RFC 4383
The Use of Timed Efficient Stream Loss-Tolerant Authentication (TESLA) in the Secure Real-time Transport Protocol (SRTP)
RFC 4383: The Use of Timed Efficient Stream Loss-Tolerant Authentication (TESLA) in the Secure Real-time Transport Protocol (SRTP) 💖
Okay bestie, the title block tea ☕: this is RFC 4383, written by M. Baugher from Cisco and E. Carrara from the Royal Institute of Technology. It's a Standards Track doc in the Network Working Group, dated February 2006. The title block doesn't list any RFCs it obsoletes or updates. 🎀 (Part 1 of 4 ✨)
Status of This Memo
This doc specifies an Internet standards track protocol for the Internet community, and it wants discussion and suggestions for improvements 🦋 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
Copyright Notice
Copyright (C) The Internet Society (2006). 💜
Abstract
This memo explains how to use the Timed Efficient Stream Loss-tolerant Authentication (RFC 4082) transform inside the Secure Real-time Transport Protocol (SRTP) 🔥 The whole point is to give data origin authentication for multicast and broadcast data streams 😭✨
Table of Contents 📑
1. Introduction ....................................................2
1.1. Notational Conventions .....................................3
2. SRTP ............................................................3
3. TESLA ...........................................................4
4. Usage of TESLA within SRTP ......................................5
4.1. The TESLA Extension ........................................5
4.2. SRTP Packet Format .........................................6
4.3. Extension of the SRTP Cryptographic Context ................7
4.4. SRTP Processing ............................................8
4.4.1. Sender Processing ...................................9
4.4.2. Receiver Processing .................................9
4.5. SRTCP Packet Format .......................................11
4.6. TESLA MAC .................................................13
4.7. PRFs ......................................................13
5. TESLA Bootstrapping and Cleanup ................................14
6. SRTP TESLA Default Parameters ..................................14
7. Security Considerations ........................................15
8. Acknowledgements ...............................................16
9. References .....................................................17
9.1. Normative References ......................................17
9.2. Informative References ....................................171. Introduction 🌸
Okay so multicast and broadcast comms come with some brand new security drama compared to unicast 💀 A lot of multicast and broadcast apps need "data origin authentication" (DOA), also called "source authentication". That's how you guarantee a message really came from a given source and didn't get messed with on the way 🫶
In unicast, a pairwise security association between one sender and one receiver can give you data origin authentication with symmetric-key crypto (like a message authentication code, MAC). If the comms are strictly pairwise, the sender and receiver agree on a key that only the two of them know. Iconic, no notes 💅
In groups though, a key is shared among more than two members, and this symmetric-key approach does not guarantee data origin authentication 🙈 With a group security association [RFC4046] instead of a pairwise one, any member can alter the packet and impersonate any other member. The MAC in this case only proves the packet wasn't tampered with by an outsider (someone who doesn't have the group key), and that it was sent by somebody inside the group. Not me being like "wait, who sent that??" 💀
Some apps can't handle source ambiguity and need to figure out the true sender from every other group member. The usual fix is asymmetric crypto, like digital signatures. Unfortunately, that's giving high overhead in both time (to sign and verify) and bandwidth (to carry the signature in the packet) 😭
Several schemes have been proposed to give efficient data origin authentication in multicast and broadcast scenarios. The Timed Efficient Stream Loss-tolerant Authentication (TESLA) is one of them 🧚
This memo specifies TESLA authentication for SRTP. SRTP TESLA can give data origin authentication to RTP apps that use group security associations (like multicast RTP apps), as long as receivers follow the TESLA security invariants [RFC4082] 👑
1.1. Notational Conventions 🎀
