+   Tagging the following packet:
+
+        8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573
+
+   Form the IV
+          | Pad |   SSRC    |    ROC    | SEQ |
+           00 00 55 01 a0 b2 00 00 00 00 f1 7b
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+   AAD: 8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573
+    IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+     H: c6a13b37878f5b826f4f8162a1c8d879
+
+   Compute the GMAC tag
+
+     Process the AAD
+           AAD word: 8040f17b8041f8d35501a0b247616c6c
+       partial hash: 79f41fea34a474a77609d8925e9f2b22
+           AAD word: 696120657374206f6d6e697320646976
+       partial hash: 84093a2f85abf17ab37d3ce2f706138f
+           AAD word: 69736120696e20706172746573207472
+       partial hash: ab2760fee24e6dec754739d8059cd144
+           AAD word: 65730000000000000000000000000000
+       partial hash: e84f3c55d287fc561c41d09a8aada4be
+
+     Process the length word
+        length word: 00000000000001900000000000000000
+       partial hash: b04200c26b81c98af55cc2eafccd1cbc
+
+   Turn GHASH into GMAC
+              GHASH: b0 42 00 c2 6b 81 c9 8a f5 5c c2 ea fc cd 1c bc
+                 K0: 92 0b 3f 40 b9 3d 2a 1d 1c 8b 5c d1 e5 67 5e aa
+          full GMAC: 22 49 3f 82 d2 bc e3 97 e9 d7 9e 3b 19 aa 42 16
+
+   Cipher with tag
+        22493f82 d2bce397 e9d79e3b 19aa4216
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 29]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Tagged packet:
+        8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        65732249 3f82d2bc e397e9d7 9e3b19aa
+        4216
+
+16.1.4.  SRTP AEAD_AES_128_GCM Tag Verification
+
+   Verifying the following packet:
+
+        8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        65732249 3f82d2bc e397e9d7 9e3b19aa
+        4216
+
+   Form the IV
+          | Pad |   SSRC    |    ROC    | SEQ |
+           00 00 55 01 a0 b2 00 00 00 00 f1 7b
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+   AAD: 8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573
+    CT: 22493f82 d2bce397 e9d79e3b 19aa4216
+    IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+     H: c6a13b37878f5b826f4f8162a1c8d879
+
+   Verify the received tag
+      22 49 3f 82 d2 bc e3 97 e9 d7 9e 3b 19 aa 42 16
+
+     Process the AAD
+           AAD word: 8040f17b8041f8d35501a0b247616c6c
+       partial hash: 79f41fea34a474a77609d8925e9f2b22
+           AAD word: 696120657374206f6d6e697320646976
+       partial hash: 84093a2f85abf17ab37d3ce2f706138f
+           AAD word: 69736120696e20706172746573207472
+       partial hash: ab2760fee24e6dec754739d8059cd144
+           AAD word: 65730000000000000000000000000000
+       partial hash: e84f3c55d287fc561c41d09a8aada4be
+
+     Process the length word
+        length word: 00000000000001900000000000000000
+       partial hash: b04200c26b81c98af55cc2eafccd1cbc
+
+
+
+McGrew & Igoe                Standards Track                   [Page 30]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Turn GHASH into GMAC
+              GHASH: b0 42 00 c2 6b 81 c9 8a f5 5c c2 ea fc cd 1c bc
+                 K0: 92 0b 3f 40 b9 3d 2a 1d 1c 8b 5c d1 e5 67 5e aa
+          full GMAC: 22 49 3f 82 d2 bc e3 97 e9 d7 9e 3b 19 aa 42 16
+
+        Received tag = 22493f82 d2bce397 e9d79e3b 19aa4216
+        Computed tag = 22493f82 d2bce397 e9d79e3b 19aa4216
+     Received tag verified.
