[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Linphone-developers] Set Master Key for SRTP in linphone

From: Hilman Fitriana
Subject: Re: [Linphone-developers] Set Master Key for SRTP in linphone
Date: Thu, 4 Jun 2020 22:45:53 +0700

Thank you for the answer, as you said a master key on srtp will be generated into 6 session keys that are used directly for the encryption and authentication process. However, as mentioned, srtp requires external input as a master key. To be able to communicate using srtp (aes), of course both parties need to have the same key. This is the point of the problem. Which party regulates the key to the security process? Is it on the sender, receiver or even the server?

I found interesting code in the linphone source in the linphone-sdk / mediastreamer2 / tools / mediastreamer.c file which generates the master key for local or remote. Here is the code : 
void setup_media_streams(MediastreamDatas* args){
if (args->enable_srtp) {
     if (!args->srtp_local_master_key) {
          char tmp[30];
          args->srtp_local_master_key = (char*) malloc(41);
          b64_encode((const char*)tmp, 30, args->srtp_local_master_key, 40);
          args->srtp_local_master_key[40] = '\0';
          ms_message("Generated local srtp key: '%s'", args->srtp_local_master_key);
      if (!args->srtp_remote_master_key) {

Is this the place to generate the master key used for srtp communication?

I use asterisk as a voip server. To be able to communicate with an active SRTP, I must set the type of media encryption on the server with sdes. I think the first point to be discussed for the term "SRTP" that I raised.

Note: I use the linphone console version without UI.

Best Regards,

Pada tanggal Kam, 4 Jun 2020 pukul 17.52 Greg Troxel <> menulis:
Mark Murawski <> writes:

> Here is specific information about how SRTP operates:
> See this section on Key Derivation:

[It is still on my TODO list to really understand the entire SRTP ecosystem.]

That explains how to go from a provided master key to individual
algorithm keys, and section 8 talks about external key management.

I realize it's conventional to label this "SRTP" in a UI, but it seems
that these UIs are mislabeled, in that SRTP itself, without an associated
key management scheme, requires providing a key to both endpoints.

When people and programs simply say "SRTP", I think they could mean
either of these:

  Session Description Protocol (SDP) Security Descriptions for Media Streams

  SRTP Extension for DTLS

The first is about SIP providing keys over the TLS-protected signaling

The second is within the data channel, but has a scheme to bootstrap
authentication from the signaling channel:

   A DTLS-SRTP session may be indicated by an external signaling
   protocol like SIP.  When the signaling exchange is integrity-
   protected (e.g., when SIP Identity protection via digital signatures
   is used), DTLS-SRTP can leverage this integrity guarantee to provide
   complete security of the media stream.  A description of how to
   indicate DTLS-SRTP sessions in SIP and SDP [RFC4566], and how to
   authenticate the endpoints using fingerprints can be found in


  What is linphone doing when configured for "SRTP"?
  What is linphone doing when configured for "DTLS"

  Do people think it is a bug that the UI does not make this clear?
  Or is it obvious that SRTP is short for "SDES-SRTP (RFC4568)"?
  And that DTLS is short for RFC5764?

Linphone-developers mailing list

reply via email to

[Prev in Thread] Current Thread [Next in Thread]