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Those words are serious, bestie 🤍
This spec assumes you already know both SRTP and TESLA. Not much of their details get explained here, so you'll need to check their own specs, [RFC3711] and [RFC4082]. This spec uses the same definitions as TESLA for common terms, and it assumes you're familiar with the TESLA algorithms and protocols [RFC4082] 📚
2. SRTP 💜
The Secure Real-time Transport Protocol (SRTP) [RFC3711] is a profile of RTP. It can give confidentiality, message authentication, and replay protection to RTP traffic and to the RTP control protocol, the Real-time Transport Control Protocol (RTCP). The term "SRTP" is often used to mean SRTCP too, so don't be confused 🙃
SRTP is a framework that lets you add new security functions and new transforms. Right now SRTP doesn't define any mechanism for data origin authentication with group security associations. Lowkey sad, but it's straightforward to add TESLA to the SRTP cryptographic framework ✨
The TESLA extension to SRTP is defined in this spec, which assumes you know the SRTP spec [RFC3711], its packet structure, and its processing rules. TESLA is an alternative message-authentication algorithm that authenticates messages from the source when a key is shared among two or more receivers 🦋
3. TESLA 🌈
TESLA gives delayed per-packet data authentication, and it's specified in [RFC4082] 💖
On top of the SRTP data-packet definition here, TESLA needs an initial synchronization protocol and an initial bootstrapping procedure. The synchronization protocol lets the sender and receiver compare their clocks and figure out an upper bound on the difference. That synchronization protocol is outside the scope of this document ⏰
TESLA also needs an initial bootstrapping procedure to exchange the needed parameters and the initial commitment to the key chain [RFC4082]. For SRTP, it's assumed the bootstrapping happens out-of-band, possibly using the key management protocol that exchanges the SRTP security parameters, e.g., [RFC3547, RFC3830]. Initial bootstrapping of TESLA is outside the scope of this document 🫶
4. Usage of TESLA within SRTP 🔥
This spec is an extension to the SRTP spec [RFC3711]. It describes using TESLA with only a single key chain and delayed-authentication [RFC4082]. Main character energy 👑
4.1. The TESLA Extension 🦋
TESLA is an OPTIONAL authentication transform for SRTP. When it's used, TESLA adds the fields shown in Figure 1 to each packet. The fields TESLA adds are called "TESLA authentication extensions," while "authentication tag" or "integrity protection tag" refers to the normal SRTP integrity protection tag, used when the SRTP master key is shared by more than two endpoints [RFC3711] 💅
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| i |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~ Disclosed Key ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~ TESLA MAC ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Figure 1. The "TESLA authentication extension".
i: 32 bit, MANDATORY 🍓 The identifier of the time interval i, matching the key K_i, which is used to calculate the TESLA MAC of the current packet (and of other packets sent in the current time interval i).
Disclosed Key: variable length, MANDATORY 🌸 The disclosed key (K_(i-d)), which can be used to authenticate previous packets from earlier time intervals [RFC4082]. A Section 4.3 parameter sets the size of this field.
TESLA MAC (Message Authentication Code): variable length, MANDATORY ✨ The MAC is computed using the key K'_i (derived from K_i) [RFC4082], and it gets disclosed in a later packet (in the Disclosed Key field). The MAC coverage is defined in Section 4.6. A Section 4.3 parameter sets the size of this field 💖
4.2. SRTP Packet Format 🧚
Figure 2 shows what the SRTP packet looks like when TESLA is applied. When it's applied to RTP, the TESLA authentication extension SHALL be inserted before the (optional) SRTP MKI and (recommended) authentication tag (SRTP MAC). Bestie, this diagram is a lot, so take your time 🙈
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<+<+
|V=2|P|X| CC |M| PT | sequence number | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| timestamp | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| synchronization source (SSRC) identifier | | |
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| contributing source (CSRC) identifiers | | |
| .... | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| RTP extension (OPTIONAL) | | |
