RFC 4771
Integrity Transform Carrying Roll-Over Counter for the Secure Real-time Transport Protocol (SRTP)
RFC 4771: Integrity Transform Carrying Roll-Over Counter for the Secure Real-time Transport Protocol (SRTP) 🎀
Okay bestie, this RFC is from V. Lehtovirta, M. Naslund and K. Norrman, all at Ericsson 💅 It's RFC 4771, published January 2007 under the Network Working Group, and it's a Standards Track doc, so it's an actual protocol spec. The header doesn't list any RFCs that it obsoletes or updates, so there's nothing to cross-check there ✨
Status of This Memo 📜
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice ©️
Copyright (C) The IETF Trust (2007).
Abstract 🌸
Okay so this doc defines an integrity transform for Secure Real-time Transport Protocol (SRTP; see RFC 3711) 🔐 It lets the roll-over counter (ROC) get sent in SRTP packets as part of the authentication tag. Why does that matter? Well, it's needed when a receiver joins a session that's already going and has to sync up fast and reliably 🏃♀️ It also helps SRTP out when there's a risk of losing sender-receiver synchronization, which is giving main character energy 👑
Table of Contents 🗂️
1. Introduction ....................................................2
1.1. Terminology ................................................3
2. The Transform ...................................................3
3. Transform Modes .................................................5
4. Parameter Negotiation ...........................................5
5. Security Considerations .........................................7
6. IANA Considerations ............................................10
7. Acknowledgements ...............................................10
8. References .....................................................10
8.1. Normative References ......................................10
8.2. Informative References ....................................101. Introduction ✨
Okay, so picture this. A receiver joins an SRTP [RFC3711] session that's already running. Out-of-band signaling must provide the receiver with the value of the ROC the sender is currently using 🔑 For instance, it can be carried in the Common Header Payload of a MIKEY [RFC3830] message. Here's the tea though: sometimes the receiver still can't sync its ROC with the sender's, even when it gets that signaled out of band 😭 Here are the examples where sync failure shows up:
- The receiver gets the ROC in a MIKEY message together with a key required for a particular continuous service. But it doesn't actually join the service until a few hours later, and by then the sender's sequence number (SEQ) has wrapped around, so the sender has meanwhile increased the value of ROC 💀 When the user finally joins, they grab the SEQ from the first SRTP packet they see and prepend the ROC to build the index. If integrity protection is used, the packet gets discarded. If there's no integrity protection, the packet may (if key derivation rate is non-zero) get decrypted using the wrong session key, since ROC is used as input in session key derivation. Either way, the receiver's ROC is not synchronized with the sender's, and it's not possible to recover without out-of-band signaling 🙈
- If the receiver leaves the session (because it's out of radio coverage or because of a user action) and doesn't start receiving traffic from the service again until after 2^15 packets have been sent, it'll be out of synchronization, for the same reasons as in example 1 📉
- The receiver joins a service right after the SEQ has wrapped around (say, SEQ = 0x0001). The sender generates a MIKEY message and includes the current value of ROC (say, ROC = 1). The MIKEY message reaches the receiver, who reads the ROC value and initializes its local ROC to 1. Now, if an SRTP packet from before the wraparound, i.e., with a SEQ lower than 0 (say, SEQ = 0xffff), got delayed and reaches the receiver as the first SRTP packet it sees, the receiver will initialize its highest received sequence number, s_l, to 0xffff. Next, the receiver gets SRTP packets with sequence numbers larger than zero, and deduces that the SEQ has wrapped. So the receiver incorrectly updates the ROC and ends up out of synchronization 😩
- This is like example 3. Since the initial SEQ is selected at random by the sender, it may happen to be a value very close to 0xffff. In that case, if the first few packets are lost, the receiver may similarly end up out of synchronization 🌀
These problems have been recognized in, e.g., 3GPP2 and 3GPP, where SRTP is used for streaming media protection in their respective multicast/broadcast solutions [BCMCS][MBMS]. Problem 4 actually exists inherently because of the way SEQ initialization is done in RTP 🧩
