RFC 3711

The Secure Real-time Transport Protocol (SRTP)
Standards Track
March 2004
RFC Library > Cryptographic Primitives > RFC 3711
Abstract: This document describes the Secure Real-time Transport Protocol (SRTP), a profile of RTP providing confidentiality, message authentication, and replay protection for RTP and RTCP traffic. SRTP uses AES in counter mode for encryption and HMAC-SHA1 for authentication, with a key derivation function for per-session key management.
Canonical source: https://www.rfc-editor.org/rfc/rfc3711  |  IETF Datatracker

Overview

▶

SRTP provides security services for Real-time Transport Protocol (RTP) media streams, including confidentiality (encryption), integrity (authentication), and replay protection. It is designed for low-latency, real-time communication with minimal overhead.

In 3GPP, SRTP secures voice and video media in IMS (IP Multimedia Subsystem) calls, protecting the media plane between UEs and between UE and media gateways.

SRTP Packet Format

▶

SRTP preserves the RTP header in cleartext (for routing) and encrypts only the payload. The authentication tag covers the RTP header, payload, and the ROC (Rollover Counter) to provide integrity.

  ┌─────────────────────────────────────────────┐
│           RTP Header (12+ bytes)            │
│  V=2│P│X│CC│M│  PT  │  Sequence Number      │
│         Timestamp                           │
│         SSRC                                │
│         [CSRC list]                         │
├─────────────────────────────────────────────┤
│         Encrypted RTP Payload               │
│         (AES-CM or AES-f8)                  │
├─────────────────────────────────────────────┤
│  SRTP MKI (optional, configurable length)   │
├─────────────────────────────────────────────┤
│  Authentication Tag (HMAC-SHA1, 80/32 bits) │
└─────────────────────────────────────────────┘

Cryptographic Algorithms

▶
Function Default Algorithm Parameters
Encryption AES-128-CM (Counter Mode) 128-bit key, 112-bit salt
Authentication HMAC-SHA1-80 160-bit key, 80-bit tag
Alt Authentication HMAC-SHA1-32 160-bit key, 32-bit tag (voice)
Key Derivation AES-128-CM KDF Master key → session keys
Voice optimization: The 32-bit authentication tag variant (HMAC-SHA1-32) reduces overhead for bandwidth-constrained voice calls at the cost of reduced forgery resistance.

Key Derivation Function

▶

SRTP derives per-session keys from a single master key using an AES-CM based KDF. This produces separate keys for encryption, authentication, and salting, and supports periodic key refresh without re-keying.

  • Master Key: Negotiated via key management protocol (SDES, DTLS-SRTP, MIKEY)
  • Session Encryption Key: KDF(master_key, label=0x00, index)
  • Session Auth Key: KDF(master_key, label=0x01, index)
  • Session Salt Key: KDF(master_key, label=0x02, index)
  • Key derivation rate: Configurable — can derive new keys every 2^n packets

Replay Protection

▶

SRTP maintains a replay list using a sliding window mechanism based on the SRTP packet index (48-bit, derived from RTP sequence number + ROC). Duplicate packets or packets outside the window are rejected.

SRTCP (Secure RTCP)

▶

SRTCP provides the same security services for RTCP control messages. Unlike SRTP, SRTCP includes an explicit 31-bit SRTCP index in each packet for replay protection, and encryption is optional (an 'E' flag indicates whether the payload is encrypted).

3GPP Relevance

▶
  • TS 33.328 IMS media security: SRTP is the mandatory media protection mechanism for IMS VoLTE/VoNR calls
  • TS 24.229 SIP: Key negotiation for SRTP integrated with SIP signaling (SDP Security Descriptions or DTLS-SRTP)
  • e2e media encryption: SRTP provides end-to-end encryption between UEs for voice/video, complementing signaling-plane security
  • Lawful interception: SRTP key management must support lawful interception requirements per TS 33.107
  • VoNR/VoLTE: All IMS voice and video bearers protected by SRTP in production deployments