+>+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| | payload ... | | |
| | +-------------------------------+ | |
| | | RTP padding | RTP pad count | | |
+>+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<+ |
| | i | | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ Disclosed Key ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ TESLA MAC ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<|-+
| ~ MKI ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ MAC ~ | || +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| | |
+- Encrypted Portion TESLA Authenticated Portion ---+ |
|
Authenticated Portion ---+Figure 2. The format of the SRTP packet when TESLA is applied. 🎀
Okay so the Encrypted Portion of an SRTP packet is basically the encrypted RTP payload (RTP padding included, if there is any) of the equivalent RTP packet. Same as regular SRTP, no drama 💅
The Authenticated Portion is the RTP header, the Encrypted Portion, and the TESLA authentication extension. Like, the definition gets extended from [RFC3711] because now the TESLA extension is in the mix 🦋
The TESLA Authenticated Portion is the RTP header plus the Encrypted Portion. Now here's the tea 🍵 The SRTP MAC covers everything up to the MKI field, but NOT the MKI itself. The SRTP-TESLA MAC tag has to be covered by the SRTP integrity check for packet integrity, and SRTP doesn't cover the MKI (it doesn't need to for SRTP integrity). To make the two tags (SRTP-TESLA MAC and SRTP-MAC) sit right next to each other, you'd have to redefine SRTP so the MKI is included in SRTP-MAC coverage. That's just not happening, so the MKI ends up separating the TESLA MAC from the SRTP MAC in the layout of Figure 2. Good news: this layout change is no problem for an implementation that supports the new SRTP-TESLA authentication transform 🌸
The lengths of the Disclosed Key and TESLA MAC fields are Section 4.3 parameters. And just like regular SRTP, fields after the packet payload aren't necessarily aligned on 32-bit boundaries 🧚
4.3. Extension of the SRTP Cryptographic Context ✨
Okay bestie, when TESLA is in use, the cryptographic context definition from Section 3.2 of SRTP SHALL get these extensions 🫶
Transform-Dependent Parameters
- an identifier for the PRF (
TESLA PRF) that implements the one-way functionF(x)in TESLA (to derive the keys in the chain) and the one-way functionF'(x)in TESLA (to derive the keys for the TESLA MAC from the keys in the chain), e.g., to indicateHMAC-SHA1. See Section 6 for the default value. 🔑 - a non-negative integer,
n_p, determining the length of theFoutput, i.e., the length of the keys in the chain (which is also the key disclosed in an SRTP packet). See Section 6 for the default value. - a non-negative integer,
n_f, determining the length of the output ofF', i.e., the key for the TESLA MAC. See Section 6 for the default value. - an identifier for the TESLA MAC that accepts the output of
F'(x)as its key, e.g., to indicateHMAC-SHA1. See Section 6 for the default value. - a non-negative integer,
n_m, determining the length of the TESLA MAC output. See Section 6 for the default value. - the beginning of the session,
T_0. ⏰ - the interval duration,
T_int(in msec). - the key disclosure delay,
d(in number of intervals). - the upper bound,
D_t(in sec), on the lag of the receiver clock relative to the sender clock (the peers have to calculate this quantity out-of-band, so no shortcuts 🙈). - a non-negative integer,
n_c, determining the length of the key chain,K_0...K_n-1of [RFC4082] (see also Section 6 of this document). This is based on the expected duration of the stream. - the initial key of the chain that the sender has committed themself to. 💜
So F(x) is what builds the keychain of keys in SRTP TESLA, as defined in Section 6. And according to TESLA, F'(x) computes a TESLA MAC key using the inputs defined in Section 6. Section 6 of this document is where the default values for the transform-specific TESLA parameters live, so go check it out 🌈
4.4. SRTP Processing 🔥
Processing SRTP packets is described in Section 3.3 of the SRTP specification [RFC3711]. TESLA changes things up a little: the SRTP MAC gets checked as soon as the packet arrives (that's for DoS prevention), but the current packet isn't TESLA-authenticated yet. Instead, each packet gets buffered until a later packet discloses its TESLA key. The TESLA verification itself is made of several steps, like testing the TESLA security invariants, and those are described in Sections 3.5-3.7 of [RFC4082]. In this doc, the words "TESLA computation" and "TESLA verification" stand in for all of those steps, even though they aren't all spelled out below. Also, notice that TESLA verification includes checking the safety condition (Section 3.5 of [RFC4082]) 👀