One possible approach could be to carry the ROC in the MKI (Master Key Identifier) field of each SRTP packet. This has the advantage that the receiver immediately knows the entire index for a packet ✨ The catch is that the MKI has no semantics in RFC 3711 (other than specifying master key), so a regular RFC 3711 compliant implementation would not be able to use the info carried in the MKI 🥲 Also, the MKI field is not integrity protected, so care must be taken to avoid obvious attacks against the synchronization 🚨
This document presents a solution where the ROC is carried in the authentication tag of a special integrity transform in selected SRTP packets 💖
The benefit of this approach is that fast and robust synchronization can be achieved as a separate integrity transform, using the hooks that already exist in SRTP 🦋 Plus, when the ROC is transmitted to the receiver, it needs to be integrity protected to avoid persistent denial-of-service (DoS) attacks or transmission errors that could knock the receiver out of synchronization. (A DoS attack is regarded as persistent if it can last after the attacker has left the area. In this particular case, an attacker could modify the ROC in one packet, and the victim would be out of synchronization until the next ROC is transmitted.) So the conclusion is that it makes sense to carry the ROC inside the authentication tag of an integrity transform 💅
1.1. Terminology 📝
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🧠
2. The Transform 🦋
The transform, hereafter called Roll-over Counter Carrying Transform (or RCC for short), works like this ✨
The sender processes the RTP packet according to RFC 3711. When applying the message integrity transform, the sender checks if the SEQ is equal to 0 modulo some non-zero integer constant R. If that's the case, the sender computes the MAC the same way it's done with the default integrity transform (i.e., HMAC-SHA1(auth_key, Authenticated_portion || ROC)). Next, the sender truncates the MAC by 32 bits to generate MAC_tr, i.e., MAC_tr is the tag_length - 32 most significant bits of the MAC. Then the sender builds the tag as TAG = ROC_sender || MAC_tr, where ROC_sender is the value of its local ROC, and appends the tag to the packet. See the security considerations section for discussion of the effects of shortening the MAC. In particular, note that a tag-length of 32 bits gives no security at all 🚫
If the SEQ is not equal to 0 mod R, the sender just proceeds to process the packet according to RFC 3711 without doing the actions in the previous paragraph 🏃♀️
The value R is the rate at which the ROC is included in the SRTP packets. Since the ROC takes up four octets, this gives the possibility to use it sparsely 🌸
When the receiver gets an SRTP packet, it processes the packet according to RFC 3711, except that during authentication processing ROC_local is replaced by ROC_sender (retrieved from the packet). Here's how that works. In the step where integrity protection is to be verified, if the SEQ is equal to 0 modulo R, the receiver extracts ROC_sender from the TAG and verifies the MAC computed (the same way as if the default integrity transform was used) over the authenticated portion of the packet (as defined in [RFC3711]), but concatenated with ROC_sender instead of concatenated with the local_ROC. The receiver generates MAC_tr for the MAC verification the same way the sender did. Note that the session key used in the MAC calculation depends on the ROC, and during the derivation of the session integrity key, the ROC found in the packet under consideration MUST be used. If the verification succeeds, the receiver sets its local ROC equal to the ROC carried in the packet. If the MAC does not verify, the packet MUST be dropped. The reasoning behind using the ROC from the packet in the MAC calculation is that if the receiver has an incorrect ROC value, MAC verification will fail, so the receiver won't correct its ROC 🛡️
If the SEQ is not equal to 0 mod R, the receiver just proceeds to process the packet according to RFC 3711 without doing the actions in the previous paragraph 💫
Since Secure Real-time Transport Control Protocol (SRTCP) already carries the entire index in-band, there's no reason to apply this transform to SRTCP. Hence, the transform SHALL only be applied to SRTP, and SHALL NOT be used with SRTCP 🫶
3. Transform Modes 🦋
okay so the transform we just looked at only protects the packets that carry the ROC, and that's mode 1 🎀. But sometimes you want everything protected, so packets whose SEQ is not 0 mod R MUST be protected with the default integrity transform. That's mode 2 💖.
