diff options
Diffstat (limited to 'doc/rfc/rfc7714.txt')
-rw-r--r-- | doc/rfc/rfc7714.txt | 2691 |
1 files changed, 2691 insertions, 0 deletions
diff --git a/doc/rfc/rfc7714.txt b/doc/rfc/rfc7714.txt new file mode 100644 index 0000000..f67912a --- /dev/null +++ b/doc/rfc/rfc7714.txt @@ -0,0 +1,2691 @@ + + + + + + +Internet Engineering Task Force (IETF) D. McGrew +Request for Comments: 7714 Cisco Systems, Inc. +Category: Standards Track K. Igoe +ISSN: 2070-1721 National Security Agency + December 2015 + + + AES-GCM Authenticated Encryption + in the Secure Real-time Transport Protocol (SRTP) + +Abstract + + This document defines how the AES-GCM Authenticated Encryption with + Associated Data family of algorithms can be used to provide + confidentiality and data authentication in the Secure Real-time + Transport Protocol (SRTP). + +Status of This Memo + + This is an Internet Standards Track document. + + This document is a product of the Internet Engineering Task Force + (IETF). It represents the consensus of the IETF community. It has + received public review and has been approved for publication by the + Internet Engineering Steering Group (IESG). Further information on + Internet Standards is available in Section 2 of RFC 5741. + + Information about the current status of this document, any errata, + and how to provide feedback on it may be obtained at + http://www.rfc-editor.org/info/rfc7714. + +Copyright Notice + + Copyright (c) 2015 IETF Trust and the persons identified as the + document authors. All rights reserved. + + This document is subject to BCP 78 and the IETF Trust's Legal + Provisions Relating to IETF Documents + (http://trustee.ietf.org/license-info) in effect on the date of + publication of this document. Please review these documents + carefully, as they describe your rights and restrictions with respect + to this document. Code Components extracted from this document must + include Simplified BSD License text as described in Section 4.e of + the Trust Legal Provisions and are provided without warranty as + described in the Simplified BSD License. + + + + + + +McGrew & Igoe Standards Track [Page 1] + +RFC 7714 AES-GCM for SRTP December 2015 + + +Table of Contents + + 1. Introduction ....................................................3 + 2. Conventions Used in This Document ...............................4 + 3. Overview of the SRTP/SRTCP AEAD Security Architecture ...........4 + 4. Terminology .....................................................5 + 5. Generic AEAD Processing .........................................6 + 5.1. Types of Input Data ........................................6 + 5.2. AEAD Invocation Inputs and Outputs .........................6 + 5.2.1. Encrypt Mode ........................................6 + 5.2.2. Decrypt Mode ........................................7 + 5.3. Handling of AEAD Authentication ............................7 + 6. Counter Mode Encryption .........................................7 + 7. Unneeded SRTP/SRTCP Fields ......................................8 + 7.1. SRTP/SRTCP Authentication Tag Field ........................8 + 7.2. RTP Padding ................................................9 + 8. AES-GCM Processing for SRTP .....................................9 + 8.1. SRTP IV Formation for AES-GCM ..............................9 + 8.2. Data Types in SRTP Packets ................................10 + 8.3. Handling Header Extensions ................................11 + 8.4. Prevention of SRTP IV Reuse ...............................12 + 9. AES-GCM Processing of SRTCP Compound Packets ...................13 + 9.1. SRTCP IV Formation for AES-GCM ............................13 + 9.2. Data Types in Encrypted SRTCP Compound Packets ............14 + 9.3. Data Types in Unencrypted SRTCP Compound Packets ..........16 + 9.4. Prevention of SRTCP IV Reuse ..............................17 + 10. Constraints on AEAD for SRTP and SRTCP ........................17 + 11. Key Derivation Functions ......................................18 + 12. Summary of AES-GCM in SRTP/SRTCP ..............................19 + 13. Security Considerations .......................................20 + 13.1. Handling of Security-Critical Parameters .................20 + 13.2. Size of the Authentication Tag ...........................21 + 14. IANA Considerations ...........................................21 + 14.1. SDES .....................................................21 + 14.2. DTLS-SRTP ................................................22 + 14.3. MIKEY ....................................................23 + 15. Parameters for Use with MIKEY .................................23 + 16. Some RTP Test Vectors .........................................24 + 16.1. SRTP AEAD_AES_128_GCM ....................................25 + 16.1.1. SRTP AEAD_AES_128_GCM Encryption ..................25 + 16.1.2. SRTP AEAD_AES_128_GCM Decryption ..................27 + 16.1.3. SRTP AEAD_AES_128_GCM Authentication Tagging ......29 + 16.1.4. SRTP AEAD_AES_128_GCM Tag Verification ............30 + 16.2. SRTP AEAD_AES_256_GCM ....................................31 + 16.2.1. SRTP AEAD_AES_256_GCM Encryption ..................31 + 16.2.2. SRTP AEAD_AES_256_GCM Decryption ..................33 + 16.2.3. SRTP AEAD_AES_256_GCM Authentication Tagging ......35 + 16.2.4. SRTP AEAD_AES_256_GCM Tag Verification ............36 + + + +McGrew & Igoe Standards Track [Page 2] + +RFC 7714 AES-GCM for SRTP December 2015 + + + 17. RTCP Test Vectors .............................................37 + 17.1. SRTCP AEAD_AES_128_GCM Encryption and Tagging ............39 + 17.2. SRTCP AEAD_AES_256_GCM Verification and Decryption .......41 + 17.3. SRTCP AEAD_AES_128_GCM Tagging Only ......................43 + 17.4. SRTCP AEAD_AES_256_GCM Tag Verification ..................44 + 18. References ....................................................45 + 18.1. Normative References .....................................45 + 18.2. Informative References ...................................47 + Acknowledgements ..................................................48 + Authors' Addresses ................................................48 + +1. Introduction + + The Secure Real-time Transport Protocol (SRTP) [RFC3711] is a profile + of the Real-time Transport Protocol (RTP) [RFC3550], which can + provide confidentiality, message authentication, and replay + protection to the RTP traffic and to the control traffic for RTP, the + Real-time Transport Control Protocol (RTCP). It is important to note + that the outgoing SRTP packets from a single endpoint may be + originating from several independent data sources. + + Authenticated Encryption [BN00] is a form of encryption that, in + addition to providing confidentiality for the Plaintext that is + encrypted, provides a way to check its integrity and authenticity. + Authenticated Encryption with Associated Data, or AEAD [R02], adds + the ability to check the integrity and authenticity of some + Associated Data (AD), also called "Additional Authenticated Data" + (AAD), that is not encrypted. This specification makes use of the + interface to a generic AEAD algorithm as defined in [RFC5116]. + + The Advanced Encryption Standard (AES) is a block cipher that + provides a high level of security and can accept different key sizes. + AES Galois/Counter Mode (AES-GCM) [GCM] is a family of AEAD + algorithms based upon AES. This specification makes use of the AES + versions that use 128-bit and 256-bit keys, which we call "AES-128" + and "AES-256", respectively. + + Any AEAD algorithm provides an intrinsic authentication tag. In many + applications, the authentication tag is truncated to less than full + length. In this specification, the authentication tag MUST NOT be + truncated. The authentications tags MUST be a full 16 octets in + length. When used in SRTP/SRTCP, AES-GCM will have two + configurations: + + AEAD_AES_128_GCM AES-128 with a 16-octet authentication tag + AEAD_AES_256_GCM AES-256 with a 16-octet authentication tag + + + + + +McGrew & Igoe Standards Track [Page 3] + +RFC 7714 AES-GCM for SRTP December 2015 + + + The key size is set when the session is initiated and SHOULD NOT be + altered. + + The Galois/Counter Mode of operation (GCM) is an AEAD mode of + operation for block ciphers. GCM uses Counter Mode to encrypt the + data, an operation that can be efficiently pipelined. Further, GCM + authentication uses operations that are particularly well suited to + efficient implementation in hardware, making it especially appealing + for high-speed implementations, or for implementations in an + efficient and compact circuit. + + In summary, this document defines how to use an AEAD algorithm, + particularly AES-GCM, to provide confidentiality and message + authentication within SRTP and SRTCP packets. + +2. Conventions Used in This Document + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and + "OPTIONAL" in this document are to be interpreted as described in + [RFC2119]. + +3. Overview of the SRTP/SRTCP AEAD Security Architecture + + SRTP/SRTCP AEAD security is based upon the following principles: + + a) Both privacy and authentication are based upon the use of + symmetric algorithms. An AEAD algorithm such as AES-GCM + combines privacy and authentication into a single process. + + b) A secret master key is shared by all participating endpoints -- + both those originating SRTP/SRTCP packets and those receiving + these packets. Any given master key MAY be used simultaneously + by several endpoints to originate SRTP/SRTCP packets (as well + as one or more endpoints using this master key to process + inbound data). + + c) A Key Derivation Function (KDF) is applied to the shared master + key value