As [RFC4082] points out, if a packet is deemed "unsafe," the receiver treats it as unauthenticated. Ideally it should discard unsafe packets, but at its own risk, it may choose to use them unverified. So if the safe condition doesn't hold, it is RECOMMENDED to discard the packet and log the event 🚫
4.4.1. Sender Processing 📤
The sender processing is the same as Section 3.3 of [RFC3711], up to step 5, inclusive. After that, the following process happens:
- When TESLA is applied, identify the key in the TESLA chain to use in the current time interval, plus the TESLA MAC key derived from it. Then run the TESLA computation to get the TESLA authentication extension for the current packet. You do this by appending the current interval identifier (as the i field), the disclosed key of the chain for the previous disclosure interval (since the key for interval i is disclosed in interval i+d), and the TESLA MAC under the current key from the chain. This step uses the related TESLA parameters from the crypto context, same as Step 4. ✨
- If the MKI indicator in the SRTP crypto context is set to one, append the MKI to the packet. 🎀
- When TESLA is applied, and the SRTP authentication (external tag) is required (for DoS), compute the authentication tag as described in step 7 of Section 3.3 of the SRTP specification, but with the coverage defined in this specification (see Section 4.6). 🛡️
- If necessary, update the rollover counter (step 8 in Section 3.3 of [RFC3711]). 🔄
4.4.2. Receiver Processing 📥
The receiver processing is the same as Section 3.3 of [RFC3711], up to step 4, inclusive.
To authenticate and replay-protect the current packet, here's the flow 💖
First, check whether the packet has been replayed (as per Section 3.3 of [RFC3711]). Heads up though: the SRTP replay list holds SRTP indices of recently received packets that were authenticated by TESLA. So replay list updates MUST NOT be based on the SRTP MAC. If the packet is judged to be replayed, then the packet MUST be discarded, and the event SHOULD be logged. 🙅♀️
Next, verify the SRTP integrity protection tag (not the TESLA MAC), if present. You use the rollover counter from the current packet, the authentication algorithm from the cryptographic context, and the session authentication key. If the verification is unsuccessful, the packet MUST be discarded from further processing, and the event SHOULD be logged. ❌
If the verification is successful, remove and store the MKI (if present) and the authentication tag fields from the packet. The packet is now buffered, waiting for its TESLA key to be disclosed in a later packet ⏳
TESLA authentication happens on a packet when its key gets disclosed in a subsequent packet. Remember, the key for interval i is disclosed during interval i+d, so the same key shows up in packets sent over d intervals of length T_int. If the interval identifier i from the packet (Section 4.1) has jumped more than d intervals past the highest i received so far, then packets got lost. In that case, one or more keys MUST be computed as described in Section 3.2, second paragraph, of the TESLA specification [RFC4082]. This computation runs recursively for all the disclosed keys that were lost, from the newly-received interval back to the last-received interval. 🕵️♀️
When a newly-disclosed key is received or computed, perform the TESLA verification of the packet using the rollover counter from the packet, the TESLA security parameters from the cryptographic context, and the disclosed key. If the verification is unsuccessful, the packet MUST be discarded from further processing, and the event SHOULD be logged. If the TESLA verification is successful, remove the TESLA authentication extension from the packet. 🎉
To decrypt the current packet, the processing goes like this:
Decrypt the Encrypted Portion of the packet, using the decryption algorithm from the cryptographic context, the session encryption key, and the salt (if used), found in Step 4 with the index from Step 2. 🔓
(Quick note: the order of decryption and TESLA verification is not mandated. It is RECOMMENDED that TESLA verification be performed before decryption. TESLA application designers might pick optimistic processing techniques, like reporting TESLA verification results after decryption or even after plaintext processing. Optimistic verification is beyond the scope of this document. 🌸)