+
+16.2.  SRTP AEAD_AES_256_GCM
+
+16.2.1.  SRTP AEAD_AES_256_GCM Encryption
+
+   Encrypting the following packet:
+
+        8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573
+
+   Form the IV
+          | Pad |   SSRC    |    ROC    | SEQ |
+           00 00 55 01 a0 b2 00 00 00 00 f1 7b
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+        10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
+   AAD: 8040f17b 8041f8d3 5501a0b2
+    PT: 47616c6c 69612065 7374206f 6d6e6973
+        20646976 69736120 696e2070 61727465
+        73207472 6573
+    IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+     H: f29000b62a499fd0a9f39a6add2e7780
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 31]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Encrypt the Plaintext
+     block # 0
+       IV||blk_cntr: 51753c6580c2726f2071841400000002
+          key_block: 75 d0 b2 14 c1 43 de 77 9c eb 58 95 5e 40 5a d9
+        plain_block: 47 61 6c 6c 69 61 20 65 73 74 20 6f 6d 6e 69 73
+       cipher_block: 32 b1 de 78 a8 22 fe 12 ef 9f 78 fa 33 2e 33 aa
+     block # 1
+       IV||blk_cntr: 51753c6580c2726f2071841400000003
+          key_block: 91 e4 7b 4e f3 2b 83 d3 dc 65 0a 72 17 8d da 6a
+        plain_block: 20 64 69 76 69 73 61 20 69 6e 20 70 61 72 74 65
+       cipher_block: b1 80 12 38 9a 58 e2 f3 b5 0b 2a 02 76 ff ae 0f
+     block # 2
+       IV||blk_cntr: 51753c6580c2726f2071841400000004
+          key_block: 68 86 43 eb dd 08 07 98 16 3a 16 d5 e5 04 f6 3a
+        plain_block: 73 20 74 72 65 73
+       cipher_block: 1b a6 37 99 b8 7b
+
+   Cipher before tag appended
+        32b1de78 a822fe12 ef9f78fa 332e33aa
+        b1801238 9a58e2f3 b50b2a02 76ffae0f
+        1ba63799 b87b
+
+   Compute the GMAC tag
+
+     Process the AAD
+           AAD word: 8040f17b8041f8d35501a0b200000000
+       partial hash: 0154dcb75485b71880e1957c877351bd
+
+     Process the cipher
+        cipher word: 32b1de78a822fe12ef9f78fa332e33aa
+       partial hash: c3f07db9a8b9cb4345eb07f793d322d2
+        cipher word: b18012389a58e2f3b50b2a0276ffae0f
+       partial hash: 6d1e66fe32eb32ecd8906ceab09db996
+        cipher word: 1ba63799b87b00000000000000000000
+       partial hash: b3d1d2f1fa3b366619bc42cd2eedafee
+
+     Process the length word
+        length word: 00000000000000600000000000000130
+       partial hash: 7debf5fa1fac3bd318d5e1a7ee401091
+
+   Turn GHASH into GMAC
+              GHASH: 7d eb f5 fa 1f ac 3b d3 18 d5 e1 a7 ee 40 10 91
+                 K0: 07 48 2e cc c0 53 ed 63 e1 6e 99 df 39 e7 7c 82
+          full GMAC: 7a a3 db 36 df ff d6 b0 f9 bb 78 78 d7 a7 6c 13
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 32]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Cipher with tag
+        32b1de78 a822fe12 ef9f78fa 332e33aa
+        b1801238 9a58e2f3 b50b2a02 76ffae0f
+        1ba63799 b87b7aa3 db36dfff d6b0f9bb
+        7878d7a7 6c13
+
+   Encrypted and tagged packet:
+        8040f17b 8041f8d3 5501a0b2 32b1de78
+        a822fe12 ef9f78fa 332e33aa b1801238
+        9a58e2f3 b50b2a02 76ffae0f 1ba63799
+        b87b7aa3 db36dfff d6b0f9bb 7878d7a7
+        6c13
+
+16.2.2.  SRTP AEAD_AES_256_GCM Decryption
+
+   Decrypting the following packet:
+
+        8040f17b 8041f8d3 5501a0b2 32b1de78
+        a822fe12 ef9f78fa 332e33aa b1801238
+        9a58e2f3 b50b2a02 76ffae0f 1ba63799
+        b87b7aa3 db36dfff d6b0f9bb 7878d7a7
+        6c13
+
+   Form the IV
+          | Pad |   SSRC    |    ROC    | SEQ |
+           00 00 55 01 a0 b2 00 00 00 00 f1 7b
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+        10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
+   AAD: 8040f17b 8041f8d3 5501a0b2
+    CT: 32b1de78 a822fe12 ef9f78fa 332e33aa
+        b1801238 9a58e2f3 b50b2a02 76ffae0f
+        1ba63799 b87b7aa3 db36dfff d6b0f9bb
+        7878d7a7 6c13
+    IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+     H: f29000b62a499fd0a9f39a6add2e7780
+
+   Verify the received tag
+      7a a3 db 36 df ff d6 b0 f9 bb 78 78 d7 a7 6c 13
+
+     Process the AAD
+           AAD word: 8040f17b8041f8d35501a0b200000000
+       partial hash: 0154dcb75485b71880e1957c877351bd
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 33]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+     Process the cipher
+        cipher word: 32b1de78a822fe12ef9f78fa332e33aa
+       partial hash: c3f07db9a8b9cb4345eb07f793d322d2
+        cipher word: b18012389a58e2f3b50b2a0276ffae0f
+       partial hash: 6d1e66fe32eb32ecd8906ceab09db996
+        cipher word: 1ba63799b87b00000000000000000000
+       partial hash: b3d1d2f1fa3b366619bc42cd2eedafee
+
+     Process the length word
+        length word: 00000000000000600000000000000130
+       partial hash: 7debf5fa1fac3bd318d5e1a7ee401091
+
+   Turn GHASH into GMAC
+              GHASH: 7d eb f5 fa 1f ac 3b d3 18 d5 e1 a7 ee 40 10 91
+                 K0: 07 48 2e cc c0 53 ed 63 e1 6e 99 df 39 e7 7c 82
+          full GMAC: 7a a3 db 36 df ff d6 b0 f9 bb 78 78 d7 a7 6c 13
+
+        Received tag = 7aa3db36 dfffd6b0 f9bb7878 d7a76c13
+        Computed tag = 7aa3db36 dfffd6b0 f9bb7878 d7a76c13
+     Received tag verified.