to form separate encryption keys, authentication + keys, and salting keys for SRTP and for SRTCP (a total of six + keys). This process is described in Section 4.3 of [RFC3711]. + The master key MUST be at least as large as the encryption key + derived from it. Since AEAD algorithms such as AES-GCM combine + encryption and authentication into a single process, AEAD + algorithms do not make use of separate authentication keys. + + + + + + +McGrew & Igoe Standards Track [Page 4] + +RFC 7714 AES-GCM for SRTP December 2015 + + + d) Aside from making modifications to IANA registries to allow + AES-GCM to work with Security Descriptions (SDES), Datagram + Transport Layer Security for Secure RTP (DTLS-SRTP), and + Multimedia Internet KEYing (MIKEY), the details of how the + master key is established and shared between the participants + are outside the scope of this document. Similarly, any + mechanism for rekeying an existing session is outside the scope + of the document. + + e) Each time an instantiation of AES-GCM is invoked to encrypt and + authenticate an SRTP or SRTCP data packet, a new Initialization + Vector (IV) is used. SRTP combines the 4-octet Synchronization + Source (SSRC) identifier, the 4-octet Rollover Counter (ROC), + and the 2-octet Sequence Number (SEQ) with the 12-octet + encryption salt to form a 12-octet IV (see Section 8.1). + SRTCP combines the SSRC and 31-bit SRTCP index with the + encryption salt to form a 12-octet IV (see Section 9.1). + +4. Terminology + + The following terms have very specific meanings in the context of + this RFC: + + Instantiation: In AEAD, an instantiation is an (Encryption_key, + salt) pair together with all of the data structures + (for example, counters) needed for it to function + properly. In SRTP/SRTCP, each endpoint will need + two instantiations of the AEAD algorithm for each + master key in its possession: one instantiation for + SRTP traffic and one instantiation for SRTCP + traffic. + + Invocation: SRTP/SRTCP data streams are broken into packets. + Each packet is processed by a single invocation of + the appropriate instantiation of the AEAD + algorithm. + + In many applications, each endpoint will have one master key for + processing outbound data but may have one or more separate master + keys for processing inbound data. + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 5] + +RFC 7714 AES-GCM for SRTP December 2015 + + +5. Generic AEAD Processing + +5.1. Types of Input Data + + Associated Data: Data that is to be authenticated but not + encrypted. + + Plaintext: Data that is to be both encrypted and + authenticated. + + Raw Data: Data that is to be neither encrypted nor + authenticated. + + Which portions of SRTP/SRTCP packets that are to be treated as + Associated Data, which are to be treated as Plaintext, and which are + to be treated as Raw Data are covered in Sections 8.2, 9.2, and 9.3. + +5.2. AEAD Invocation Inputs and Outputs + +5.2.1. Encrypt Mode + + Inputs: + Encryption_key Octet string, either 16 or + 32 octets long + Initialization_Vector Octet string, 12 octets long + Associated_Data Octet string of variable length + Plaintext Octet string of variable length + + Outputs: + Ciphertext* Octet string, length = + length(Plaintext) + tag_length + + (*): In AEAD, the authentication tag in embedded in the + ciphertext. When GCM is being used, the ciphertext + consists of the encrypted Plaintext followed by the + authentication tag. + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 6] + +RFC 7714 AES-GCM for SRTP December 2015 + + +5.2.2. Decrypt Mode + + Inputs: + Encryption_key Octet string, either 16 or + 32 octets long + Initialization_Vector Octet string, 12 octets long + Associated_Data Octet string of variable length + Ciphertext Octet string of variable length + + Outputs: + Plaintext Octet string, length = + length(Ciphertext) - tag_length + Validity_Flag Boolean, TRUE if valid, + FALSE otherwise + +5.3. Handling of AEAD Authentication + + AEAD requires that all incoming packets MUST pass AEAD authentication + before any other action takes place. Plaintext and Associated Data + MUST NOT be released until the AEAD authentication tag has been + validated. Further, the ciphertext MUST NOT be decrypted until the + AEAD tag has been validated. + + Should the AEAD tag prove to be invalid, the packet in question is to + be discarded and a Validation Error flag raised. Local policy + determines how this flag is to be handled and is outside the scope of + this document. + +6. Counter Mode Encryption + + Each outbound packet uses a 12-octet IV and an encryption key to form + two outputs: + + o a 16-octet first_key_block, which is used in forming the + authentication tag, and + + o a keystream of octets, formed in blocks of 16 octets each + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 7] + +RFC 7714 AES-GCM for SRTP December 2015 + + + The first 16-octet block of the key is saved for use in forming the + authentication tag, and the remainder of the keystream is XORed to + the Plaintext to form the cipher. This keystream is formed one block + at a time by inputting the concatenation of a 12-octet IV (see + Sections 8.1 and 9.1) with a 4-octet block to AES. The pseudocode + below illustrates this process: + + def GCM_keystream( Plaintext_len, IV, Encryption_key ): + assert Plaintext_len <= (2**36) - 32 ## measured in octets + key_stream = "" + block_counter = 1 + first_key_block = AES_ENC( data=IV||block_counter, + key=Encryption_key ) + while len(key_stream) < Plaintext_len: + block_counter = block_counter + 1 + key_block = AES_ENC( data=IV||block_counter, + key=Encryption_key ) + key_stream = key_stream||key_block + key_stream = truncate( key_stream, Plaintext_len ) + return( first_key_block, key_stream ) + + In theory, this keystream generation process allows for the + encryption of up to (2^36) - 32 octets per invocation (i.e., per + packet), far longer than is actually required. + + With any counter mode, if the same (IV, Encryption_key) pair is used + twice, precisely the same keystream is formed. As explained in + Section 9.1 of [RFC3711], this is a cryptographic disaster. For GCM, + the consequences are even worse, since such a reuse compromises GCM's + integrity mechanism not only for the current packet stream but for + all future uses of the current encryption_key. + +7. Unneeded SRTP/SRTCP Fields + + AEAD Counter Mode encryption removes the need for certain existing + SRTP/SRTCP mechanisms. + +7.1. SRTP/SRTCP Authentication Tag Field + + The AEAD message authentication mechanism MUST be the primary message + authentication mechanism for AEAD SRTP/SRTCP. Additional SRTP/SRTCP + authentication mechanisms SHOULD NOT be used with any AEAD algorithm, + and the optional SRTP/SRTCP authentication tags are NOT RECOMMENDED + and SHOULD NOT be present. Note that this contradicts Section 3.4 of + [RFC3711], which makes the use of the SRTCP authentication tag field + mandatory, but the presence of the AEAD authentication renders the + older authentication methods redundant. + + + + +McGrew & Igoe Standards Track [Page 8] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Rationale: Some applications use the SRTP/SRTCP authentication tag + as a means of conveying additional information, notably [RFC4771]. + This document retains the authentication tag field primarily to + preserve compatibility with these applications. + +7.2. RTP Padding + + AES-GCM does not require that the data be padded out to a specific + block size, reducing the need to use the padding mechanism provided + by RTP. It is RECOMMENDED that the RTP padding mechanism not be used + unless it is necessary to disguise the length of the underlying + Plaintext. + +8. AES-GCM Processing for SRTP + +8.1. SRTP IV Formation for AES-GCM + + 0 0 0 0 0 0 0 0 0 0 1 1 + 0 1 2 3 4 5 6 7 8 9 0 1 + +--+--+--+--+--+--+--+--+--+--+--+--+ + |00|00| SSRC | ROC | SEQ |---+ + +--+--+--+--+--+--+--+--+--+--+--+--+ | + | + +--+--+--+--+--+--+--+--+--+--+--+--+ | + | Encryption Salt |->(+) + +--+--+--+--+--+--+--+--+--+--+--+--+ | + | + +--+--+--+--+--+--+--+--+--+--+--+--+ | + | Initialization Vector |<--+ + +--+--+--+--+--+--+--+--+--+--+--+--+ + + Figure 1: AES-GCM SRTP Initialization Vector Formation + + The 12-octet IV used by AES-GCM SRTP is formed by first concatenating + 2 octets of zeroes, the 4-octet SSRC, the 4-octet rollover counter + (ROC), and the 2-octet sequence number (SEQ). The resulting 12-octet + value is then XORed to the 12-octet salt to form the 12-octet IV. + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 9] + +RFC 7714 AES-GCM for SRTP December 2015 + + +8.2. Data Types in SRTP Packets + + All SRTP packets MUST be both authenticated and encrypted. The data + fields within the RTP packets are broken into Associated Data, + Plaintext, and Raw Data, as follows (see Figure 2): + + Associated Data: The version V (2 bits), padding flag P (1 bit), + extension flag X (1 bit), Contributing Source + (CSRC) count CC (4 bits), marker M (1 bit), + Payload Type PT (7 bits), sequence number + (16 bits), timestamp (32 bits), SSRC (32 bits), + optional CSRC identifiers (32 bits each), and + optional RTP extension (variable length). + + Plaintext: The RTP payload (variable length), RTP padding + (if used, variable length), and RTP pad count (if + used, 1 octet). + + Raw Data: The optional variable-length SRTP Master Key + Identifier (MKI) and SRTP authentication tag + (whose use is NOT RECOMMENDED). These fields are + appended after encryption has been performed. + + 0 1 2 3 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A |V=2|P|X| CC |M| PT | sequence number | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | timestamp | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | synchronization source (SSRC) identifier | + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + A | contributing source (CSRC) identifiers (optional) | + A | .... | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | RTP extension (OPTIONAL) | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + P | payload ... | + P | +-------------------------------+ + P | | RTP padding | RTP pad count | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + + P = Plaintext (to be encrypted and authenticated) + A = Associated Data (to be authenticated only) + + Figure 2: Structure of an RTP Packet before Authenticated Encryption + + + + + +McGrew & Igoe Standards Track [Page 10] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Since the AEAD ciphertext is larger than the Plaintext by exactly the + length of the AEAD authentication tag, the corresponding + SRTP-encrypted packet replaces the Plaintext field with a slightly + larger field containing the cipher. Even if the Plaintext field is + empty, AEAD encryption must still be performed, with the resulting + cipher consisting solely of the authentication tag. This tag is to + be placed immediately before the optional variable-length SRTP MKI + and SRTP authentication tag fields. + + 0 1 2 3 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A |V=2|P|X| CC |M| PT | sequence number | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | timestamp | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | synchronization source (SSRC) identifier | + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + A | contributing source (CSRC) identifiers (optional) | + A | .... | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | RTP extension (OPTIONAL) | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + C | cipher | + C | ... | + C | | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + R : SRTP MKI (OPTIONAL) : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + R : SRTP authentication tag (NOT RECOMMENDED) : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + + C = Ciphertext (encrypted and authenticated) + A = Associated Data (authenticated only) + R = neither encrypted nor authenticated, added + after Authenticated Encryption completed + + Figure 3: Structure of an SRTP Packet after Authenticated Encryption + +8.3. Handling Header Extensions + + RTP header extensions were first defined in [RFC3550]. [RFC6904] + describes how these header extensions are to be encrypted in SRTP. + + When RFC 6904 is in use, a separate keystream is generated to encrypt + selected RTP header extension elements. For the AEAD_AES_128_GCM + algorithm, this keystream MUST be generated in the manner defined in + [RFC6904], using the AES Counter Mode (AES-CM) transform. For the + + + +McGrew & Igoe Standards Track [Page 11] + +RFC 7714 AES-GCM for SRTP December 2015 + + + AEAD_AES_256_GCM algorithm, the keystream MUST be generated in the + manner defined for the AES_256_CM transform. The originator must + perform any required header extension encryption before the AEAD + algorithm is invoked. + + As with the other fields contained within the RTP header, both + encrypted and unencrypted header extensions are to be treated by the + AEAD algorithm as Associated Data (AD). Thus, the AEAD algorithm + does not provide any additional privacy for the header extensions, + but it does provide integrity and authentication. + +8.4. Prevention of SRTP IV Reuse + + In order to prevent IV reuse, we must ensure that the (ROC,SEQ,SSRC) + triple is never used twice with the same master key. The following + two scenarios illustrate this issue: + + Counter Management: A rekey MUST be performed to establish a new + master key before the (ROC,SEQ) pair cycles + back to its original value. Note that this + scenario implicitly assumes that either + (1) the outgoing RTP process is trusted to not + attempt to repeat a (ROC,SEQ) value or (2) the + encryption process ensures that both the SEQ + and ROC numbers of the packets presented to it + are always incremented in the proper fashion. + This is particularly important for GCM, since + using the same (ROC,SEQ) value twice + compromises the authentication mechanism. For + GCM, the (ROC,SEQ) and SSRC values used MUST + be generated or checked by either the SRTP + implementation or a module (e.g., the RTP + application) that can be considered equally + trustworthy. While [RFC3711] allows the + detection of SSRC collisions after they + happen, SRTP using GCM with shared master keys + MUST prevent an SSRC collision from happening + even once. + + SSRC Management: For a given master key, the set of all SSRC + values used with that master key must be + partitioned into disjoint pools, one pool for + each endpoint using that master key to + originate outbound data. Each such + originating endpoint MUST only issue SSRC + values from the pool it has been assigned. + Further, each originating endpoint MUST + maintain a history of outbound SSRC + + + +McGrew & Igoe Standards Track [Page 12] + +RFC 7714 AES-GCM for SRTP December 2015 + + + identifiers that it has issued within the + lifetime of the current master key, and when a + new SSRC requests an SSRC identifier it + MUST NOT be given an identifier that has been + previously issued. A rekey MUST be performed + before any of the originating endpoints using + that master key exhaust their pools of SSRC + values. Further, the identity of the entity + giving out SSRC values MUST be verified, and + the SSRC signaling MUST be integrity + protected. + +9. AES-GCM Processing of SRTCP Compound Packets + + All SRTCP compound packets MUST be authenticated, but unlike SRTP, + SRTCP packet encryption is optional. A sender can select which + packets to encrypt and indicates this choice with a 1-bit + Encryption flag (located just before the 31-bit SRTCP index). + +9.1. SRTCP IV Formation for AES-GCM + + The 12-octet IV used by AES-GCM SRTCP is formed by first + concatenating 2 octets of zeroes, the 4-octet SSRC identifier, + 2 octets of zeroes, a single "0" bit, and the 31-bit SRTCP index. + The resulting 12-octet value is then XORed to the 12-octet salt to + form the 12-octet IV. + + 0 1 2 3 4 5 6 7 8 9 10 11 + +--+--+--+--+--+--+--+--+--+--+--+--+ + |00|00| SSRC |00|00|0+SRTCP Idx|---+ + +--+--+--+--+--+--+--+--+--+--+--+--+ | + | + +--+--+--+--+--+--+--+--+--+--+--+--+ | + | Encryption Salt |->(+) + +--+--+--+--+--+--+--+--+--+--+--+--+ | + | + +--+--+--+--+--+--+--+--+--+--+--+--+ | + | Initialization Vector |<--+ + +--+--+--+--+--+--+--+--+--+--+--+--+ + + Figure 4: SRTCP Initialization Vector Formation + + + + + + + + + + +McGrew & Igoe Standards Track [Page 13] + +RFC 7714 AES-GCM for SRTP December 2015 + + +9.2. Data Types in Encrypted SRTCP Compound Packets + + 0 1 2 3 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A |V=2|P| RC | Packet Type | length | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | synchronization source (SSRC) of sender | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + P | sender info : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + P | report block 1 : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + P | report block 2 : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + P | ... : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + P |V=2|P| SC | Packet Type | length | + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + P | SSRC/CSRC_1 | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + P | SDES items : + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + P | ... : + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + A |1| SRTCP index | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + R | SRTCP MKI (optional) index : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + R : SRTCP authentication tag (NOT RECOMMENDED) : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + + P = Plaintext (to be encrypted and authenticated) + A = Associated Data (to be authenticated only) + R = neither encrypted nor authenticated, added after + encryption + + Figure 5: AEAD SRTCP Inputs When Encryption Flag = 1 + (The fields are defined in RFC 3550.) + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 14] + +RFC 7714 AES-GCM for SRTP December 2015 + + + When the Encryption flag is set to 1, the SRTCP packet is broken into + Plaintext, Associated Data, and Raw (untouched) Data (as shown above + in Figure 5): + + Associated Data: The packet version V (2 bits), padding flag P + (1 bit), reception report count RC (5 bits), + Packet Type (8 bits), length (2 octets), SSRC + (4 octets), Encryption flag (1 bit), and SRTCP + index (31 bits). + + Raw Data: The optional variable-length SRTCP MKI and SRTCP + authentication tag (whose use is + NOT RECOMMENDED). + + Plaintext: All other data. + + Note that the Plaintext comes in one contiguous field. Since the + AEAD cipher is larger than the Plaintext by exactly the length of the + AEAD authentication tag, the corresponding SRTCP-encrypted packet + replaces the Plaintext field with a slightly larger field containing + the cipher. Even if the Plaintext field is empty, AEAD encryption + must still be performed, with the resulting cipher consisting solely + of the authentication tag. This tag is to be placed immediately + before the Encryption flag and SRTCP index. + + + + + + + + + + + + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 15] + +RFC 7714 AES-GCM for SRTP December 2015 + + +9.3. Data Types in Unencrypted SRTCP Compound Packets + + 0 1 2 3 + 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A |V=2|P| RC | Packet Type | length | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | synchronization source (SSRC) of sender | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | sender info : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | report block 1 : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | report block 2 : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | ... : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A |V=2|P| SC | Packet Type | length | + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + A | SSRC/CSRC_1 | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + A | SDES items : + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + A | ... : + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + A |0| SRTCP index | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + R | SRTCP MKI (optional) index : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + R : authentication tag (NOT RECOMMENDED) : + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + + A = Associated Data (to be authenticated only) + R = neither encrypted nor authenticated, added after + encryption + + Figure 6: AEAD SRTCP Inputs When Encryption Flag = 0 + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 16] + +RFC 7714 AES-GCM for SRTP December 2015 + + + When the Encryption flag is set to 0, the SRTCP compound packet is + broken into Plaintext, Associated Data, and Raw (untouched) Data, as + follows (see Figure 6): + + Plaintext: None. + + Raw Data: The variable-length optional SRTCP MKI and SRTCP + authentication tag (whose use is + NOT RECOMMENDED). + + Associated Data: All other data. + + Even though there is no ciphertext in this RTCP packet, AEAD + encryption returns a cipher field that is precisely the length of the + AEAD authentication tag. This cipher is to be placed before the + Encryption flag and the SRTCP index in the authenticated SRTCP + packet. + +9.4. Prevention of SRTCP IV Reuse + + A new master key MUST be established before the 31-bit SRTCP index + cycles back to its original value. Ideally, a rekey should be + performed and a new master key put in place well before the SRTCP + index cycles back to the starting value. + + The comments on SSRC management in Section 8.4 also apply. + +10. Constraints on AEAD for SRTP and SRTCP + + In general, any AEAD algorithm can accept inputs with varying + lengths, but each algorithm can accept only a limited range of + lengths for a specific parameter. In this section, we describe the + constraints on the parameter lengths that any AEAD algorithm must + support to be used in AEAD-SRTP. Additionally, we specify a complete + parameter set for one specific family of AEAD algorithms, namely + AES-GCM. + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 17] + +RFC 7714 AES-GCM for SRTP December 2015 + + + All AEAD algorithms used with SRTP/SRTCP MUST satisfy the five + constraints listed below: + + Parameter Meaning Value + --------------------------------------------------------------------- + A_MAX maximum Associated MUST be at least 12 octets. + Data length + + N_MIN minimum nonce (IV) MUST be 12 octets. + length + + N_MAX maximum nonce (IV) MUST be 12 octets. + length + + P_MAX maximum Plaintext GCM: MUST be <= 2^36 - 32 octets. + length per invocation + + C_MAX maximum ciphertext GCM: MUST be <= 2^36 - 16 octets. + length per invocation + + For the sake of clarity, we specify three additional parameters: + + AEAD authentication tag length MUST be 16 octets + + Maximum number of invocations SRTP: MUST be at most 2^48 + for a given instantiation SRTCP: MUST be at most 2^31 + + Block Counter size GCM: MUST be 32 bits + + The reader is reminded that the ciphertext is longer than the + Plaintext by exactly the length of the AEAD authentication tag. + +11. Key Derivation Functions + + A Key Derivation Function (KDF) is used to derive all of the required + encryption and authentication keys from a secret value shared by the + endpoints. The AEAD_AES_128_GCM algorithm MUST use the (128-bit) + AES_CM PRF KDF described in [RFC3711]. AEAD_AES_256_GCM MUST use the + AES_256_CM_PRF KDF described in [RFC6188]. + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 18] + +RFC 7714 AES-GCM for SRTP December 2015 + + +12. Summary of AES-GCM in SRTP/SRTCP + + For convenience, much of the information about the use of the AES-GCM + family of algorithms in SRTP is collected in the tables contained in + this section. + + The AES-GCM family of AEAD algorithms is built around the AES block + cipher algorithm. AES-GCM uses AES-CM for encryption and Galois + Message Authentication Code (GMAC) for authentication. A detailed + description of the AES-GCM family can be found in [RFC5116]. The + following members of the AES-GCM family may be used with SRTP/SRTCP: + + Name Key Size AEAD Tag Size Reference + ================================================================ + AEAD_AES_128_GCM 16 octets 16 octets [RFC5116] + AEAD_AES_256_GCM 32 octets 16 octets [RFC5116] + + Table 1: AES-GCM Algorithms for SRTP/SRTCP + + Any implementation of AES-GCM SRTP MUST support both AEAD_AES_128_GCM + and AEAD_AES_256_GCM. Below, we summarize parameters associated with + these two GCM algorithms: + + +--------------------------------+------------------------------+ + | Parameter | Value | + +--------------------------------+------------------------------+ + | Master key length | 128 bits | + | Master salt length | 96 bits | + | Key Derivation Function | AES_CM PRF [RFC3711] | + | Maximum key lifetime (SRTP) | 2^48 packets | + | Maximum key lifetime (SRTCP) | 2^31 packets | + | Cipher (for SRTP and SRTCP) | AEAD_AES_128_GCM | + | AEAD authentication tag length | 128 bits | + +--------------------------------+------------------------------+ + + Table 2: The AEAD_AES_128_GCM Crypto Suite + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 19] + +RFC 7714 AES-GCM for SRTP December 2015 + + + +--------------------------------+------------------------------+ + | Parameter | Value | + +--------------------------------+------------------------------+ + | Master key length | 256 bits | + | Master salt length | 96 bits | + | Key Derivation Function | AES_256_CM_PRF [RFC6188] | + | Maximum key lifetime (SRTP) | 2^48 packets | + | Maximum key lifetime (SRTCP) | 2^31 packets | + | Cipher (for SRTP and SRTCP) | AEAD_AES_256_GCM | + | AEAD authentication tag length | 128 bits | + +--------------------------------+------------------------------+ + + Table 3: The AEAD_AES_256_GCM Crypto Suite + +13. Security Considerations + +13.1. Handling of Security-Critical Parameters + + As with any security process, the implementer must take care to + ensure that cryptographically sensitive parameters are properly + handled. Many of these recommendations hold for all SRTP + cryptographic algorithms, but we include them here to emphasize their + importance. + + - If the master salt is to be kept secret, it MUST be properly erased + when no longer needed. + + - The secret master key and all keys derived from it MUST be kept + secret. All keys MUST be properly erased when no longer needed. + + - At the start of each packet, the Block Counter MUST be reset to 1. + The Block Counter is incremented after each block key has been + produced, but it MUST NOT be allowed to exceed 2^32 - 1 for GCM. + Note that even though the Block Counter is reset at the start of + each packet, IV uniqueness is ensured by the inclusion of + SSRC/ROC/SEQ or the SRTCP index in the IV. (The reader is reminded + that the first block of key produced is reserved for use in + authenticating the packet and is not used to encrypt Plaintext.) + + - Each time a rekey occurs, the initial values of both the 31-bit + SRTCP index and the 48-bit SRTP packet index (ROC||SEQ) MUST be + saved in order to prevent IV reuse. + + - Processing MUST cease if either the 31-bit SRTCP index or the + 48-bit SRTP packet index (ROC||SEQ) cycles back to its initial + value. Processing MUST NOT resume until a new SRTP/SRTCP session + has been established using a new SRTP master key. Ideally, a rekey + should be done well before any of these counters cycle. + + + +McGrew & Igoe Standards Track [Page 20] + +RFC 7714 AES-GCM for SRTP December 2015 + + +13.2. Size of the Authentication Tag + + We require that the AEAD authentication tag be 16 octets, in order to + effectively eliminate the risk of an adversary successfully + introducing fraudulent data. Though other protocols may allow the + use of truncated authentication tags, the consensus of the authors + and the working group is that risks associated with using truncated + AES-GCM tags are deemed too high to allow the use of truncated + authentication tags in SRTP/SRTCP. + +14. IANA Considerations + +14.1. SDES + + "Session Description Protocol (SDP) Security Descriptions for Media + Streams" [RFC4568] defines SRTP "crypto suites". A crypto suite + corresponds to a particular AEAD algorithm in SRTP. In order to + allow security descriptions to signal the use of the algorithms + defined in this document, IANA has registered the following crypto + suites in the "SRTP Crypto Suite Registrations" subregistry of the + "Session Description Protocol (SDP) Security Descriptions" registry. + The ABNF [RFC5234] syntax is as follows: + + srtp-crypto-suite-ext = "AEAD_AES_128_GCM" / + "AEAD_AES_256_GCM" / + srtp-crypto-suite-ext + + + + + + + + + + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 21] + +RFC 7714 AES-GCM for SRTP December 2015 + + +14.2. DTLS-SRTP + + DTLS-SRTP [RFC5764] defines DTLS-SRTP "SRTP protection profiles". + These profiles also correspond to the use of an AEAD algorithm in + SRTP. In order to allow the use of the algorithms defined in this + document in DTLS-SRTP, IANA has registered the following SRTP + protection profiles: + + SRTP_AEAD_AES_128_GCM = {0x00, 0x07} + SRTP_AEAD_AES_256_GCM = {0x00, 0x08} + + Below, we list the SRTP transform parameters for each of these + protection profiles. Unless separate parameters for SRTP and SRTCP + are explicitly listed, these parameters apply to both SRTP and SRTCP. + + SRTP_AEAD_AES_128_GCM + cipher: AES_128_GCM + cipher_key_length: 128 bits + cipher_salt_length: 96 bits + aead_auth_tag_length: 16 octets + auth_function: NULL + auth_key_length: N/A + auth_tag_length: N/A + maximum lifetime: at most 2^31 SRTCP packets and + at most 2^48 SRTP packets + + SRTP_AEAD_AES_256_GCM + cipher: AES_256_GCM + cipher_key_length: 256 bits + cipher_salt_length: 96 bits + aead_auth_tag_length: 16 octets + auth_function: NULL + auth_key_length: N/A + auth_tag_length: N/A + maximum lifetime: at most 2^31 SRTCP packets and + at most 2^48 SRTP packets + + Note that these SRTP protection profiles do not specify an + auth_function, auth_key_length, or auth_tag_length, because all + of these profiles use AEAD algorithms and thus do not use a + separate auth_function, auth_key, or auth_tag. The term + "aead_auth_tag_length" is used to emphasize that this refers to + the authentication tag provided by the AEAD algorithm and that + this tag is not located in the authentication tag field provided by + SRTP/SRTCP. + + + + + + +McGrew & Igoe Standards Track [Page 22] + +RFC 7714 AES-GCM for SRTP December 2015 + + +14.3. MIKEY + + In accordance with "MIKEY: Multimedia Internet KEYing" [RFC3830], + IANA maintains several subregistries under "Multimedia Internet + KEYing (MIKEY) Payload Name Spaces". Per this document, additions + have been made to two of the MIKEY subregistries. + + In the "MIKEY Security Protocol Parameters" subregistry, the + following has been added: + + Type | Meaning | Possible Values + -------------------------------------------------------- + 20 | AEAD authentication tag length | 16 octets + + This list is, of course, intended for use with GCM. It is + conceivable that new AEAD algorithms introduced at some point in the + future may require a different set of authentication tag lengths. + + In the "Encryption algorithm (Value 0)" subregistry (derived from + Table 6.10.1.b of [RFC3830]), the following has been added: + + SRTP Encr. | Value | Default Session | Default Auth. + Algorithm | | Encr. Key Length | Tag Length + ----------------------------------------------------------- + AES-GCM | 6 | 16 octets | 16 octets + + The encryption algorithm, session encryption key length, and AEAD + authentication tag sizes received from MIKEY fully determine the AEAD + algorithm to be used. The exact mapping is described in Section 15. + +15. Parameters for Use with MIKEY + + MIKEY specifies the algorithm family separately from the key length + (which is specified by the Session Encryption key length) and the + authentication tag length (specified by the AEAD authentication tag + length). + + +------------+-------------+-------------+ + | Encryption | Encryption | AEAD Auth. | + | Algorithm | Key Length | Tag Length | + +============+=============+=============+ + AEAD_AES_128_GCM | AES-GCM | 16 octets | 16 octets | + +------------+-------------+-------------+ + AEAD_AES_256_GCM | AES-GCM | 32 octets | 16 octets | + +============+=============+=============+ + + Table 4: Mapping MIKEY Parameters to AEAD Algorithms + + + + +McGrew & Igoe Standards Track [Page 23] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Section 11 of this document restricts the choice of KDF for AEAD + algorithms. To enforce this restriction in MIKEY, we require that + the SRTP Pseudorandom Function (PRF) has value AES-CM whenever an + AEAD algorithm is used. Note that, according to Section 6.10.1 of + [RFC3830], the input key length of the KDF (i.e., the SRTP master key + length) is always equal to the session encryption key length. This + means, for example, that AEAD_AES_256_GCM will use AES_256_CM_PRF as + the KDF. + +16. Some RTP Test Vectors + + The examples in this section are all based upon the same RTP packet + + 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573 + + consisting of a 12-octet header (8040f17b 8041f8d3 5501a0b2) and a + 38-octet payload (47616c6c 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 6573), which is just the ASCII + string "Gallia est omnis divisa in partes tres". The salt used + (51756964 2070726f 2071756f) comes from the ASCII string "Quid pro + quo". The 16-octet (128-bit) key is 00 01 02 ... 0f, and the + 32-octet (256-bit) key is 00 01 02 ... 1f. At the time this document + was written, the RTP payload type (1000000 binary = 64 decimal) was + an unassigned value. + + As shown in Section 8.1, the IV is formed by XORing two 12-octet + values. The first 12-octet value is formed by concatenating two + zero octets, the 4-octet SSRC (found in the ninth through 12th octets + of the packet), the 4-octet rollover counter (ROC) maintained at each + end of the link, and the 2-octet sequence number (SEQ) (found in the + third and fourth octets of the packet). The second 12-octet value is + the salt, a value that is held constant at least until the key is + changed. + + | Pad | SSRC | ROC | SEQ | + 00 00 55 01 a0 b2 00 00 00 00 f1 7b + salt 51 75 69 64 20 70 72 6f 20 71 75 6f + ------------------------------------ + IV 51 75 3c 65 80 c2 72 6f 20 71 84 14 + + All of the RTP examples use this IV. + + + + + + + +McGrew & Igoe Standards Track [Page 24] + +RFC 7714 AES-GCM for SRTP December 2015 + + +16.1. SRTP AEAD_AES_128_GCM + +16.1.1. SRTP AEAD_AES_128_GCM Encryption + + Encrypting the following packet: + + 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573 + + Form the IV + | Pad | SSRC | ROC | SEQ | + 00 00 55 01 a0 b2 00 00 00 00 f1 7b + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + AAD: 8040f17b 8041f8d3 5501a0b2 + PT: 47616c6c 69612065 7374206f 6d6e6973 + 20646976 69736120 696e2070 61727465 + 73207472 6573 + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + H: c6a13b37878f5b826f4f8162a1c8d879 + + Encrypt the Plaintext + block # 0 + IV||blk_cntr: 51753c6580c2726f2071841400000002 + key_block: b5 2c 8f cf 92 55 fe 09 df ce a6 73 f0 10 22 b9 + plain_block: 47 61 6c 6c 69 61 20 65 73 74 20 6f 6d 6e 69 73 + cipher_block: f2 4d e3 a3 fb 34 de 6c ac ba 86 1c 9d 7e 4b ca + block # 1 + IV||blk_cntr: 51753c6580c2726f2071841400000003 + key_block: 9e 07 52 a3 64 5a 2f 4f 2b cb d4 0a 30 b5 a5 fe + plain_block: 20 64 69 76 69 73 61 20 69 6e 20 70 61 72 74 65 + cipher_block: be 63 3b d5 0d 29 4e 6f 42 a5 f4 7a 51 c7 d1 9b + block # 2 + IV||blk_cntr: 51753c6580c2726f2071841400000004 + key_block: 45 fe 4e ad ed 40 0a 5d 1a f3 63 f9 0c e1 49 3b + plain_block: 73 20 74 72 65 73 + cipher_block: 36 de 3a df 88 33 + + Cipher before tag appended + f24de3a3 fb34de6c acba861c 9d7e4bca + be633bd5 0d294e6f 42a5f47a 51c7d19b + 36de3adf 8833 + + + + + +McGrew & Igoe Standards Track [Page 25] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Compute the GMAC tag + + Process the AAD + AAD word: 8040f17b8041f8d35501a0b200000000 + partial hash: bcfb3d1d0e6e3e78ba45403377dba11b + + Process the cipher + cipher word: f24de3a3fb34de6cacba861c9d7e4bca + partial hash: 0ebc0abe1b15b32fedd2b07888c1ef61 + cipher word: be633bd50d294e6f42a5f47a51c7d19b + partial hash: 438e5797011ea860585709a2899f4685 + cipher word: 36de3adf883300000000000000000000 + partial hash: 336fb643310d7bac2aeaa76247f6036d + + Process the length word + length word: 00000000000000600000000000000130 + partial hash: 1b964067078c408c4e442a8f015e5264 + + Turn GHASH into GMAC + GHASH: 1b 96 40 67 07 8c 40 8c 4e 44 2a 8f 01 5e 52 64 + K0: 92 0b 3f 40 b9 3d 2a 1d 1c 8b 5c d1 e5 67 5e aa + full GMAC: 89 9d 7f 27 be b1 6a 91 52 cf 76 5e e4 39 0c ce + + Cipher with tag + f24de3a3 fb34de6c acba861c 9d7e4bca + be633bd5 0d294e6f 42a5f47a 51c7d19b + 36de3adf 8833899d 7f27beb1 6a9152cf + 765ee439 0cce + + Encrypted and tagged packet: + 8040f17b 8041f8d3 5501a0b2 f24de3a3 + fb34de6c acba861c 9d7e4bca be633bd5 + 0d294e6f 42a5f47a 51c7d19b 36de3adf + 8833899d 7f27beb1 6a9152cf 765ee439 + 0cce + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 26] + +RFC 7714 AES-GCM for SRTP December 2015 + + +16.1.2. SRTP AEAD_AES_128_GCM Decryption + + Decrypting the following packet: + + 8040f17b 8041f8d3 5501a0b2 f24de3a3 + fb34de6c acba861c 9d7e4bca be633bd5 + 0d294e6f 42a5f47a 51c7d19b 36de3adf + 8833899d 7f27beb1 6a9152cf 765ee439 + 0cce + + Form the IV + | Pad | SSRC | ROC | SEQ | + 00 00 55 01 a0 b2 00 00 00 00 f1 7b + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + AAD: 8040f17b 8041f8d3 5501a0b2 + CT: f24de3a3 fb34de6c acba861c 9d7e4bca + be633bd5 0d294e6f 42a5f47a 51c7d19b + 36de3adf 8833899d 7f27beb1 6a9152cf + 765ee439 0cce + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + H: c6a13b37878f5b826f4f8162a1c8d879 + + Verify the received tag + 89 9d 7f 27 be b1 6a 91 52 cf 76 5e e4 39 0c ce + + Process the AAD + AAD word: 8040f17b8041f8d35501a0b200000000 + partial hash: bcfb3d1d0e6e3e78ba45403377dba11b + + Process the cipher + cipher word: f24de3a3fb34de6cacba861c9d7e4bca + partial hash: 0ebc0abe1b15b32fedd2b07888c1ef61 + cipher word: be633bd50d294e6f42a5f47a51c7d19b + partial hash: 438e5797011ea860585709a2899f4685 + cipher word: 36de3adf883300000000000000000000 + partial hash: 336fb643310d7bac2aeaa76247f6036d + + Process the length word + length word: 00000000000000600000000000000130 + partial hash: 1b964067078c408c4e442a8f015e5264 + + + + + + + + +McGrew & Igoe Standards Track [Page 27] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Turn GHASH into GMAC + GHASH: 1b 96 40 67 07 8c 40 8c 4e 44 2a 8f 01 5e 52 64 + K0: 92 0b 3f 40 b9 3d 2a 1d 1c 8b 5c d1 e5 67 5e aa + full GMAC: 89 9d 7f 27 be b1 6a 91 52 cf 76 5e e4 39 0c ce + + Received tag = 899d7f27 beb16a91 52cf765e e4390cce + Computed tag = 899d7f27 beb16a91 52cf765e e4390cce + Received tag verified. + + Decrypt the cipher + block # 0 + IV||blk_cntr: 51753c6580c2726f2071841400000002 + key_block: b5 2c 8f cf 92 55 fe 09 df ce a6 73 f0 10 22 b9 + cipher_block: f2 4d e3 a3 fb 34 de 6c ac ba 86 1c 9d 7e 4b ca + plain_block: 47 61 6c 6c 69 61 20 65 73 74 20 6f 6d 6e 69 73 + block # 1 + IV||blk_cntr: 51753c6580c2726f2071841400000003 + key_block: 9e 07 52 a3 64 5a 2f 4f 2b cb d4 0a 30 b5 a5 fe + cipher_block: be 63 3b d5 0d 29 4e 6f 42 a5 f4 7a 51 c7 d1 9b + plain_block: 20 64 69 76 69 73 61 20 69 6e 20 70 61 72 74 65 + block # 2 + IV||blk_cntr: 51753c6580c2726f2071841400000004 + key_block: 45 fe 4e ad ed 40 0a 5d 1a f3 63 f9 0c e1 49 3b + cipher_block: 36 de 3a df 88 33 + plain_block: 73 20 74 72 65 73 + + Verified and tagged packet: + 47616c6c 69612065 7374206f 6d6e6973 + 20646976 69736120 696e2070 61727465 + 73207472 6573 + + + + + + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 28] + +RFC 7714 AES-GCM for SRTP December 2015 + + +16.1.3. SRTP AEAD_AES_128_GCM Authentication Tagging + + Tagging the following packet: + + 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573 + + Form the IV + | Pad | SSRC | ROC | SEQ | + 00 00 55 01 a0 b2 00 00 00 00 f1 7b + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + AAD: 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573 + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + H: c6a13b37878f5b826f4f8162a1c8d879 + + Compute the GMAC tag + + Process the AAD + AAD word: 8040f17b8041f8d35501a0b247616c6c + partial hash: 79f41fea34a474a77609d8925e9f2b22 + AAD word: 696120657374206f6d6e697320646976 + partial hash: 84093a2f85abf17ab37d3ce2f706138f + AAD word: 69736120696e20706172746573207472 + partial hash: ab2760fee24e6dec754739d8059cd144 + AAD word: 65730000000000000000000000000000 + partial hash: e84f3c55d287fc561c41d09a8aada4be + + Process the length word + length word: 00000000000001900000000000000000 + partial hash: b04200c26b81c98af55cc2eafccd1cbc + + Turn GHASH into GMAC + GHASH: b0 42 00 c2 6b 81 c9 8a f5 5c c2 ea fc cd 1c bc + K0: 92 0b 3f 40 b9 3d 2a 1d 1c 8b 5c d1 e5 67 5e aa + full GMAC: 22 49 3f 82 d2 bc e3 97 e9 d7 9e 3b 19 aa 42 16 + + Cipher with tag + 22493f82 d2bce397 e9d79e3b 19aa4216 + + + + + +McGrew & Igoe Standards Track [Page 29] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Tagged packet: + 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 65732249 3f82d2bc e397e9d7 9e3b19aa + 4216 + +16.1.4. SRTP AEAD_AES_128_GCM Tag Verification + + Verifying the following packet: + + 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 65732249 3f82d2bc e397e9d7 9e3b19aa + 4216 + + Form the IV + | Pad | SSRC | ROC | SEQ | + 00 00 55 01 a0 b2 00 00 00 00 f1 7b + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + AAD: 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573 + CT: 22493f82 d2bce397 e9d79e3b 19aa4216 + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + H: c6a13b37878f5b826f4f8162a1c8d879 + + Verify the received tag + 22 49 3f 82 d2 bc e3 97 e9 d7 9e 3b 19 aa 42 16 + + Process the AAD + AAD word: 8040f17b8041f8d35501a0b247616c6c + partial hash: 79f41fea34a474a77609d8925e9f2b22 + AAD word: 696120657374206f6d6e697320646976 + partial hash: 84093a2f85abf17ab37d3ce2f706138f + AAD word: 69736120696e20706172746573207472 + partial hash: ab2760fee24e6dec754739d8059cd144 + AAD word: 65730000000000000000000000000000 + partial hash: e84f3c55d287fc561c41d09a8aada4be + + Process the length word + length word: 00000000000001900000000000000000 + partial hash: b04200c26b81c98af55cc2eafccd1cbc + + + +McGrew & Igoe Standards Track [Page 30] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Turn GHASH into GMAC + GHASH: b0 42 00 c2 6b 81 c9 8a f5 5c c2 ea fc cd 1c bc + K0: 92 0b 3f 40 b9 3d 2a 1d 1c 8b 5c d1 e5 67 5e aa + full GMAC: 22 49 3f 82 d2 bc e3 97 e9 d7 9e 3b 19 aa 42 16 + + Received tag = 22493f82 d2bce397 e9d79e3b 19aa4216 + Computed tag = 22493f82 d2bce397 e9d79e3b 19aa4216 + Received tag verified. + +16.2. SRTP AEAD_AES_256_GCM + +16.2.1. SRTP AEAD_AES_256_GCM Encryption + + Encrypting the following packet: + + 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573 + + Form the IV + | Pad | SSRC | ROC | SEQ | + 00 00 55 01 a0 b2 00 00 00 00 f1 7b + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f + AAD: 8040f17b 8041f8d3 5501a0b2 + PT: 47616c6c 69612065 7374206f 6d6e6973 + 20646976 69736120 696e2070 61727465 + 73207472 6573 + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + H: f29000b62a499fd0a9f39a6add2e7780 + + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 31] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Encrypt the Plaintext + block # 0 + IV||blk_cntr: 51753c6580c2726f2071841400000002 + key_block: 75 d0 b2 14 c1 43 de 77 9c eb 58 95 5e 40 5a d9 + plain_block: 47 61 6c 6c 69 61 20 65 73 74 20 6f 6d 6e 69 73 + cipher_block: 32 b1 de 78 a8 22 fe 12 ef 9f 78 fa 33 2e 33 aa + block # 1 + IV||blk_cntr: 51753c6580c2726f2071841400000003 + key_block: 91 e4 7b 4e f3 2b 83 d3 dc 65 0a 72 17 8d da 6a + plain_block: 20 64 69 76 69 73 61 20 69 6e 20 70 61 72 74 65 + cipher_block: b1 80 12 38 9a 58 e2 f3 b5 0b 2a 02 76 ff ae 0f + block # 2 + IV||blk_cntr: 51753c6580c2726f2071841400000004 + key_block: 68 86 43 eb dd 08 07 98 16 3a 16 d5 e5 04 f6 3a + plain_block: 73 20 74 72 65 73 + cipher_block: 1b a6 37 99 b8 7b + + Cipher before tag appended + 32b1de78 a822fe12 ef9f78fa 332e33aa + b1801238 9a58e2f3 b50b2a02 76ffae0f + 1ba63799 b87b + + Compute the GMAC tag + + Process the AAD + AAD word: 8040f17b8041f8d35501a0b200000000 + partial hash: 0154dcb75485b71880e1957c877351bd + + Process the cipher + cipher word: 32b1de78a822fe12ef9f78fa332e33aa + partial hash: c3f07db9a8b9cb4345eb07f793d322d2 + cipher word: b18012389a58e2f3b50b2a0276ffae0f + partial hash: 6d1e66fe32eb32ecd8906ceab09db996 + cipher word: 1ba63799b87b00000000000000000000 + partial hash: b3d1d2f1fa3b366619bc42cd2eedafee + + Process the length word + length word: 00000000000000600000000000000130 + partial hash: 7debf5fa1fac3bd318d5e1a7ee401091 + + Turn GHASH into GMAC + GHASH: 7d eb f5 fa 1f ac 3b d3 18 d5 e1 a7 ee 40 10 91 + K0: 07 48 2e cc c0 53 ed 63 e1 6e 99 df 39 e7 7c 82 + full GMAC: 7a a3 db 36 df ff d6 b0 f9 bb 78 78 d7 a7 6c 13 + + + + + + + +McGrew & Igoe Standards Track [Page 32] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Cipher with tag + 32b1de78 a822fe12 ef9f78fa 332e33aa + b1801238 9a58e2f3 b50b2a02 76ffae0f + 1ba63799 b87b7aa3 db36dfff d6b0f9bb + 7878d7a7 6c13 + + Encrypted and tagged packet: + 8040f17b 8041f8d3 5501a0b2 32b1de78 + a822fe12 ef9f78fa 332e33aa b1801238 + 9a58e2f3 b50b2a02 76ffae0f 1ba63799 + b87b7aa3 db36dfff d6b0f9bb 7878d7a7 + 6c13 + +16.2.2. SRTP AEAD_AES_256_GCM Decryption + + Decrypting the following packet: + + 8040f17b 8041f8d3 5501a0b2 32b1de78 + a822fe12 ef9f78fa 332e33aa b1801238 + 9a58e2f3 b50b2a02 76ffae0f 1ba63799 + b87b7aa3 db36dfff d6b0f9bb 7878d7a7 + 6c13 + + Form the IV + | Pad | SSRC | ROC | SEQ | + 00 00 55 01 a0 b2 00 00 00 00 f1 7b + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f + AAD: 8040f17b 8041f8d3 5501a0b2 + CT: 32b1de78 a822fe12 ef9f78fa 332e33aa + b1801238 9a58e2f3 b50b2a02 76ffae0f + 1ba63799 b87b7aa3 db36dfff d6b0f9bb + 7878d7a7 6c13 + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + H: f29000b62a499fd0a9f39a6add2e7780 + + Verify the received tag + 7a a3 db 36 df ff d6 b0 f9 bb 78 78 d7 a7 6c 13 + + Process the AAD + AAD word: 8040f17b8041f8d35501a0b200000000 + partial hash: 0154dcb75485b71880e1957c877351bd + + + + + + +McGrew & Igoe Standards Track [Page 33] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Process the cipher + cipher word: 32b1de78a822fe12ef9f78fa332e33aa + partial hash: c3f07db9a8b9cb4345eb07f793d322d2 + cipher word: b18012389a58e2f3b50b2a0276ffae0f + partial hash: 6d1e66fe32eb32ecd8906ceab09db996 + cipher word: 1ba63799b87b00000000000000000000 + partial hash: b3d1d2f1fa3b366619bc42cd2eedafee + + Process the length word + length word: 00000000000000600000000000000130 + partial hash: 7debf5fa1fac3bd318d5e1a7ee401091 + + Turn GHASH into GMAC + GHASH: 7d eb f5 fa 1f ac 3b d3 18 d5 e1 a7 ee 40 10 91 + K0: 07 48 2e cc c0 53 ed 63 e1 6e 99 df 39 e7 7c 82 + full GMAC: 7a a3 db 36 df ff d6 b0 f9 bb 78 78 d7 a7 6c 13 + + Received tag = 7aa3db36 dfffd6b0 f9bb7878 d7a76c13 + Computed tag = 7aa3db36 dfffd6b0 f9bb7878 d7a76c13 + Received tag verified. + + Decrypt the cipher + block # 0 + IV||blk_cntr: 51753c6580c2726f2071841400000002 + key_block: 75 d0 b2 14 c1 43 de 77 9c eb 58 95 5e 40 5a d9 + cipher_block: 32 b1 de 78 a8 22 fe 12 ef 9f 78 fa 33 2e 33 aa + plain_block: 47 61 6c 6c 69 61 20 65 73 74 20 6f 6d 6e 69 73 + block # 1 + IV||blk_cntr: 51753c6580c2726f2071841400000003 + key_block: 91 e4 7b 4e f3 2b 83 d3 dc 65 0a 72 17 8d da 6a + cipher_block: b1 80 12 38 9a 58 e2 f3 b5 0b 2a 02 76 ff ae 0f + plain_block: 20 64 69 76 69 73 61 20 69 6e 20 70 61 72 74 65 + block # 2 + IV||blk_cntr: 51753c6580c2726f2071841400000004 + key_block: 68 86 43 eb dd 08 07 98 16 3a 16 d5 e5 04 f6 3a + cipher_block: 1b a6 37 99 b8 7b + plain_block: 73 20 74 72 65 73 + + Verified and tagged packet: + 47616c6c 69612065 7374206f 6d6e6973 + 20646976 69736120 696e2070 61727465 + 73207472 6573 + + + + + + + + + +McGrew & Igoe Standards Track [Page 34] + +RFC 7714 AES-GCM for SRTP December 2015 + + +16.2.3. SRTP AEAD_AES_256_GCM Authentication Tagging + + Tagging the following packet: + + 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573 + + Form the IV + | Pad | SSRC | ROC | SEQ | + 00 00 55 01 a0 b2 00 00 00 00 f1 7b + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f + AAD: 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573 + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + H: f29000b62a499fd0a9f39a6add2e7780 + + Compute the GMAC tag + + Process the AAD + AAD word: 8040f17b8041f8d35501a0b247616c6c + partial hash: c059753e6763791762ca630d8ef97714 + AAD word: 696120657374206f6d6e697320646976 + partial hash: a4e3401e712900dc4f1d2303bc4b2675 + AAD word: 69736120696e20706172746573207472 + partial hash: 1c8c1af883de0d67878f379a19c65987 + AAD word: 65730000000000000000000000000000 + partial hash: 958462781aa8e8feacce6d93b54472ac + + Process the length word + length word: 00000000000001900000000000000000 + partial hash: af2efb5dcfdb9900e7127721fdb56956 + + Turn GHASH into GMAC + GHASH: af 2e fb 5d cf db 99 00 e7 12 77 21 fd b5 69 56 + K0: 07 48 2e cc c0 53 ed 63 e1 6e 99 df 39 e7 7c 82 + full GMAC: a8 66 d5 91 0f 88 74 63 06 7c ee fe c4 52 15 d4 + + Cipher with tag + a866d591 0f887463 067ceefe c45215d4 + + + + +McGrew & Igoe Standards Track [Page 35] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Tagged packet: + 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573a866 d5910f88 7463067c eefec452 + 15d4 + +16.2.4. SRTP AEAD_AES_256_GCM Tag Verification + + Verifying the following packet: + + 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573a866 d5910f88 7463067c eefec452 + 15d4 + + Form the IV + | Pad | SSRC | ROC | SEQ | + 00 00 55 01 a0 b2 00 00 00 00 f1 7b + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f + AAD: 8040f17b 8041f8d3 5501a0b2 47616c6c + 69612065 7374206f 6d6e6973 20646976 + 69736120 696e2070 61727465 73207472 + 6573 + CT: a866d591 0f887463 067ceefe c45215d4 + IV: 51 75 3c 65 80 c2 72 6f 20 71 84 14 + H: f29000b62a499fd0a9f39a6add2e7780 + + Verify the received tag + a8 66 d5 91 0f 88 74 63 06 7c ee fe c4 52 15 d4 + + Process the AAD + AAD word: 8040f17b8041f8d35501a0b247616c6c + partial hash: c059753e6763791762ca630d8ef97714 + AAD word: 696120657374206f6d6e697320646976 + partial hash: a4e3401e712900dc4f1d2303bc4b2675 + AAD word: 69736120696e20706172746573207472 + partial hash: 1c8c1af883de0d67878f379a19c65987 + AAD word: 65730000000000000000000000000000 + partial hash: 958462781aa8e8feacce6d93b54472ac + + + + + + +McGrew & Igoe Standards Track [Page 36] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Process the length word + length word: 00000000000001900000000000000000 + partial hash: af2efb5dcfdb9900e7127721fdb56956 + + Turn GHASH into GMAC + GHASH: af 2e fb 5d cf db 99 00 e7 12 77 21 fd b5 69 56 + K0: 07 48 2e cc c0 53 ed 63 e1 6e 99 df 39 e7 7c 82 + full GMAC: a8 66 d5 91 0f 88 74 63 06 7c ee fe c4 52 15 d4 + + Received tag = a866d591 0f887463 067ceefe c45215d4 + Computed tag = a866d591 0f887463 067ceefe c45215d4 + Received tag verified. + +17. RTCP Test Vectors + + The examples in this section are all based upon the same RTCP packet: + + 81c8000e 4d617273 4e545031 4e545031 + 52545020 0000042a 0000eb98 4c756e61 + deadbeef deadbeef deadbeef deadbeef + deadbeef + + with 32-bit SRTCP index 000005d4. + + As shown in Section 9.1, the IV is formed by XORing two 12-octet + values. The first 12-octet value is formed by concatenating + two zero octets, the 4-octet SSRC (found in the fifth through + eighth octets of the RTP packet), another two padding octets, and the + 31-bit SRTCP index, right-justified in a 32-bit = 4-octet field with + a single "0" bit prepended as padding. An example of SRTCP IV + formation is shown below: + + | Pad | SSRC | Pad | 0+SRTCP | + 00 00 4d 61 72 73 00 00 00 00 05 d4 + salt 51 75 69 64 20 70 72 6f 20 71 75 6f + ------------------------------------ + IV 51 75 24 05 52 03 72 6f 20 71 70 bb + + In an SRTCP packet, a 1-bit Encryption flag is prepended to the + 31-bit SRTCP index to form a 32-bit value we shall call the + "ESRTCP word". The E-flag is one if the SRTCP packet has been + encrypted and zero if it has been tagged but not encrypted. Note + that the ESRTCP field is only present in an SRTCP packet, not in an + RTCP packet. The full ESRTCP word is part of the AAD. + + + + + + + +McGrew & Igoe Standards Track [Page 37] + +RFC 7714 AES-GCM for SRTP December 2015 + + + When encrypting and tagging an RTCP packet (E-flag = 1), the SRTCP + packet consists of the following fields in the following order: + + - The first 8 octets of the RTCP packet (part of the AAD). + + - The cipher. + + - The ESRTCP word (the final part of the AAD). + + - Any Raw Data that might have been appended to the end of the + original RTCP packet. + + Recall that AEAD treats the authentication tag as an integral part of + the cipher, and in fact the authentication tag is the last 8 or + 16 octets of the cipher. + + The reader is reminded that when the RTCP packet is to be tagged but + not encrypted (E-flag = 0), GCM will produce a cipher that consists + solely of the 8-octet or 16-octet authentication tag. The tagged + SRTCP consists of the following fields in the order listed below: + + - All of the AAD, except for the ESRTCP word. + + - The cipher (= the authentication tag). + + - The ESRTCP word (the final part of the AAD). + + - Any Raw Data that might have been appended to the end of the + original RTCP packet. + + + + + + + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 38] + +RFC 7714 AES-GCM for SRTP December 2015 + + +17.1. SRTCP AEAD_AES_128_GCM Encryption and Tagging + + Encrypting the following packet: + + 81c8000d 4d617273 4e545031 4e545032 + 52545020 0000042a 0000e930 4c756e61 + deadbeef deadbeef deadbeef deadbeef + deadbeef + + Key size = 128 bits + Tag size = 16 octets + + Form the IV + | Pad | SSRC | Pad | SRTCP | + 00 00 4d 61 72 73 00 00 00 00 05 d4 + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 24 05 52 03 72 6f 20 71 70 bb + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + AAD: 81c8000d 4d617273 800005d4 + PT: 4e545031 4e545032 52545020 0000042a + 0000e930 4c756e61 deadbeef deadbeef + deadbeef deadbeef deadbeef + IV: 51 75 24 05 52 03 72 6f 20 71 70 bb + H: c6a13b37878f5b826f4f8162a1c8d879 + + Encrypt the Plaintext + block # 0 + IV||blk_cntr: 517524055203726f207170bb00000002 + key_block: 2d bd 18 b4 92 8e e6 4e f5 73 87 46 2f 6b 7a b3 + plain_block: 4e 54 50 31 4e 54 50 32 52 54 50 20 00 00 04 2a + cipher_block: 63 e9 48 85 dc da b6 7c a7 27 d7 66 2f 6b 7e 99 + block # 1 + IV||blk_cntr: 517524055203726f207170bb00000003 + key_block: 7f f5 29 c7 20 73 9d 4c 18 db 1b 1e ad a0 d1 35 + plain_block: 00 00 e9 30 4c 75 6e 61 de ad be ef de ad be ef + cipher_block: 7f f5 c0 f7 6c 06 f3 2d c6 76 a5 f1 73 0d 6f da + block # 2 + IV||blk_cntr: 517524055203726f207170bb00000004 + key_block: 92 4d 25 a9 58 9d 83 02 d5 14 99 b4 e0 14 78 15 + plain_block: de ad be ef de ad be ef de ad be ef + cipher_block: 4c e0 9b 46 86 30 3d ed 0b b9 27 5b + + Cipher before tag appended + 63e94885 dcdab67c a727d766 2f6b7e99 + 7ff5c0f7 6c06f32d c676a5f1 730d6fda + 4ce09b46 86303ded 0bb9275b + + + + +McGrew & Igoe Standards Track [Page 39] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Compute the GMAC tag + + Process the AAD + AAD word: 81c8000d4d617273800005d400000000 + partial hash: 085d6eb166c555aa62982f630430ec6e + + Process the cipher + cipher word: 63e94885dcdab67ca727d7662f6b7e99 + partial hash: 8c9221be93466d68bbb16fa0d42b0187 + cipher word: 7ff5c0f76c06f32dc676a5f1730d6fda + partial hash: 221ebb044ec9fd0bf116d7780f198792 + cipher word: 4ce09b4686303ded0bb9275b00000000 + partial hash: 50f70b9ca110ab312dce212657328dae + + Process the length word + length word: 00000000000000600000000000000160 + partial hash: 7296107c9716534371dfc1a30c5ffeb5 + + Turn GHASH into GMAC + GHASH: 72 96 10 7c 97 16 53 43 71 df c1 a3 0c 5f fe b5 + K0: ba dc b4 24 01 d9 1e 6c b4 74 39 d1 49 86 14 6b + full GMAC: c8 4a a4 58 96 cf 4d 2f c5 ab f8 72 45 d9 ea de + + Cipher with tag + 63e94885 dcdab67c a727d766 2f6b7e99 + 7ff5c0f7 6c06f32d c676a5f1 730d6fda + 4ce09b46 86303ded 0bb9275b c84aa458 + 96cf4d2f c5abf872 45d9eade + + Append the ESRTCP word with the E-flag set + 63e94885 dcdab67c a727d766 2f6b7e99 + 7ff5c0f7 6c06f32d c676a5f1 730d6fda + 4ce09b46 86303ded 0bb9275b c84aa458 + 96cf4d2f c5abf872 45d9eade 800005d4 + + Encrypted and tagged packet: + 81c8000d 4d617273 63e94885 dcdab67c + a727d766 2f6b7e99 7ff5c0f7 6c06f32d + c676a5f1 730d6fda 4ce09b46 86303ded + 0bb9275b c84aa458 96cf4d2f c5abf872 + 45d9eade 800005d4 + + + + + + + + + + +McGrew & Igoe Standards Track [Page 40] + +RFC 7714 AES-GCM for SRTP December 2015 + + +17.2. SRTCP AEAD_AES_256_GCM Verification and Decryption + + Key size = 256 bits + Tag size = 16 octets + + Process the length word + + Decrypting the following packet: + + 81c8000d 4d617273 d50ae4d1 f5ce5d30 + 4ba297e4 7d470c28 2c3ece5d bffe0a50 + a2eaa5c1 110555be 8415f658 c61de047 + 6f1b6fad 1d1eb30c 4446839f 57ff6f6c + b26ac3be 800005d4 + + Key size = 256 bits + Key size = 16 octets + + Form the IV + | Pad | SSRC | Pad | SRTCP | + 00 00 4d 61 72 73 00 00 00 00 05 d4 + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 24 05 52 03 72 6f 20 71 70 bb + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f + AAD: 81c8000d 4d617273 800005d4 + CT: d50ae4d1 f5ce5d30 4ba297e4 7d470c28 + 2c3ece5d bffe0a50 a2eaa5c1 110555be + 8415f658 c61de047 6f1b6fad 1d1eb30c + 4446839f 57ff6f6c b26ac3be + IV: 51 75 24 05 52 03 72 6f 20 71 70 bb + H: f29000b62a499fd0a9f39a6add2e7780 + + Verify the received tag + 1d 1e b3 0c 44 46 83 9f 57 ff 6f 6c b2 6a c3 be + + Process the AAD + AAD word: 81c8000d4d617273800005d400000000 + partial hash: 3ae5afd36dead5280b18950400176b5b + + Process the cipher + cipher word: d50ae4d1f5ce5d304ba297e47d470c28 + partial hash: e90fab7546f6940781227227ac926ebe + cipher word: 2c3ece5dbffe0a50a2eaa5c1110555be + partial hash: 9b236807d8b2dab07583adce367aa88f + cipher word: 8415f658c61de0476f1b6fad00000000 + partial hash: e69313f423a75e3e0b7eb93321700e86 + + + +McGrew & Igoe Standards Track [Page 41] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Process the length word + length word: 00000000000000600000000000000160 + partial hash: 3a284af2616fdf505faf37eec39fbc8b + + Turn GHASH into GMAC + GHASH: 3a 28 4a f2 61 6f df 50 5f af 37 ee c3 9f bc 8b + K0: 27 36 f9 fe 25 29 5c cf 08 50 58 82 71 f5 7f 35 + full GMAC: 1d 1e b3 0c 44 46 83 9f 57 ff 6f 6c b2 6a c3 be + + Received tag = 1d1eb30c 4446839f 57ff6f6c b26ac3be + Computed tag = 1d1eb30c 4446839f 57ff6f6c b26ac3be + Received tag verified. + + Decrypt the cipher + block # 0 + IV||blk_cntr: 517524055203726f207170bb00000002 + key_block: 9b 5e b4 e0 bb 9a 0d 02 19 f6 c7 c4 7d 47 08 02 + cipher_block: d5 0a e4 d1 f5 ce 5d 30 4b a2 97 e4 7d 47 0c 28 + plain_block: 4e 54 50 31 4e 54 50 32 52 54 50 20 00 00 04 2a + block # 1 + IV||blk_cntr: 517524055203726f207170bb00000003 + key_block: 2c 3e 27 6d f3 8b 64 31 7c 47 1b 2e cf a8 eb 51 + cipher_block: 2c 3e ce 5d bf fe 0a 50 a2 ea a5 c1 11 05 55 be + plain_block: 00 00 e9 30 4c 75 6e 61 de ad be ef de ad be ef + block # 2 + IV||blk_cntr: 517524055203726f207170bb00000004 + key_block: 5a b8 48 b7 18 b0 5e a8 b1 b6 d1 42 3b 74 39 55 + cipher_block: 84 15 f6 58 c6 1d e0 47 6f 1b 6f ad + plain_block: de ad be ef de ad be ef de ad be ef + + Verified and decrypted packet: + 81c8000d 4d617273 4e545031 4e545032 + 52545020 0000042a 0000e930 4c756e61 + deadbeef deadbeef deadbeef deadbeef + deadbeef + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 42] + +RFC 7714 AES-GCM for SRTP December 2015 + + +17.3. SRTCP AEAD_AES_128_GCM Tagging Only + + Tagging the following packet: + + 81c8000d 4d617273 4e545031 4e545032 + 52545020 0000042a 0000e930 4c756e61 + deadbeef deadbeef deadbeef deadbeef + deadbeef + + Key size = 128 bits + Tag size = 16 octets + + Form the IV + | Pad | SSRC | Pad | SRTCP | + 00 00 4d 61 72 73 00 00 00 00 05 d4 + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 24 05 52 03 72 6f 20 71 70 bb + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + AAD: 81c8000d 4d617273 4e545031 4e545032 + 52545020 0000042a 0000e930 4c756e61 + deadbeef deadbeef deadbeef deadbeef + deadbeef 000005d4 + IV: 51 75 24 05 52 03 72 6f 20 71 70 bb + H: c6a13b37878f5b826f4f8162a1c8d879 + + Compute the GMAC tag + + Process the AAD + AAD word: 81c8000d4d6172734e5450314e545032 + partial hash: f8dbbe278e06afe17fb4fb2e67f0a22e + AAD word: 525450200000042a0000e9304c756e61 + partial hash: 6ccd900dfd0eb292f68f8a410d0648ec + AAD word: deadbeefdeadbeefdeadbeefdeadbeef + partial hash: 6a14be0ea384c6b746235ba955a57ff5 + AAD word: deadbeef000005d40000000000000000 + partial hash: cc81f14905670a1e37f8bc81a91997cd + + Process the length word + length word: 00000000000001c00000000000000000 + partial hash: 3ec16d4c3c0e90a59e91be415bd976d8 + + Turn GHASH into GMAC + GHASH: 3e c1 6d 4c 3c 0e 90 a5 9e 91 be 41 5b d9 76 d8 + K0: ba dc b4 24 01 d9 1e 6c b4 74 39 d1 49 86 14 6b + full GMAC: 84 1d d9 68 3d d7 8e c9 2a e5 87 90 12 5f 62 b3 + + + + + +McGrew & Igoe Standards Track [Page 43] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Cipher with tag + 841dd968 3dd78ec9 2ae58790 125f62b3 + + Tagged packet: + 81c8000d 4d617273 4e545031 4e545032 + 52545020 0000042a 0000e930 4c756e61 + deadbeef deadbeef deadbeef deadbeef + deadbeef 841dd968 3dd78ec9 2ae58790 + 125f62b3 000005d4 + +17.4. SRTCP AEAD_AES_256_GCM Tag Verification + + Key size = 256 bits + Tag size = 16 octets + + Process the length word + Verifying the following packet: + + 81c8000d 4d617273 4e545031 4e545032 + 52545020 0000042a 0000e930 4c756e61 + deadbeef deadbeef deadbeef deadbeef + deadbeef 91db4afb feee5a97 8fab4393 + ed2615fe 000005d4 + + Key size = 256 bits + Key size = 16 octets + + Form the IV + | Pad | SSRC | Pad | SRTCP | + 00 00 4d 61 72 73 00 00 00 00 05 d4 + salt: 51 75 69 64 20 70 72 6f 20 71 75 6f + IV: 51 75 24 05 52 03 72 6f 20 71 70 bb + + Key: 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f + 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f + AAD: 81c8000d 4d617273 4e545031 4e545032 + 52545020 0000042a 0000e930 4c756e61 + deadbeef deadbeef deadbeef deadbeef + deadbeef 000005d4 + CT: 91db4afb feee5a97 8fab4393 ed2615fe + IV: 51 75 24 05 52 03 72 6f 20 71 70 bb + H: f29000b62a499fd0a9f39a6add2e7780 + + Verify the received tag + 91 db 4a fb fe ee 5a 97 8f ab 43 93 ed 26 15 fe + + + + + + +McGrew & Igoe Standards Track [Page 44] + +RFC 7714 AES-GCM for SRTP December 2015 + + + Process the AAD + AAD word: 81c8000d4d6172734e5450314e545032 + partial hash: 7bc665c71676a5a5f663b3229af4b85c + AAD word: 525450200000042a0000e9304c756e61 + partial hash: 34ed77752703ab7d69f44237910e3bc0 + AAD word: deadbeefdeadbeefdeadbeefdeadbeef + partial hash: 74a59f1a99282344d64ab1c8a2be6cf8 + AAD word: deadbeef000005d40000000000000000 + partial hash: 126335c0baa7ab1b79416ceeb9f7a518 + + Process the length word + length word: 00000000000001c00000000000000000 + partial hash: b6edb305dbc7065887fb1b119cd36acb + + Turn GHASH into GMAC + GHASH: b6 ed b3 05 db c7 06 58 87 fb 1b 11 9c d3 6a cb + K0: 27 36 f9 fe 25 29 5c cf 08 50 58 82 71 f5 7f 35 + full GMAC: 91 db 4a fb fe ee 5a 97 8f ab 43 93 ed 26 15 fe + + Received tag = 91db4afb feee5a97 8fab4393 ed2615fe + Computed tag = 91db4afb feee5a97 8fab4393 ed2615fe + Received tag verified. + + Verified packet: + 81c8000d 4d617273 4e545031 4e545032 + 52545020 0000042a 0000e930 4c756e61 + deadbeef deadbeef deadbeef deadbeef + deadbeef + +18. References + +18.1. Normative References + + [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate + Requirement Levels", BCP 14, RFC 2119, + DOI 10.17487/RFC2119, March 1997, + <http://www.rfc-editor.org/info/rfc2119>. + + [RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V. + Jacobson, "RTP: A Transport Protocol for Real-Time + Applications", STD 64, RFC 3550, DOI 10.17487/RFC3550, + July 2003, <http://www.rfc-editor.org/info/rfc3550>. + + [RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K. + Norrman, "The Secure Real-time Transport Protocol (SRTP)", + RFC 3711, DOI 10.17487/RFC3711, March 2004, + <http://www.rfc-editor.org/info/rfc3711>. + + + + +McGrew & Igoe Standards Track [Page 45] + +RFC 7714 AES-GCM for SRTP December 2015 + + + [RFC3830] Arkko, J., Carrara, E., Lindholm, F., Naslund, M., and K. + Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830, + DOI 10.17487/RFC3830, August 2004, + <http://www.rfc-editor.org/info/rfc3830>. + + [RFC4568] Andreasen, F., Baugher, M., and D. Wing, "Session + Description Protocol (SDP) Security Descriptions for Media + Streams", RFC 4568, DOI 10.17487/RFC4568, July 2006, + <http://www.rfc-editor.org/info/rfc4568>. + + [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated + Encryption", RFC 5116, DOI 10.17487/RFC5116, January 2008, + <http://www.rfc-editor.org/info/rfc5116>. + + [RFC5234] Crocker, D., Ed., and P. Overell, "Augmented BNF for + Syntax Specifications: ABNF", STD 68, RFC 5234, + DOI 10.17487/RFC5234, January 2008, + <http://www.rfc-editor.org/info/rfc5234>. + + [RFC5764] McGrew, D. and E. Rescorla, "Datagram Transport Layer + Security (DTLS) Extension to Establish Keys for the Secure + Real-time Transport Protocol (SRTP)", RFC 5764, + DOI 10.17487/RFC5764, May 2010, + <http://www.rfc-editor.org/info/rfc5764>. + + [RFC6188] McGrew, D., "The Use of AES-192 and AES-256 in Secure + RTP", RFC 6188, DOI 10.17487/RFC6188, March 2011, + <http://www.rfc-editor.org/info/rfc6188>. + + [RFC6904] Lennox, J., "Encryption of Header Extensions in the Secure + Real-time Transport Protocol (SRTP)", RFC 6904, + DOI 10.17487/RFC6904, April 2013, + <http://www.rfc-editor.org/info/rfc6904>. + + + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 46] + +RFC 7714 AES-GCM for SRTP December 2015 + + +18.2. Informative References + + [BN00] Bellare, M. and C. Namprempre, "Authenticated Encryption: + Relations among notions and analysis of the generic + composition paradigm", Proceedings of ASIACRYPT 2000, + Springer-Verlag, LNCS 1976, pp. 531-545, + DOI 10.1007/3-540-44448-3_41, + <http://www-cse.ucsd.edu/users/mihir/papers/oem.html>. + + [GCM] Dworkin, M., "NIST Special Publication 800-38D: + Recommendation for Block Cipher Modes of Operation: + Galois/Counter Mode (GCM) and GMAC", U.S. National + Institute of Standards and Technology, November 2007, + <http://csrc.nist.gov/publications/nistpubs/ + 800-38D/SP-800-38D.pdf>. + + [R02] Rogaway, P., "Authenticated-Encryption with Associated- + Data", ACM Conference on Computer and Communications + Security (CCS'02), pp. 98-107, ACM Press, + DOI 10.1145/586110.586125, September 2002, + <http://www.cs.ucdavis.edu/~rogaway/papers/ad.html>. + + [RFC4771] Lehtovirta, V., Naslund, M., and K. Norrman, "Integrity + Transform Carrying Roll-Over Counter for the Secure + Real-time Transport Protocol (SRTP)", RFC 4771, + DOI 10.17487/RFC4771, January 2007, + <http://www.rfc-editor.org/info/rfc4771>. + + + + + + + + + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 47] + +RFC 7714 AES-GCM for SRTP December 2015 + + +Acknowledgements + + The authors would like to thank Michael Peck, Michael Torla, Qin Wu, + Magnus Westerlund, Oscar Ohllson, Woo-Hwan Kim, John Mattsson, + Richard Barnes, Morris Dworkin, Stephen Farrell, and many other + reviewers who provided valuable comments on earlier draft versions of + this document. + +Authors' Addresses + + David A. McGrew + Cisco Systems, Inc. + 510 McCarthy Blvd. + Milpitas, CA 95035 + United States + Phone: (408) 525 8651 + + Email: mcgrew@cisco.com + URI: http://www.mindspring.com/~dmcgrew/dam.htm + + + Kevin M. Igoe + NSA/CSS Commercial Solutions Center + National Security Agency + + Email: mythicalkevin@yahoo.com + + + + + + + + + + + + + + + + + + + + + + + + + +McGrew & Igoe Standards Track [Page 48] + |