Last but not least, update the rollover counter and the highest sequence number, s_l, in the cryptographic context, using the packet index estimated in Step 2. If replay protection is provided, also update the Replay List. (The Replay List gets updated after TESLA authentication is successfully verified, so that order matters 👑)
4.5. SRTCP Packet Format 🎀
okay so Figure 3 shows what an SRTCP packet looks like when TESLA is applied 🦋 the TESLA auth extension SHALL be inserted before the MKI and the authentication tag. quick reminder from [RFC3711]: in SRTCP the MKI is OPTIONAL, but the E-bit, the SRTCP index, and the authentication tag are MANDATORY 💅 so the SRTP (external) MAC is MANDATORY too when TESLA is in use. no skipping that one bestie 🙈
as in SRTP, the "Encrypted Portion" of an SRTCP packet is the encryption of the RTCP payload of the equivalent compound RTCP packet. it runs from the first RTCP packet, i.e., from the ninth (9) byte to the end of the compound packet ✨
the "Authenticated Portion" of an SRTCP packet covers the entire equivalent (eventually compound) RTCP packet, the E flag, the SRTCP index (after any encryption has been applied to the payload), and the TESLA extension. the definition got extended from [RFC3711] to include the TESLA auth extension, so it's giving glow-up 💖
we also define the "TESLA Authenticated Portion" of an SRTCP packet as the RTCP header (first 8 bytes) plus the Encrypted Portion of the SRTCP packet 🧚
processing an SRTCP packet is similar to SRTP processing (Section 4.3), but there are SRTCP-specific changes described in Section 3.4 of the SRTP specification [RFC3711] and in Section 4.6 of this memo 🌸
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<+<+
|V=2|P| RC | PT=SR or RR | length | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| SSRC of sender | | |
+>+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| ~ sender info ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ report block 1 ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ report block 2 ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ ... ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| |V=2|P| SC | PT=SDES=202 | length | | |
| +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| | SSRC/CSRC_1 | | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ SDES items ~ | |
| +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| ~ ... ~ | |
+>+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| |E| SRTCP index | | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<+ |
| | i | | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ Disclosed Key ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ TESLA MAC ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<|-+
| ~ SRTCP MKI ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| : authentication tag : | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| | |
+-- Encrypted Portion TESLA Authenticated Portion -----+ |
|
Authenticated Portion -------+Figure 3. The format of the SRTCP packet when TESLA is applied.
note that when extra fields get added to a packet, the packet gets bigger, and that bumps up the RTCP average packet size too 📈
4.6. TESLA MAC 🔐
let M' be the packet data that gets TESLA-authenticated. for SRTP, M' SHALL consist of the SRTP TESLA Authenticated Portion (RTP header and SRTP Encrypted Portion; see Figure 2) of the packet, concatenated with the rollover counter (ROC) of that same packet 💜
M' = ROC || TESLA Authenticated Portion.for SRTCP, M' SHALL consist of the SRTCP TESLA Authenticated Portion only (RTCP header and SRTCP Encrypted Portion) 🫶
the normal authentication tag (OPTIONAL for SRTP, MANDATORY for SRTCP) SHALL be applied with the same coverage as specified in [RFC3711]. that means:
- for SRTP: Authenticated Portion || ROC (with the extended definition of SRTP Authentication Portion as in Section 4.2).
- for SRTCP: Authenticated Portion (with the extended definition of SRTCP Authentication Portion as in Section 4.2).
the predefined authentication transform in SRTP, HMAC-SHA1 [RFC2104], is also used to generate the TESLA MAC ✨ for SRTP (and respectively for SRTCP), the HMAC SHALL be applied to the key in the TESLA chain that corresponds to a particular time interval, and to M' as specified above. the HMAC output SHALL then be truncated to the n_m left-most bits. default values are in Section 6.
as with SRTP, the predefined HMAC-SHA1 authentication algorithm MAY be replaced with an alternative algorithm that is specified in a future Internet RFC 🦋
4.7. PRFs 🌈
TESLA requires a pseudo-random function (PRF) to implement two things:
- one one-way function F(x) to derive the key chain, and
- one one-way function F'(x) to derive (from each key of the chain) the key that is actually used to calculate the TESLA MAC.
when TESLA is used within SRTP, the default choice of the PRF SHALL be HMAC-SHA1. default values are in Section 6 👑
other PRFs can be chosen, and their use SHALL follow the common guidelines in [RFC3711] when adding new security parameters 🍓
5. TESLA Bootstrapping and Cleanup 🧁
the extensions to the SRTP cryptographic context include a set of TESLA parameters, which are listed in Section 4.3 of this document. on top of that, TESLA MUST be bootstrapped at session setup (for the parameter exchange and the initial key commitment) through a regular data authentication system. a digital signature algorithm is RECOMMENDED for this 🔏 key management procedures can take care of this bootstrapping before an SRTP session that uses TESLA authentication begins. the bootstrapping mechanism itself is out of scope for this document (it could, for example, be part of the key management protocol).
a critical factor for TESLA security is that the sender and receiver need to be loosely synchronized ⏰ TESLA requires a bound on clock drift to be known (D_t). using TESLA in SRTP assumes that time synchronization is guaranteed by out-of-band schemes (e.g., key management). that is not in the scope of SRTP.
also worth noting: TESLA has some reliability requirements. a key is disclosed for a packet in a subsequent packet, and that subsequent packet can get lost 😭 since a key in a lost packet can be derived from a future packet, TESLA is robust to packet loss 🙌 however, this key stream stops when the key-bearing data stream packets stop at the conclusion of the RTP session. to avoid this nasty boundary condition, send null packets with TESLA keys for one entire key-disclosure period following the interval in which the stream ceases. null packets SHOULD be sent for d intervals of duration t_int (items 8 and 9 of Section 4.3). the rate of null packets SHOULD be the average rate of the session media stream 💀
6. SRTP TESLA Default Parameters 💖
key management procedures establish SRTP TESLA operating parameters, which are listed in Section 4.3 of this document. the operating parameters appear in the SRTP cryptographic context and have the default values described in this section. in the future, an Internet RFC MAY define alternative settings for SRTP TESLA that differ from those specified here.
heads up, bestie 🚨 the settings defined in this memo can have a large impact on bandwidth, because they add 38 bytes to each packet (when the field length values are the default ones). for certain applications, this overhead may represent more than a 50% increase in packet size. alternative settings might seek to reduce the number and length of various TESLA fields and outputs, but no such optimizations are considered in this memo.
it is RECOMMENDED that the SRTP MAC be truncated to 32 bits, since the SRTP MAC provides only group authentication and serves only as protection against external DoS 🛡️
the default values for the security parameters are listed in the following table 🍰
Parameter Mandatory-to-support Default
--------- -------------------- -------
TESLA PRF HMAC-SHA1 HMAC-SHA1
BIT-OUTPUT LENGTH n_p 160 160
BIT-OUTPUT LENGTH n_f 160 160
TESLA MAC HMAC-SHA1 HMAC-SHA1
(TRUNCATED) BIT-OUTPUT LENGTH n_m 80 80as shown above, TESLA implementations MUST support HMAC-SHA1 [RFC2104] for the TESLA MAC and the TESLA PRF. the TESLA keychain generator is recursively defined as follows [RFC4082].
K_i=HMAC_SHA1(K_{i+1},0), i=0..N-1where N-1=n_c from the cryptographic context.
the TESLA MAC key generator is defined as follows [RFC4082].
K'_i=HMAC_SHA1(K_i,1)the TESLA MAC uses a truncated output of ten bytes [RFC2104] and is defined as follows.