+
+   Decrypt the cipher
+     block # 0
+       IV||blk_cntr: 51753c6580c2726f2071841400000002
+          key_block: 75 d0 b2 14 c1 43 de 77 9c eb 58 95 5e 40 5a d9
+       cipher_block: 32 b1 de 78 a8 22 fe 12 ef 9f 78 fa 33 2e 33 aa
+        plain_block: 47 61 6c 6c 69 61 20 65 73 74 20 6f 6d 6e 69 73
+     block # 1
+       IV||blk_cntr: 51753c6580c2726f2071841400000003
+          key_block: 91 e4 7b 4e f3 2b 83 d3 dc 65 0a 72 17 8d da 6a
+       cipher_block: b1 80 12 38 9a 58 e2 f3 b5 0b 2a 02 76 ff ae 0f
+        plain_block: 20 64 69 76 69 73 61 20 69 6e 20 70 61 72 74 65
+     block # 2
+       IV||blk_cntr: 51753c6580c2726f2071841400000004
+          key_block: 68 86 43 eb dd 08 07 98 16 3a 16 d5 e5 04 f6 3a
+       cipher_block: 1b a6 37 99 b8 7b
+        plain_block: 73 20 74 72 65 73
+
+   Verified and tagged packet:
+        47616c6c 69612065 7374206f 6d6e6973
+        20646976 69736120 696e2070 61727465
+        73207472 6573
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 34]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+16.2.3.  SRTP AEAD_AES_256_GCM Authentication Tagging
+
+   Tagging the following packet:
+
+        8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573
+
+   Form the IV
+          | Pad |   SSRC    |    ROC    | SEQ |
+           00 00 55 01 a0 b2 00 00 00 00 f1 7b
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+        10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
+   AAD: 8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573
+    IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+     H: f29000b62a499fd0a9f39a6add2e7780
+
+   Compute the GMAC tag
+
+     Process the AAD
+           AAD word: 8040f17b8041f8d35501a0b247616c6c
+       partial hash: c059753e6763791762ca630d8ef97714
+           AAD word: 696120657374206f6d6e697320646976
+       partial hash: a4e3401e712900dc4f1d2303bc4b2675
+           AAD word: 69736120696e20706172746573207472
+       partial hash: 1c8c1af883de0d67878f379a19c65987
+           AAD word: 65730000000000000000000000000000
+       partial hash: 958462781aa8e8feacce6d93b54472ac
+
+     Process the length word
+        length word: 00000000000001900000000000000000
+       partial hash: af2efb5dcfdb9900e7127721fdb56956
+
+   Turn GHASH into GMAC
+              GHASH: af 2e fb 5d cf db 99 00 e7 12 77 21 fd b5 69 56
+                 K0: 07 48 2e cc c0 53 ed 63 e1 6e 99 df 39 e7 7c 82
+          full GMAC: a8 66 d5 91 0f 88 74 63 06 7c ee fe c4 52 15 d4
+
+   Cipher with tag
+        a866d591 0f887463 067ceefe c45215d4
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 35]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Tagged packet:
+        8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573a866 d5910f88 7463067c eefec452
+        15d4
+
+16.2.4.  SRTP AEAD_AES_256_GCM Tag Verification
+
+   Verifying the following packet:
+
+        8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573a866 d5910f88 7463067c eefec452
+        15d4
+
+   Form the IV
+          | Pad |   SSRC    |    ROC    | SEQ |
+           00 00 55 01 a0 b2 00 00 00 00 f1 7b
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+        10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
+   AAD: 8040f17b 8041f8d3 5501a0b2 47616c6c
+        69612065 7374206f 6d6e6973 20646976
+        69736120 696e2070 61727465 73207472
+        6573
+    CT: a866d591 0f887463 067ceefe c45215d4
+    IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14
+     H: f29000b62a499fd0a9f39a6add2e7780
+
+   Verify the received tag
+      a8 66 d5 91 0f 88 74 63 06 7c ee fe c4 52 15 d4
+
+     Process the AAD
+           AAD word: 8040f17b8041f8d35501a0b247616c6c
+       partial hash: c059753e6763791762ca630d8ef97714
+           AAD word: 696120657374206f6d6e697320646976
+       partial hash: a4e3401e712900dc4f1d2303bc4b2675
+           AAD word: 69736120696e20706172746573207472
+       partial hash: 1c8c1af883de0d67878f379a19c65987
+           AAD word: 65730000000000000000000000000000
+       partial hash: 958462781aa8e8feacce6d93b54472ac
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 36]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+     Process the length word
+        length word: 00000000000001900000000000000000
+       partial hash: af2efb5dcfdb9900e7127721fdb56956
+
+   Turn GHASH into GMAC
+              GHASH: af 2e fb 5d cf db 99 00 e7 12 77 21 fd b5 69 56
+                 K0: 07 48 2e cc c0 53 ed 63 e1 6e 99 df 39 e7 7c 82
+          full GMAC: a8 66 d5 91 0f 88 74 63 06 7c ee fe c4 52 15 d4
+
+        Received tag = a866d591 0f887463 067ceefe c45215d4
+        Computed tag = a866d591 0f887463 067ceefe c45215d4
+     Received tag verified.
+
+17.  RTCP Test Vectors
+
+   The examples in this section are all based upon the same RTCP packet:
+
+            81c8000e 4d617273 4e545031 4e545031
+            52545020 0000042a 0000eb98 4c756e61
+            deadbeef deadbeef deadbeef deadbeef
+            deadbeef
+
+   with 32-bit SRTCP index 000005d4.
+
+   As shown in Section 9.1, the IV is formed by XORing two 12-octet
+   values.  The first 12-octet value is formed by concatenating
+   two zero octets, the 4-octet SSRC (found in the fifth through
+   eighth octets of the RTP packet), another two padding octets, and the
+   31-bit SRTCP index, right-justified in a 32-bit = 4-octet field with
+   a single "0" bit prepended as padding.  An example of SRTCP IV
+   formation is shown below:
+
+             | Pad |   SSRC    | Pad |  0+SRTCP  |
+              00 00 4d 61 72 73 00 00 00 00 05 d4
+       salt   51 75 69 64 20 70 72 6f 20 71 75 6f
+              ------------------------------------
+         IV   51 75 24 05 52 03 72 6f 20 71 70 bb
+
+   In an SRTCP packet, a 1-bit Encryption flag is prepended to the
+   31-bit SRTCP index to form a 32-bit value we shall call the
+   "ESRTCP word".  The E-flag is one if the SRTCP packet has been
+   encrypted and zero if it has been tagged but not encrypted.  Note
+   that the ESRTCP field is only present in an SRTCP packet, not in an
+   RTCP packet.  The full ESRTCP word is part of the AAD.
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 37]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   When encrypting and tagging an RTCP packet (E-flag = 1), the SRTCP
+   packet consists of the following fields in the following order:
+
+   - The first 8 octets of the RTCP packet (part of the AAD).
+
+   - The cipher.
+
+   - The ESRTCP word (the final part of the AAD).
+
+   - Any Raw Data that might have been appended to the end of the
+     original RTCP packet.
+
+   Recall that AEAD treats the authentication tag as an integral part of
+   the cipher, and in fact the authentication tag is the last 8 or
+   16 octets of the cipher.
+
+   The reader is reminded that when the RTCP packet is to be tagged but
+   not encrypted (E-flag = 0), GCM will produce a cipher that consists
+   solely of the 8-octet or 16-octet authentication tag.  The tagged
+   SRTCP consists of the following fields in the order listed below:
+
+   - All of the AAD, except for the ESRTCP word.
+
+   - The cipher (= the authentication tag).
+
+   - The ESRTCP word (the final part of the AAD).
+
+   - Any Raw Data that might have been appended to the end of the
+     original RTCP packet.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 38]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+17.1.  SRTCP AEAD_AES_128_GCM Encryption and Tagging
+
+   Encrypting the following packet:
+
+        81c8000d 4d617273 4e545031 4e545032
+        52545020 0000042a 0000e930 4c756e61
+        deadbeef deadbeef deadbeef deadbeef
+        deadbeef
+
+   Key size = 128 bits
+   Tag size =  16 octets
+
+   Form the IV
+          | Pad |   SSRC    | Pad |   SRTCP   |
+           00 00 4d 61 72 73 00 00 00 00 05 d4
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 24 05 52 03 72 6f 20 71 70 bb
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+   AAD: 81c8000d 4d617273 800005d4
+    PT: 4e545031 4e545032 52545020 0000042a
+        0000e930 4c756e61 deadbeef deadbeef
+        deadbeef deadbeef deadbeef
+    IV: 51 75 24 05 52 03 72 6f 20 71 70 bb
+     H: c6a13b37878f5b826f4f8162a1c8d879
+
+   Encrypt the Plaintext
+     block # 0
+       IV||blk_cntr: 517524055203726f207170bb00000002
+          key_block: 2d bd 18 b4 92 8e e6 4e f5 73 87 46 2f 6b 7a b3
+        plain_block: 4e 54 50 31 4e 54 50 32 52 54 50 20 00 00 04 2a
+       cipher_block: 63 e9 48 85 dc da b6 7c a7 27 d7 66 2f 6b 7e 99
+     block # 1
+       IV||blk_cntr: 517524055203726f207170bb00000003
+          key_block: 7f f5 29 c7 20 73 9d 4c 18 db 1b 1e ad a0 d1 35
+        plain_block: 00 00 e9 30 4c 75 6e 61 de ad be ef de ad be ef
+       cipher_block: 7f f5 c0 f7 6c 06 f3 2d c6 76 a5 f1 73 0d 6f da
+     block # 2
+       IV||blk_cntr: 517524055203726f207170bb00000004
+          key_block: 92 4d 25 a9 58 9d 83 02 d5 14 99 b4 e0 14 78 15
+        plain_block: de ad be ef de ad be ef de ad be ef
+       cipher_block: 4c e0 9b 46 86 30 3d ed 0b b9 27 5b
+
+   Cipher before tag appended
+        63e94885 dcdab67c a727d766 2f6b7e99
+        7ff5c0f7 6c06f32d c676a5f1 730d6fda
+        4ce09b46 86303ded 0bb9275b
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 39]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Compute the GMAC tag
+
+     Process the AAD
+           AAD word: 81c8000d4d617273800005d400000000
+       partial hash: 085d6eb166c555aa62982f630430ec6e
+
+     Process the cipher
+        cipher word: 63e94885dcdab67ca727d7662f6b7e99
+       partial hash: 8c9221be93466d68bbb16fa0d42b0187
+        cipher word: 7ff5c0f76c06f32dc676a5f1730d6fda
+       partial hash: 221ebb044ec9fd0bf116d7780f198792
+        cipher word: 4ce09b4686303ded0bb9275b00000000
+       partial hash: 50f70b9ca110ab312dce212657328dae
+
+     Process the length word
+        length word: 00000000000000600000000000000160
+       partial hash: 7296107c9716534371dfc1a30c5ffeb5
+
+   Turn GHASH into GMAC
+              GHASH: 72 96 10 7c 97 16 53 43 71 df c1 a3 0c 5f fe b5
+                 K0: ba dc b4 24 01 d9 1e 6c b4 74 39 d1 49 86 14 6b
+          full GMAC: c8 4a a4 58 96 cf 4d 2f c5 ab f8 72 45 d9 ea de
+
+   Cipher with tag
+        63e94885 dcdab67c a727d766 2f6b7e99
+        7ff5c0f7 6c06f32d c676a5f1 730d6fda
+        4ce09b46 86303ded 0bb9275b c84aa458
+        96cf4d2f c5abf872 45d9eade
+
+   Append the ESRTCP word with the E-flag set
+        63e94885 dcdab67c a727d766 2f6b7e99
+        7ff5c0f7 6c06f32d c676a5f1 730d6fda
+        4ce09b46 86303ded 0bb9275b c84aa458
+        96cf4d2f c5abf872 45d9eade 800005d4
+
+   Encrypted and tagged packet:
+        81c8000d 4d617273 63e94885 dcdab67c
+        a727d766 2f6b7e99 7ff5c0f7 6c06f32d
+        c676a5f1 730d6fda 4ce09b46 86303ded
+        0bb9275b c84aa458 96cf4d2f c5abf872
+        45d9eade 800005d4
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 40]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+17.2.  SRTCP AEAD_AES_256_GCM Verification and Decryption
+
+   Key size = 256 bits
+   Tag size =  16 octets
+
+     Process the length word
+
+   Decrypting the following packet:
+
+        81c8000d 4d617273 d50ae4d1 f5ce5d30
+        4ba297e4 7d470c28 2c3ece5d bffe0a50
+        a2eaa5c1 110555be 8415f658 c61de047
+        6f1b6fad 1d1eb30c 4446839f 57ff6f6c
+        b26ac3be 800005d4
+
+   Key size = 256 bits
+   Key size =  16 octets
+
+   Form the IV
+          | Pad |   SSRC    | Pad |   SRTCP   |
+           00 00 4d 61 72 73 00 00 00 00 05 d4
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 24 05 52 03 72 6f 20 71 70 bb
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+        10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
+   AAD: 81c8000d 4d617273 800005d4
+    CT: d50ae4d1 f5ce5d30 4ba297e4 7d470c28
+        2c3ece5d bffe0a50 a2eaa5c1 110555be
+        8415f658 c61de047 6f1b6fad 1d1eb30c
+        4446839f 57ff6f6c b26ac3be
+    IV: 51 75 24 05 52 03 72 6f 20 71 70 bb
+     H: f29000b62a499fd0a9f39a6add2e7780
+
+   Verify the received tag
+      1d 1e b3 0c 44 46 83 9f 57 ff 6f 6c b2 6a c3 be
+
+     Process the AAD
+           AAD word: 81c8000d4d617273800005d400000000
+       partial hash: 3ae5afd36dead5280b18950400176b5b
+
+     Process the cipher
+        cipher word: d50ae4d1f5ce5d304ba297e47d470c28
+       partial hash: e90fab7546f6940781227227ac926ebe
+        cipher word: 2c3ece5dbffe0a50a2eaa5c1110555be
+       partial hash: 9b236807d8b2dab07583adce367aa88f
+        cipher word: 8415f658c61de0476f1b6fad00000000
+       partial hash: e69313f423a75e3e0b7eb93321700e86
+
+
+
+McGrew & Igoe                Standards Track                   [Page 41]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+     Process the length word
+        length word: 00000000000000600000000000000160
+       partial hash: 3a284af2616fdf505faf37eec39fbc8b
+
+   Turn GHASH into GMAC
+              GHASH: 3a 28 4a f2 61 6f df 50 5f af 37 ee c3 9f bc 8b
+                 K0: 27 36 f9 fe 25 29 5c cf 08 50 58 82 71 f5 7f 35
+          full GMAC: 1d 1e b3 0c 44 46 83 9f 57 ff 6f 6c b2 6a c3 be
+
+        Received tag = 1d1eb30c 4446839f 57ff6f6c b26ac3be
+        Computed tag = 1d1eb30c 4446839f 57ff6f6c b26ac3be
+     Received tag verified.
+
+   Decrypt the cipher
+     block # 0
+       IV||blk_cntr: 517524055203726f207170bb00000002
+          key_block: 9b 5e b4 e0 bb 9a 0d 02 19 f6 c7 c4 7d 47 08 02
+       cipher_block: d5 0a e4 d1 f5 ce 5d 30 4b a2 97 e4 7d 47 0c 28
+        plain_block: 4e 54 50 31 4e 54 50 32 52 54 50 20 00 00 04 2a
+     block # 1
+       IV||blk_cntr: 517524055203726f207170bb00000003
+          key_block: 2c 3e 27 6d f3 8b 64 31 7c 47 1b 2e cf a8 eb 51
+       cipher_block: 2c 3e ce 5d bf fe 0a 50 a2 ea a5 c1 11 05 55 be
+        plain_block: 00 00 e9 30 4c 75 6e 61 de ad be ef de ad be ef
+     block # 2
+       IV||blk_cntr: 517524055203726f207170bb00000004
+          key_block: 5a b8 48 b7 18 b0 5e a8 b1 b6 d1 42 3b 74 39 55
+       cipher_block: 84 15 f6 58 c6 1d e0 47 6f 1b 6f ad
+        plain_block: de ad be ef de ad be ef de ad be ef
+
+   Verified and decrypted packet:
+        81c8000d 4d617273 4e545031 4e545032
+        52545020 0000042a 0000e930 4c756e61
+        deadbeef deadbeef deadbeef deadbeef
+        deadbeef
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 42]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+17.3.  SRTCP AEAD_AES_128_GCM Tagging Only
+
+   Tagging the following packet:
+
+        81c8000d 4d617273 4e545031 4e545032
+        52545020 0000042a 0000e930 4c756e61
+        deadbeef deadbeef deadbeef deadbeef
+        deadbeef
+
+   Key size = 128 bits
+   Tag size =  16 octets
+
+   Form the IV
+          | Pad |   SSRC    | Pad |   SRTCP   |
+           00 00 4d 61 72 73 00 00 00 00 05 d4
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 24 05 52 03 72 6f 20 71 70 bb
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+   AAD: 81c8000d 4d617273 4e545031 4e545032
+        52545020 0000042a 0000e930 4c756e61
+        deadbeef deadbeef deadbeef deadbeef
+        deadbeef 000005d4
+    IV: 51 75 24 05 52 03 72 6f 20 71 70 bb
+     H: c6a13b37878f5b826f4f8162a1c8d879
+
+   Compute the GMAC tag
+
+     Process the AAD
+           AAD word: 81c8000d4d6172734e5450314e545032
+       partial hash: f8dbbe278e06afe17fb4fb2e67f0a22e
+           AAD word: 525450200000042a0000e9304c756e61
+       partial hash: 6ccd900dfd0eb292f68f8a410d0648ec
+           AAD word: deadbeefdeadbeefdeadbeefdeadbeef
+       partial hash: 6a14be0ea384c6b746235ba955a57ff5
+           AAD word: deadbeef000005d40000000000000000
+       partial hash: cc81f14905670a1e37f8bc81a91997cd
+
+     Process the length word
+        length word: 00000000000001c00000000000000000
+       partial hash: 3ec16d4c3c0e90a59e91be415bd976d8
+
+   Turn GHASH into GMAC
+              GHASH: 3e c1 6d 4c 3c 0e 90 a5 9e 91 be 41 5b d9 76 d8
+                 K0: ba dc b4 24 01 d9 1e 6c b4 74 39 d1 49 86 14 6b
+          full GMAC: 84 1d d9 68 3d d7 8e c9 2a e5 87 90 12 5f 62 b3
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 43]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   Cipher with tag
+        841dd968 3dd78ec9 2ae58790 125f62b3
+
+   Tagged packet:
+        81c8000d 4d617273 4e545031 4e545032
+        52545020 0000042a 0000e930 4c756e61
+        deadbeef deadbeef deadbeef deadbeef
+        deadbeef 841dd968 3dd78ec9 2ae58790
+        125f62b3 000005d4
+
+17.4.  SRTCP AEAD_AES_256_GCM Tag Verification
+
+   Key size = 256 bits
+   Tag size =  16 octets
+
+     Process the length word
+   Verifying the following packet:
+
+        81c8000d 4d617273 4e545031 4e545032
+        52545020 0000042a 0000e930 4c756e61
+        deadbeef deadbeef deadbeef deadbeef
+        deadbeef 91db4afb feee5a97 8fab4393
+        ed2615fe 000005d4
+
+   Key size = 256 bits
+   Key size =  16 octets
+
+   Form the IV
+          | Pad |   SSRC    | Pad |   SRTCP   |
+           00 00 4d 61 72 73 00 00 00 00 05 d4
+     salt: 51 75 69 64 20 70 72 6f 20 71 75 6f
+       IV: 51 75 24 05 52 03 72 6f 20 71 70 bb
+
+   Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
+        10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
+   AAD: 81c8000d 4d617273 4e545031 4e545032
+        52545020 0000042a 0000e930 4c756e61
+        deadbeef deadbeef deadbeef deadbeef
+        deadbeef 000005d4
+    CT: 91db4afb feee5a97 8fab4393 ed2615fe
+    IV: 51 75 24 05 52 03 72 6f 20 71 70 bb
+     H: f29000b62a499fd0a9f39a6add2e7780
+
+   Verify the received tag
+      91 db 4a fb fe ee 5a 97 8f ab 43 93 ed 26 15 fe
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 44]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+     Process the AAD
+           AAD word: 81c8000d4d6172734e5450314e545032
+       partial hash: 7bc665c71676a5a5f663b3229af4b85c
+           AAD word: 525450200000042a0000e9304c756e61
+       partial hash: 34ed77752703ab7d69f44237910e3bc0
+           AAD word: deadbeefdeadbeefdeadbeefdeadbeef
+       partial hash: 74a59f1a99282344d64ab1c8a2be6cf8
+           AAD word: deadbeef000005d40000000000000000
+       partial hash: 126335c0baa7ab1b79416ceeb9f7a518
+
+     Process the length word
+        length word: 00000000000001c00000000000000000
+       partial hash: b6edb305dbc7065887fb1b119cd36acb
+
+   Turn GHASH into GMAC
+              GHASH: b6 ed b3 05 db c7 06 58 87 fb 1b 11 9c d3 6a cb
+                 K0: 27 36 f9 fe 25 29 5c cf 08 50 58 82 71 f5 7f 35
+          full GMAC: 91 db 4a fb fe ee 5a 97 8f ab 43 93 ed 26 15 fe
+
+        Received tag = 91db4afb feee5a97 8fab4393 ed2615fe
+        Computed tag = 91db4afb feee5a97 8fab4393 ed2615fe
+     Received tag verified.
+
+   Verified packet:
+        81c8000d 4d617273 4e545031 4e545032
+        52545020 0000042a 0000e930 4c756e61
+        deadbeef deadbeef deadbeef deadbeef
+        deadbeef
+
+18.  References
+
+18.1.  Normative References
+
+   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
+              Requirement Levels", BCP 14, RFC 2119,
+              DOI 10.17487/RFC2119, March 1997,
+              <http://www.rfc-editor.org/info/rfc2119>.
+
+   [RFC3550]  Schulzrinne, H., Casner, S., Frederick, R., and V.
+              Jacobson, "RTP: A Transport Protocol for Real-Time
+              Applications", STD 64, RFC 3550, DOI 10.17487/RFC3550,
+              July 2003, <http://www.rfc-editor.org/info/rfc3550>.
+
+   [RFC3711]  Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K.
+              Norrman, "The Secure Real-time Transport Protocol (SRTP)",
+              RFC 3711, DOI 10.17487/RFC3711, March 2004,
+              <http://www.rfc-editor.org/info/rfc3711>.
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 45]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+   [RFC3830]  Arkko, J., Carrara, E., Lindholm, F., Naslund, M., and K.
+              Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830,
+              DOI 10.17487/RFC3830, August 2004,
+              <http://www.rfc-editor.org/info/rfc3830>.
+
+   [RFC4568]  Andreasen, F., Baugher, M., and D. Wing, "Session
+              Description Protocol (SDP) Security Descriptions for Media
+              Streams", RFC 4568, DOI 10.17487/RFC4568, July 2006,
+              <http://www.rfc-editor.org/info/rfc4568>.
+
+   [RFC5116]  McGrew, D., "An Interface and Algorithms for Authenticated
+              Encryption", RFC 5116, DOI 10.17487/RFC5116, January 2008,
+              <http://www.rfc-editor.org/info/rfc5116>.
+
+   [RFC5234]  Crocker, D., Ed., and P. Overell, "Augmented BNF for
+              Syntax Specifications: ABNF", STD 68, RFC 5234,
+              DOI 10.17487/RFC5234, January 2008,
+              <http://www.rfc-editor.org/info/rfc5234>.
+
+   [RFC5764]  McGrew, D. and E. Rescorla, "Datagram Transport Layer
+              Security (DTLS) Extension to Establish Keys for the Secure
+              Real-time Transport Protocol (SRTP)", RFC 5764,
+              DOI 10.17487/RFC5764, May 2010,
+              <http://www.rfc-editor.org/info/rfc5764>.
+
+   [RFC6188]  McGrew, D., "The Use of AES-192 and AES-256 in Secure
+              RTP", RFC 6188, DOI 10.17487/RFC6188, March 2011,
+              <http://www.rfc-editor.org/info/rfc6188>.
+
+   [RFC6904]  Lennox, J., "Encryption of Header Extensions in the Secure
+              Real-time Transport Protocol (SRTP)", RFC 6904,
+              DOI 10.17487/RFC6904, April 2013,
+              <http://www.rfc-editor.org/info/rfc6904>.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 46]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+18.2.  Informative References
+
+   [BN00]     Bellare, M. and C. Namprempre, "Authenticated Encryption:
+              Relations among notions and analysis of the generic
+              composition paradigm", Proceedings of ASIACRYPT 2000,
+              Springer-Verlag, LNCS 1976, pp. 531-545,
+              DOI 10.1007/3-540-44448-3_41,
+              <http://www-cse.ucsd.edu/users/mihir/papers/oem.html>.
+
+   [GCM]      Dworkin, M., "NIST Special Publication 800-38D:
+              Recommendation for Block Cipher Modes of Operation:
+              Galois/Counter Mode (GCM) and GMAC", U.S. National
+              Institute of Standards and Technology, November 2007,
+              <http://csrc.nist.gov/publications/nistpubs/
+              800-38D/SP-800-38D.pdf>.
+
+   [R02]      Rogaway, P., "Authenticated-Encryption with Associated-
+              Data", ACM Conference on Computer and Communications
+              Security (CCS'02), pp. 98-107, ACM Press,
+              DOI 10.1145/586110.586125, September 2002,
+              <http://www.cs.ucdavis.edu/~rogaway/papers/ad.html>.
+
+   [RFC4771]  Lehtovirta, V., Naslund, M., and K. Norrman, "Integrity
+              Transform Carrying Roll-Over Counter for the Secure
+              Real-time Transport Protocol (SRTP)", RFC 4771,
+              DOI 10.17487/RFC4771, January 2007,
+              <http://www.rfc-editor.org/info/rfc4771>.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 47]
+
+RFC 7714                    AES-GCM for SRTP               December 2015
+
+
+Acknowledgements
+
+   The authors would like to thank Michael Peck, Michael Torla, Qin Wu,
+   Magnus Westerlund, Oscar Ohllson, Woo-Hwan Kim, John Mattsson,
+   Richard Barnes, Morris Dworkin, Stephen Farrell, and many other
+   reviewers who provided valuable comments on earlier draft versions of
+   this document.
+
+Authors' Addresses
+
+   David A. McGrew
+   Cisco Systems, Inc.
+   510 McCarthy Blvd.
+   Milpitas, CA  95035
+   United States
+   Phone: (408) 525 8651
+
+   Email: mcgrew@cisco.com
+   URI:   http://www.mindspring.com/~dmcgrew/dam.htm
+
+
+   Kevin M. Igoe
+   NSA/CSS Commercial Solutions Center
+   National Security Agency
+
+   Email: mythicalkevin@yahoo.com
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+McGrew & Igoe                Standards Track                   [Page 48]
+