Then there's mode 3 🙈, which is basically no integrity protection at all. It's acceptable in some situations, but bestie, be careful. If the ROC-carrying packets aren't integrity protected, a DoS attack becomes possible, and it sticks around until the next correctly received ROC. Please read Section 5 carefully before you even think about mode 3 💅.
If there's no integrity protection (mode 3), the receiver's SRTP layer SHOULD ignore the ROC in the packet when the application layer can tell it that the local ROC is in sync with the sender. Then the packet gets processed with the local ROC ✨. The received ROC still MUST be removed from the packet before any further processing, though. Also, the app-to-SRTP feedback doesn't need to happen per packet. It can just be a boolean that the app sets and the SRTP layer reads 🌸.
So here's the difference, and it's kind of iconic 👑. Mode 2 integrity protects every RTP packet, but only adds the ROC to packets where SEQ is divisible by R. Mode 1 with R set to one also integrity protects every packet, but it adds the ROC to each packet. Modes 1 and 2 MUST compute the MAC the same way as the pre-defined authentication transform for SRTP, which is HMAC-SHA1 🧚.
To comply with this spec, modes 1, 2, and 3 are all mandatory to implement. However, local policy gets to decide which modes are actually allowed 🫶.
4. Parameter Negotiation 🧚
RCC needs a few parameters signaled out of band 💜. The ones that have to be in place before the transform can be used are the integrity transform mode and the rate R at which the ROC gets transmitted. You can do this with, e.g., MIKEY [RFC3830] ✨.
To negotiate with MIKEY, three integrity transforms have been registered (RCCm1, RCCm2, and RCCm3, in Table 6.10.1.c of [RFC3830]), one for each of the three modes 🎀.
Table 1. Integrity transforms
SRTP auth alg | Value
--------------+------
RCCm1 | 2
RCCm2 | 3
RCCm3 | 4The parameter R was registered in Table 6.10.1.a of [RFC3830] too 🌈.
Table 2. Integrity transform parameter
Type | Meaning | Possible values
-----+-----------------------------+----------------
13 | ROC transmission rate | 16-bit integerThe ROC transmission rate, R, is given in network byte order. R MUST be a non-zero unsigned integer 🔥. If the ROC transmission rate isn't included in the negotiation, the default value of 1 SHALL be used 🍓.
RCC needs different integrity transforms for SRTP and SRTCP, so there are a few more parameters, registered in Table 6.10.1.a of [RFC3830] 💅:
Table 3. Integrity parameters
Type | Meaning | Possible values
-----+-----------------------------+----------------
14 | SRTP Auth. algorithm | see below
15 | SRTCP Auth. algorithm | see below
16 | SRTP Session Auth. key len | see below
17 | SRTCP Session Auth. key len | see below
18 | SRTP Authentication tag len | see below
19 | SRTCP Authentication tag len| see belowFor the authentication algorithms (types 14 and 15), the possible values are the same as the "Authentication algorithm" parameter (type 2) in Table 6.10.1.a of RFC 3830, plus the values from Table 1 above 🦋.
For the session authentication key lengths (types 16 and 17), the possible values match the "Session Auth. key length" parameter (type 3) in Table 6.10.1.a of RFC 3830 🌸.
For the authentication tag lengths (types 18 and 19), the possible values match the "Authentication tag length" parameter (type 11) in Table 6.10.1.a of RFC 3830, with one extra twist: the length of ROC MUST be included in the "Authentication tag length" parameter. So the minimum tag length with RCC is 32 bits 🫶.
To avoid confusion between these new parameters and the existing ones in Table 6.10.1.a of RFC 3830 (they overlap a lot, iykyk 🙈), the following approach MUST be taken. If any of the parameter types 14-19 (the SRTP- or SRTCP-specific ones) and a matching general parameter (type 2, 3, or 11) are both in the policy, the more specific parameter SHALL have precedence 👑. For example, if "Authentication algorithm" (type 2) is set to HMAC-SHA-1 and "SRTP Auth. Algorithm" (type 14) is set to RCCm1, SRTP uses RCCm1. But since nothing specific is chosen for SRTCP, SRTCP falls back to the more general one, HMAC-SHA-1 💖.
5. Security Considerations 🔥
okay bestie, this section is serious, so buckle up 😭. An analogous method already exists in SRTCP, where the SRTCP index is carried in each packet under integrity protection. To the best of our knowledge, the only new security consideration here is that the entire SRTP index (ROC || SEQ) becomes public, because it's sent without encryption. (Normally only the SEQ part of the index is disclosed.) That said, RFC 3711 doesn't identify any need to encrypt the SRTP index 🌈.
It's really important to get this: in mode 1, only every Rth packet is integrity protected. So unless R = 1, this mechanism should be seen for what it is, a way to improve sender-receiver synchronization, not a replacement for integrity protection 🚨.
Mode 3 (NULL-MAC) brings a vulnerability that RFC 3711 doesn't have. If an attacker modifies the ROC, the receiver won't detect it, and it'll lose cryptographic synchronization until the next correct ROC shows up. That means an attacker can DoS by only modifying every Rth packet 💀. Because of this, mode 3 MUST only be used after a proper risk assessment of the underlying network. On top of the considerations in Section 9.5 and 9.5.1 of RFC 3711, the underlying transport network must meet some additional requirements:
- The transport network must only consist of trusted domains. That means everyone on the path from source to destination is trusted not to modify or inject packets.
- The transport network must be protected from packet injection. In other words, the only packets on the path from source to destination(s) must come from trusted sources.
- If the packets travel outside a trusted domain on their way from source to destination(s), their integrity must be ensured (for example, with a Virtual Private Network (VPN) connection or a trusted leased line) 🔐.
In the (assumed common) case where the last link to the destination(s) is wireless, the chance that an attacker injects forged packets there must be carefully considered before using mode 3 📡. This is extra spicy in a broadcast setting, because lots of destinations would get hit by the attack. Still, unless R is big, this DoS attack would be a lot like radio jamming, which is easier to pull off anyway 🙄.
It's also worth noting that if an attacker modifies the ROC and there's no integrity protection, the decryption output won't be useful to the upper layers. Those layers have to be able to cope with data that looks random 🌀. When integrity protection is used on the packets carrying the ROC, and an attacker modifies the ROC (while the receiver already has an approximation of it, e.g. from getting it earlier), the packet gets discarded and the receiver can't decrypt correctly. But the situation is better in that case, since the receiver can try different ROC values in a neighborhood around the approximate value it already has ✨.
RCC is expected to be used in a broadcast setting, where group membership is based on access to a symmetric group key. So it's important to point out that with symmetric-key-based integrity protection, getting access to the integrity key may be just as easy, if not easier, than being able to transmit. That's often a combo of a cheap subscription and breaking the security of a terminal to extract the integrity key 😤.
A word of warning about choosing the authentication tag length 🚨: unlike common MAC tags, there's a clear distinction between the RCC authentication tag and the RCC MAC. The tag is the container that holds the MAC (and, for some packets, the ROC too), and the MAC is the output of the MAC algorithm (i.e., HMAC-SHA1). The RCC tag length includes the four-octet ROC in some packets. So for a tag length of n octets, there's only room for a MAC of length n - 4. A tag length of n octets does not give full n-octet integrity protection on all packets. There are five cases:
- RCCm1 is used and the tag length is n. For packets where SEQ = 0 mod R, the ROC is carried in the tag and occupies four octets. That leaves n - 4 octets for the MAC 🎀.
- RCCm1 is used and the tag length is n. For packets where SEQ != 0 mod R, there's no ROC in the tag. With RCCm1 there's no MAC on packets that don't carry the ROC, so neither the MAC length nor the tag length matters there 🌸.
- RCCm2 is used and the tag length is n. For packets where SEQ = 0 mod R, the ROC is carried in the tag and occupies four octets. That leaves n - 4 octets for the MAC (this is equivalent to case 1) 🦋.
- RCCm2 is used and the tag length is n. For packets where SEQ != 0 mod R, there's no ROC in the tag. That leaves n octets for the MAC 💖.
- RCCm3 is used. RCCm3 doesn't use any MAC, but the ROC still occupies four octets in the tag for packets where SEQ = 0 mod R, so the tag length MUST be set to four. For packets where SEQ != 0 mod R, neither the MAC length nor the tag length matters 🧚.
The conclusion is that in cases 1 and 3, the MAC is shorter than the authentication tag. To get the same (or lower) MAC forgery success probability on all packets with RCCm1 or RCCm2 as with the default integrity transform in RFC 3711, the tag length must be set to 14 octets. That means the length of MAC_tr is 10 octets 🌈.
It is recommended to set the tag length to 14 octets when RCCm1 or RCCm2 is used, and the tag length MUST be set to four octets when RCCm3 is used 👑.
6. IANA Considerations ✨
okay so IANA stuff 📋 According to Section 10 of RFC 3830, IETF consensus is required to register values in the range 0-240 in the SRTP auth alg namespace and the SRTP Type namespace. 🔒
the value 2 for RCCm1, the value 3 for RCCm2, and the value 4 for RCCm3 have been registered in the SRTP auth alg namespace, as specified in Table 1 in Section 4. 💜
the value 13 for ROC transmission rate has been registered in the SRTP Type namespace, as specified in Table 2 in Section 4. 🌸
the values 14 to 19 have been registered in the SRTP Type namespace according to Table 3 in Section 4. ✨
7. Acknowledgements 🫶
we would like to thank Nigel Dallard, Lakshminath Dondeti, and David McGrew for their fruitful comments and discussions. they were iconic 👑
8. References 📚
8.1. Normative References
[RFC3830] Arkko, J., Carrara, E., Lindholm, F., Naslund, M., and K.
Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830,
August 2004.
[RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K.
Norrman, "The Secure Real-time Transport Protocol (SRTP)",
RFC 3711, March 2004.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.8.2. Informative References
[MBMS] 3GPP TS 33.246, "3G Security; Security of Multimedia
Broadcast/ Multicast Service (MBMS)", October 2006.
[BCMCS] 3GPP2 X.S0022-0, "Broadcast and Multicast Service in
cdma2000 Wireless IP Network", February 2005.Authors' Addresses 💌
Vesa Lehtovirta
Ericsson Research
02420 Jorvas
Finland
Phone: +358 9 2993314
EMail: vesa.lehtovirta@ericsson.com
Mats Naslund
Ericsson Research
SE-16480 Stockholm
Sweden
Phone: +46 8 58533739
EMail: mats.naslund@ericsson.com
Karl Norrman
Ericsson Research
SE-16480 Stockholm
Sweden
Phone: +46 8 4044502
EMail: karl.norrman@ericsson.comFull Copyright Statement ©
Copyright (C) The IETF Trust (2007). 🌈
this document is subject to the rights, licenses and restrictions in BCP 78. except as set out there, the authors keep all their rights. 🦋
the document and the information in it are provided "AS IS". THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS, OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. no cap, that's a lot of disclaimers 💀
Intellectual Property 🔐
the IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to apply to the technology described in this document, or on whether any license under such rights might or might not be available. it also doesn't claim to have made any independent effort to find such rights. more on how RFC documents handle rights can be found in BCP 78 and BCP 79. 📜
copies of IPR disclosures made to the IETF Secretariat, and any assurances of licenses to be made available, or the result of an attempt to get a general license or permission for implementers or users to use these proprietary rights, can be found in the IETF online IPR repository at http://www.ietf.org/ipr. 🔗
the IETF invites any interested party to tell it about any copyrights, patents, patent applications, or other proprietary rights that may cover technology needed to implement this standard. please send that information to the IETF at ietf-ipr@ietf.org. 💖
Acknowledgement 🎀
funding for the RFC Editor function is currently provided by the Internet Society. ✨
📦 where this page comes from
- ietf: rfc4771 2007-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms