A student's open lab: learning and sharing, free for everyone.

SIP UniverseFree University

Home / TLS, SRTP, identity, and abuse / SRTP and two keying methods

SRTP and two keying methods

SRTP is RFC 3711. SDES a=crypto is RFC 4568. DTLS-SRTP is RFC 5764. An SBC must not assume peers share one method.

Learn in 5 minutes

  1. Separate SRTP from the way keys are obtained
  2. Name SDES and DTLS-SRTP as different keying methods
  3. Key each SBC leg with the method that leg negotiated

Visual

Two legs, two methods · study drawing · cyphermonkeylabs.com Peer ASBCPeer B INVITE 100 INVITE 200

SVG HTML PNG

Copying one leg's keying line onto the other leg is the failure this lesson prevents.

Worked example

See the profile mismatch The offer is RTP/SAVP. The answer is RTP/AVP. Negotiate and read the profile warning.

  1. Press Negotiate.
  2. Compare the profile tokens.
  3. State which profile is SRTP.

Fault

Peer A negotiated SDES. Peer B negotiated DTLS-SRTP. The SBC forwarded Peer A's a=crypto line onto Peer B and media stays silent.

SDES is RFC 4568. DTLS-SRTP is RFC 5764. SRTP itself is RFC 3711.

Quiz

SRTP is


a=crypto is


DTLS-SRTP is


RTP/AVP and RTP/SAVP


An SBC between SDES and DTLS-SRTP should


SDES keying material in SDP requires


Ecosystem

Glossary, sister systems, and the integration seam for this room.

E911 / emergency calling Location has to ride with the call. RFC 6881 is the BCP, RFC 6442 carries location in SIP, and the FCC MLTS page states Kari’s Law and RAY BAUM’s Act obligations for multi-line systems.

Glossary · Ecosystem map · Ports · Troubleshooting

Sources and go deeper