HMAC_SHA1(K'_i, M')where M' is as specified in Section 4.6 🦋
7. Security Considerations ✨
Okay, bestie, this section is where we talk about the scary stuff 😭 Denial of Service (DoS) attacks on delayed authentication are covered in [PCST]. Here's the problem: TESLA makes the receiver buffer packets before it can authenticate them, so an attacker can flood it with bogus packets and the receiver can suffer a denial of service attack. 🙈
The fix is the external SRTP MAC, which is based on the group key. It MAY be used in addition to the TESLA MAC 🛡️ Its short size (default 32 bits) is on purpose, because that MAC is only there to stop DoS from attackers outside the group. Yes, a shorter output tag means an attacker has a better chance of getting a forged packet accepted, about 2^31 attempts on average. But as a first line of defense, a short tag is probably good enough! A victim will likely have plenty of evidence that it's under attack before it accepts a forged packet, and that forged packet will then fail the TESLA check anyway. Iconic. 💅
If you want other ways to stop DoS instead of the external group-key MAC, [RFC4082] describes some. If you use them, they need to be added as processing steps, following the guidelines of [RFC4082]. ✨
Using TESLA in SRTP, the way this specification defines it, comes with the security considerations from the SRTP specification [RFC3711] and the TESLA specification [RFC4082]. The big one is that TESLA's security depends on computing the "safety condition" defined in Section 3.5 of [RFC4082]. Don't skip that part, it's serious 🥺
SRTP TESLA also depends on how well the systems that do bootstrapping (time synchronization) and key management are secured. Those systems live outside SRTP and aren't covered by this specification, so keep that in mind! 🧚
Last but not least, the TESLA MAC is 80 bits by default. RFC 2104 says the MAC length has to be at least 80 bits AND at least half the output size of the underlying hash function. SHA-1's output is 160 bits, so the 80-bit MAC in this document meets both requirements, slay 🎀 Note that IPsec implementations tend to use 96 bits for their MAC values so the header lines up on a 64-bit boundary. Both MAC sizes are way beyond what current cryptanalytic techniques can reach, so we're literally safe, periodt 🔥
8. Acknowledgements 🫶
The authors want to thank Ran Canetti, Karl Norrman, Mats Naslund, Fredrik Lindholm, David McGrew, and Bob Briscoe for their valuable help. Main character supporting cast energy 👑
9. References 📚
9.1. Normative References
- [RFC2104]: Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing for Message Authentication", RFC 2104, February 1997.
- [RFC2119]: Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC3711]: Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K. Norrman, "The Secure Real-time Transport Protocol (SRTP)", RFC 3711, March 2004.
- [RFC4082]: Perrig, A., Song, D., Canetti, R., Tygar, J., and B. Briscoe, "Timed Efficient Stream Loss-Tolerant Authentication (TESLA): Multicast Source Authentication Transform Introduction", RFC 4082, June 2005.
9.2. Informative References
- [PCST]: Perrig, A., Canetti, R., Song, D., Tygar, D., "Efficient and Secure Source Authentication for Multicast", in Proc. of Network and Distributed System Security Symposium NDSS 2001, pp. 35-46, 2001.
- [RFC3547]: Baugher, M., Weis, B., Hardjono, T., and H. Harney, "The Group Domain of Interpretation", RFC 3547, July 2003.
- [RFC3830]: Arkko, J., Carrara, E., Lindholm, F., Naslund, M., and K. Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830, August 2004.
- [RFC4046]: Baugher, M., Canetti, R., Dondeti, L., and F. Lindholm, "Multicast Security (MSEC) Group Key Management Architecture", RFC 4046, April 2005.
Authors' Addresses 🎀
Questions and comments should be directed to the authors and msec@ietf.org. Hit them up!
Mark Baugher
Cisco Systems, Inc.
5510 SW Orchid Street
Portland, OR 97219 USA
Phone: +1 408-853-4418
EMail: mbaugher@cisco.com
Elisabetta Carrara
Royal Institute of Technology
Stockholm
Sweden
EMail: carrara@kth.seFull Copyright Statement ©
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 💜
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 🌸
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). Thank you, IASA, you're the real MVP ✨
📦 where this page comes from
- ietf: rfc4383 2006-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms