RFC 6188
The Use of AES-192 and AES-256 in Secure RTP
RFC 6188 🎀 The Use of AES-192 and AES-256 in Secure RTP
Okay bestie, here's the title block tea ☕: this doc came from the IETF (Internet Engineering Task Force) and was written by D. McGrew at Cisco Systems, Inc. 💅 It's a Standards Track document, dated March 2011, with ISSN 2070-1721. Its number is RFC 6188. There's no "Obsoletes" or "Updates" line in the header, so it doesn't list any older RFCs it replaces or changes. 🦋
Abstract
This memo is all about using AES (the Advanced Encryption Standard) with 192- and 256-bit keys inside Secure RTP (SRTP) 🔐. It covers counter mode encryption for SRTP and Secure Realtime Transport Control Protocol (SRTCP), plus a brand-new SRTP Key Derivation Function (KDF) for AES-192 and AES-256 ✨.
Status of This Memo
This is an Internet Standards Track document 🌸
This doc is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 5741 📚
Info about the current status of this document, any errata, and how to give feedback can be found at http://www.rfc-editor.org/info/rfc6188 💜
Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. ©️
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please review these docs carefully, because they spell out your rights and restrictions for this document 🧾 Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License.
Table of Contents
1. Introduction ....................................................3
1.1. Conventions Used in This Document ..........................3
2. AES-192 and AES-256 Encryption ..................................3
3. The AES_192_CM_PRF and AES_256_CM_PRF Key Derivation Functions ..4
3.1. Usage Requirements .........................................5
4. Crypto Suites ...................................................6
5. IANA Considerations .............................................9
6. Security Considerations .........................................9
7. Test Cases .....................................................10
7.1. AES-256-CM Test Cases .....................................10
7.2. AES_256_CM_PRF Test Cases .................................11
7.3. AES-192-CM Test Cases .....................................13
7.4. AES_192_CM_PRF Test Cases .................................13
8. Acknowledgements ...............................................15
9. References .....................................................15
9.1. Normative References ......................................15
9.2. Informative References ....................................151. Introduction 🌈
Okay so this memo is about using AES [FIPS197] with 192- and 256-bit keys inside SRTP [RFC3711]. We're calling those block ciphers AES-192 and AES-256, and AES with a 128-bit key is AES-128. The doc describes counter mode encryption for SRTP and SRTCP, plus the right SRTP key derivation functions for AES-192 and AES-256. It also defines new crypto suites that use those new functions 🦋
AES-128 is widely seen as more than adequately secure, ngl 💪 But some people might want AES-192 or AES-256 because they're going for a super conservative security strategy. For example, the Suite B profile requires AES-256 to protect TOP SECRET info [suiteB]. (Quick note: the AES-192 and AES-256 encryption methods here use Suite B algorithms, but the crypto suites in this doc use HMAC-SHA-1, which isn't in Suite B 🙈) See Section 6 for more on security issues.
The crypto functions here are an addition to the crypto functions in [RFC3711], not a replacement for them 🫶
1.1. Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 📖
2. AES-192 and AES-256 Encryption 💖
Section 4.1.1 of [RFC3711] defines AES counter mode encryption, which it calls AES_CM. That definition works for all of the AES key sizes 🔑 Here, AES-192 counter mode and AES-256 counter mode are denoted AES_192_CM and AES_256_CM. In both ciphers, the plaintext inputs to the block cipher are formed the same way as in AES_CM, and the block cipher outputs get processed the same way as in AES_CM too. The only difference is that AES_192_CM uses AES-192, and AES_256_CM uses AES-256. Both AES_192_CM and AES_256_CM use a 112-bit salt as an input, just like AES_CM does 🧂
For the convenience of the reader (aka me, making sure you're following along 🙈), here's Figure 1, which shows the structure of the counter blocks in SRTP counter mode encryption. It uses the terminology from Section 4.1.1 of [RFC3711]. The (+) symbol means bitwise exclusive-or, and the AES encrypt operation uses AES-128, AES-192, or AES-256 for AES_CM, AES_192_CM, and AES_256_CM, respectively. The field labeled b_c is a block counter, and its value goes up once for each invocation of the "AES Encrypt" function. The SSRC field is part of the RTP header [RFC3550] 🎀
one octet
<-->
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|00|00|00|00| SSRC | packet index | b_c |---+
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
|
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ v
| salt (k_s) |00|00|->(+)
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
|
v
+-------------+
encryption key (k_e) -> | AES encrypt |
+-------------+
|
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| keystream block |<--+
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
Figure 1: AES Counter Mode3. The AES_192_CM_PRF and AES_256_CM_PRF Key Derivation Functions 🧚
Section 4.3.3 of [RFC3711] defines an AES counter mode key derivation function, which it calls AES_CM PRF (and sometimes AES-CM PRF) 🌸 That spec uses the term PRF, or pseudo-random function, interchangeably with "key derivation function." This KDF can be used with any AES key size. In this note, the AES-192 counter mode PRF and the AES-256 counter mode PRF are denoted AES_192_CM_PRF and AES_256_CM_PRF. In both PRFs, the plaintext inputs to the block cipher are formed the same way as in the AES_CM PRF, and the block cipher outputs are processed the same way too. The only difference is that AES_192_CM_PRF uses AES-192, and AES_256_CM_PRF uses AES-256. Both use a 112-bit salt as an input, just like the AES_CM PRF 🧂
Figure 2 is here to help, showing the structure of the counter blocks in SRTP counter mode key derivation, using the terminology from Section 4.3.3 of [RFC3711]. Again, (+) means bitwise exclusive-or, and the "AES Encrypt" operation uses AES-128, AES-192, or AES-256 for the AES_CM PRF, AES_192_CM_PRF, and AES_256_CM_PRF, respectively. The field "LB" holds the 8-bit constant "label," which is an input to the KDF and is different for each type of key the function generates. The b_c field is a block counter that goes up once for each invocation of the "AES Encrypt" function. The DIV operation is defined in Section 4.3.1 of [RFC3711] like this: let "a DIV t" mean integer division of a by t, rounded down, with the convention that "a DIV 0 = 0" for all a. We also treat "a DIV t" as a bit string of the same length as a, so "a DIV t" will generally have leading zeros 🤓
one octet
<-->
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|00|00|00|00|00|00|00|LB| index DIV kdr | b_c |---+
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
|
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ v
| master salt |00|00|->(+)
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
|
v
+-------------+
master key -> | AES encrypt |
+-------------+
|
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |
| output block |<--+
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
Figure 2: The AES Counter Mode Key Derivation Function3.1. Usage Requirements 🚦
When AES_192_CM is used for encryption, AES_192_CM_PRF SHOULD be used as the key derivation function, and AES_128_CM_PRF MUST NOT be used as the key derivation function. 👑
When AES_256_CM is used for encryption, AES_256_CM_PRF SHOULD be used as the key derivation function. Both AES_128_CM_PRF and AES_192_CM_PRF MUST NOT be used as the key derivation function. 💅
AES_256_CM_PRF MAY be used as the key derivation function when AES_CM is used for encryption, and when AES_192_CM is used for encryption. AES_192_CM_PRF MAY be used as the key derivation function when AES_CM is used for encryption. ✨
Rationale: it is essential that the cryptographic strength of the key derivation meets or exceeds that of the encryption method. It is natural to use the same function for both encryption and key derivation. However, it is not required to do so, because it is desirable to allow these ciphers to be used with alternative key derivation functions that may be defined in the future. 🦋
4. Crypto Suites ✨
Okay bestie, this section is where we define the SRTP crypto suites that use the ciphers and key derivation functions from this document 💖 The parameters live in Section 8.2 of [RFC3711]. These suites are registered with IANA for use with the SDP Security Descriptions attributes (Section 10.3.2.1 of [RFC4568]). Other SRTP key management methods that use the crypto functions from this document are encouraged to use these suite definitions too 🫶
Rationale: the suites use the same authentication function that every SRTP implementation is required to support, HMAC-SHA1 with a 160-bit key 🔐 HMAC-SHA1 would accept bigger keys, but once you go past 160 bits it doesn't give you any cryptanalysis resistance beyond that level, because it only has 160 bits of internal state 🙈 So by keeping the authentication keys at 160 bits, these suites play nicer with existing crypto suites and implementations. Iconic compatibility energy 👑
Here are the four suites, with all their parameters laid out.
+------------------------------+------------------------------------+
| Parameter | Value |
+------------------------------+------------------------------------+
| Master key length | 192 bits |
| Master salt length | 112 bits |
| Key Derivation Function | AES_192_CM_PRF (Section 3) |
| Default key lifetime | 2^31 packets |
| Cipher (for SRTP and SRTCP) | AES_192_CM (Section 2) |
| SRTP authentication function | HMAC-SHA1 (Section 4.2.1 of |
| | [RFC3711]) |
| SRTP authentication key | 160 bits |
| length | |
| SRTP authentication tag | 80 bits |
| length | |
| SRTCP authentication | HMAC-SHA1 (Section 4.2.1 of |
| function | [RFC3711]) |
| SRTCP authentication key | 160 bits |
| length | |
| SRTCP authentication tag | 80 bits |
| length | |
+------------------------------+------------------------------------+
Table 1: The AES_192_CM_HMAC_SHA1_80 Crypto Suite+------------------------------+------------------------------------+
| Parameter | Value |
+------------------------------+------------------------------------+
| Master key length | 192 bits |
| Master salt length | 112 bits |
| Key Derivation Function | AES_192_CM_PRF (Section 3) |
| Default key lifetime | 2^31 packets |
| Cipher (for SRTP and SRTCP) | AES_192_CM (Section 2) |
| SRTP authentication function | HMAC-SHA1 (Section 4.2.1 of |
| | [RFC3711]) |
| SRTP authentication key | 160 bits |
| length | |
| SRTP authentication tag | 32 bits |
| length | |
| SRTCP authentication | HMAC-SHA1 (Section 4.2.1 of |
| function | [RFC3711]) |
| SRTCP authentication key | 160 bits |
| length | |
| SRTCP authentication tag | 80 bits |
| length | |
+------------------------------+------------------------------------+
Table 2: The AES_192_CM_HMAC_SHA1_32 Crypto Suite+------------------------------+------------------------------------+
| Parameter | Value |
+------------------------------+------------------------------------+
| Master key length | 256 bits |
| Master salt length | 112 bits |
| Key Derivation Function | AES_256_CM_PRF (Section 3) |
| Default key lifetime | 2^31 packets |
| Cipher (for SRTP and SRTCP) | AES_256_CM (Section 2) |
| SRTP authentication function | HMAC-SHA1 (Section 4.2.1 of |
| | [RFC3711]) |
| SRTP authentication key | 160 bits |
| length | |
| SRTP authentication tag | 80 bits |
| length | |
| SRTCP authentication | HMAC-SHA1 (Section 4.2.1 of |
| function | [RFC3711]) |
| SRTCP authentication key | 160 bits |
| length | |
| SRTCP authentication tag | 80 bits |
| length | |
+------------------------------+------------------------------------+
Table 3: The AES_256_CM_HMAC_SHA1_80 Crypto Suite+------------------------------+------------------------------------+
| Parameter | Value |
+------------------------------+------------------------------------+
| Master key length | 256 bits |
| Master salt length | 112 bits |
| Key Derivation Function | AES_256_CM_PRF (Section 3) |
| Default key lifetime | 2^31 packets |
| Cipher (for SRTP and SRTCP) | AES_256_CM (Section 2) |
| SRTP authentication function | HMAC-SHA1 (Section 4.2.1 of |
| | [RFC3711]) |
| SRTP authentication key | 160 bits |
| length | |
| SRTP authentication tag | 32 bits |
| length | |
| SRTCP authentication | HMAC-SHA1 (Section 4.2.1 of |
| function | [RFC3711]) |
| SRTCP authentication key | 160 bits |
| length | |
| SRTCP authentication tag | 80 bits |
| length | |
+------------------------------+------------------------------------+
Table 4: The AES_256_CM_HMAC_SHA1_32 Crypto Suite5. IANA Considerations 🌸
IANA has assigned the following parameters in the Session Description Protocol (SDP) Security Descriptions registry 🦋
+-------------------------+-----------+
| Crypto Suite Name | Reference |
+-------------------------+-----------+
| AES_192_CM_HMAC_SHA1_80 | [RFC6188] |
| AES_192_CM_HMAC_SHA1_32 | [RFC6188] |
| AES_256_CM_HMAC_SHA1_80 | [RFC6188] |
| AES_256_CM_HMAC_SHA1_32 | [RFC6188] |
+-------------------------+-----------+6. Security Considerations 🔐
Okay this section is seriously important, so pay attention 👀 AES-128 gives a level of security that's widely seen as more than enough for confidentiality 💅 It's believed that the economic cost of breaking AES-128 is way higher than the cost of more direct approaches to violating system security, like theft, bribery, wiretapping, and other forms of malfeasance 🙅♀️
Future advances in state-of-the-art cryptanalysis could wreck this confidence in AES-128 and motivate the use of AES-192 or AES-256 😭 AES-192 is regarded as secure even against some adversaries for which breaking AES-128 may be feasible. Similarly, AES-256 is regarded as secure even against some adversaries for which it may be feasible to break AES-192. The bigger key size versions of AES give you a fallback plan in case of unanticipated cryptanalytic results 🛟
It is conjectured that AES-256 provides adequate security even against adversaries that could build a quantum computer working on 256 or more quantum bits 🌌 No such computer is known to exist, and whether it's feasible is an area of active speculation and research 🧪
Despite AES-128 being apparently sufficient, some users are still interested in the bigger AES key sizes 👑 For some applications, the 40% increase in computational cost for AES-256 over AES-128 is a worthwhile bargain for the security advantages above 💖 These include applications with a perceived need for very high security, e.g., due to a desire for very long-term confidentiality ⏳
Key point: AES-256 (as it's used in this note) provides the highest level of security, and it SHOULD be used whenever the highest possible security is desired 🔥 AES-192 is the middle ground between the 128-bit and 256-bit versions of AES, and it MAY be used when security higher than AES-128 is desired 🍓 In this note, AES-192 and AES-256 are used with keys generated from a strong pseudo-random source, so the related-key attacks described in the theoretical literature don't apply 🦋
As with any cipher, the conjectured security level of AES may change over time 🌈 The considerations in this section reflect the best knowledge available at the time this document was published 📚
It is desirable that AES_192_CM and AES_192_CM_PRF be used with an authentication function that uses a 192-bit key, and that AES_256_CM and AES_256_CM_PRF be used with an authentication function that uses a 256-bit key 🎀 However, this desire is not regarded as security critical 🙈 Cryptographic authentication is resilient against future advances in cryptanalysis, since the opportunity for a forgery attack against a session closes when that session closes ✨ For this reason, this note defines new ciphers, but not new authentication functions 💜
7. Test Cases 🧪
The test cases in this section are based on Appendix B of [RFC3711] 🫶
7.1. AES-256-CM Test Cases 🎀
Okay bestie, these are the AES-256-CM keystream test vectors, and they are giving pure precision. 💅 Here's the setup, the keystream segment length, the session key, and the counter values we're starting from:
Keystream segment length: 1044512 octets (65282 AES blocks)
Session Key: 57f82fe3613fd170a85ec93c40b1f092
2ec4cb0dc025b58272147cc438944a98
Rollover Counter: 00000000
Sequence Number: 0000
SSRC: 00000000
Session Salt: f0f1f2f3f4f5f6f7f8f9fafbfcfd0000 (already shifted)
Offset: f0f1f2f3f4f5f6f7f8f9fafbfcfd0000
Counter Keystream
f0f1f2f3f4f5f6f7f8f9fafbfcfd0000 92bdd28a93c3f52511c677d08b5515a4
f0f1f2f3f4f5f6f7f8f9fafbfcfd0001 9da71b2378a854f67050756ded165bac
f0f1f2f3f4f5f6f7f8f9fafbfcfd0002 63c4868b7096d88421b563b8c94c9a31
... ...
f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff cea518c90fd91ced9cbb18c078a54711
f0f1f2f3f4f5f6f7f8f9fafbfcfdff00 3dbc4814f4da5f00a08772b63c6a046d
f0f1f2f3f4f5f6f7f8f9fafbfcfdff01 6eb246913062a16891433e97dd01a57f7.2. AES_256_CM_PRF Test Cases ✨
Okay so this section is the test data for the AES_256_CM_PRF key derivation function, which runs AES-256 in counter mode. 🦋 We're walking through the initial key derivation, and it makes three things: a 32-octet session encryption key, a 14-octet session salt, and a 20-octet session authentication key for HMAC-SHA1. We call these the cipher key, the cipher salt, and the auth key. Since this is the initial derivation and the key derivation rate is zero, (index DIV key_derivation_rate) is zero, which is a six-octet string of zeros. From here on I'm shortening key_derivation_rate to kdr, bestie. 🌸
The inputs are the 32-octet master key and the 14-octet master salt:
master key: f0f04914b513f2763a1b1fa130f10e29
98f6f6e43e4309d1e622a0e332b9f1b6
master salt: 3b04803de51ee7c96423ab5b78d2First up is the cipher key. The input block for AES-256-CM comes from XORing the master salt with the encryption key label 0x00 concatenated with (index DIV kdr), then padding two null octets on the right. That padding is the multiply-by-2^16 step (see Section 4.3.3 of RFC 3711). Then we AES-256-CM-encrypt that value with the master key to get the cipher key. 💖
index DIV kdr: 000000000000
label: 00
master salt: 3b04803de51ee7c96423ab5b78d2
-----------------------------------------------
xor: 3b04803de51ee7c96423ab5b78d2 (x, PRF input)
x*2^16: 3b04803de51ee7c96423ab5b78d20000 (AES-256-CM input)
x*2^16 + 1: 3b04803de51ee7c96423ab5b78d20001 (2nd AES input)
cipher key: 5ba1064e30ec51613cad926c5a28ef73 (1st AES output)
1ec7fb397f70a960653caf06554cd8c4 (2nd AES output)Next, the cipher salt. Same idea: XOR the master salt with the encryption salt label, pad, and encrypt just like before. 🧚
index DIV kdr: 000000000000
label: 02
master salt: 3b04803de51ee7c96423ab5b78d2
----------------------------------------------
xor: 3b04803de51ee7cb6423ab5b78d2 (x, PRF input)
x*2^16: 3b04803de51ee7cb6423ab5b78d20000 (AES-256-CM input)
fa31791685ca444a9e07c6c64e93ae6b (AES-256 ouptut)
cipher salt: fa31791685ca444a9e07c6c64e93Now the auth key, which uses the authentication key label and is generated the same way. 🔥
index DIV kdr: 000000000000
label: 01
master salt: 3b04803de51ee7c96423ab5b78d2
-----------------------------------------------
xor: 3b04803de51ee7c86423ab5b78d2 (x, PRF input)
x*2^16: 3b04803de51ee7c86423ab5b78d20000 (AES-256-CM in)Below, the AES-256 output blocks that make up the auth key are on the left, and the matching AES-256 input blocks are on the right. Heads up: the final AES-256 output gets truncated to a 4-byte length, so the auth key is the full output plus the truncated tail. ⭐ Here's the final auth key:
auth key blocks AES-256 input blocks
fd9c32d39ed5fbb5a9dc96b30818454d 3b04803de51ee7c86423ab5b78d20000
1313dc05 3b04803de51ee7c86423ab5b78d20001
auth key: fd9c32d39ed5fbb5a9dc96b30818454d1313dc057.3. AES-192-CM Test Cases 🌈
Next up, the AES-192-CM keystream test vectors. 💜 Same setup as before, just with a different session key:
Keystream segment length: 1044512 octets (65282 AES blocks)
Session Key: eab234764e517b2d3d160d587d8c8621
9740f65f99b6bcf7
Rollover Counter: 00000000
Sequence Number: 0000
SSRC: 00000000
Session Salt: f0f1f2f3f4f5f6f7f8f9fafbfcfd0000 (already shifted)
Offset: f0f1f2f3f4f5f6f7f8f9fafbfcfd0000
Counter Keystream
f0f1f2f3f4f5f6f7f8f9fafbfcfd0000 35096cba4610028dc1b57503804ce37c
f0f1f2f3f4f5f6f7f8f9fafbfcfd0001 5de986291dcce161d5165ec4568f5c9a
f0f1f2f3f4f5f6f7f8f9fafbfcfd0002 474a40c77894bc17180202272a4c264d
... ...
f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff d108d1a31a00bad6367ec23eb044b415
f0f1f2f3f4f5f6f7f8f9fafbfcfdff00 c8f57129fdeb970b59f917b257662d4c
f0f1f2f3f4f5f6f7f8f9fafbfcfdff01 a5dab625811034e8cebdfeb6dc158dd37.4. AES_192_CM_PRF Test Cases 🦋
This section is the test data for the AES_192_CM_PRF key derivation function, which runs AES-192 in counter mode. 🫶 Same deal as 7.2: we derive a 24-octet session encryption key, a 14-octet session salt, and a 20-octet HMAC-SHA1 session authentication key. Those get called the cipher key, the cipher salt, and the auth key. It's the initial derivation with a key derivation rate of zero, so (index DIV key_derivation_rate) is a six-octet string of zeros, and kdr is the short name again. 🎀
The inputs are the 24-octet master key and the 14-octet master salt:
master key: 73edc66c4fa15776fb57f9505c171365
50ffda71f3e8e5f1
master salt: c8522f3acd4ce86d5add78edbb11First, the cipher key. The input block for AES-192-CM comes from XORing the master salt with the encryption key label 0x00 concatenated with (index DIV kdr), then padding two null octets on the right. That's the multiply-by-2^16 operation (see Section 4.3.3 of RFC 3711). Then the value is AES-192-CM encrypted with the master key to get the cipher key. 💅
index DIV kdr: 000000000000
label: 00
master salt: c8522f3acd4ce86d5add78edbb11
-----------------------------------------------
xor: c8522f3acd4ce86d5add78edbb11 (x, PRF input)
x*2^16: c8522f3acd4ce86d5add78edbb110000 (AES-192-CM input)
x*2^16 + 1: c8522f3acd4ce86d5add78edbb110001 (2nd AES input)
cipher key: 31874736a8f1143870c26e4857d8a5b2 (1st AES output)
c4a354407faadabb (2nd AES output)Next, the cipher salt. Same routine: XOR with the encryption salt label, pad, and encrypt. 🌸
index DIV kdr: 000000000000
label: 02
master salt: c8522f3acd4ce86d5add78edbb11
----------------------------------------------
xor: c8522f3acd4ce86f5add78edbb11 (x, PRF input)
x*2^16: c8522f3acd4ce86f5add78edbb110000 (AES-192-CM input)
2372b82d639b6d8503a47adc0a6c2590 (AES-192 ouptut)
cipher salt: 2372b82d639b6d8503a47adc0a6cNow the auth key, generated the same way but using the authentication key label. 🧚
index DIV kdr: 000000000000
label: 01
master salt: c8522f3acd4ce86d5add78edbb11
-----------------------------------------------
xor: c8522f3acd4ce86c5add78edbb11 (x, PRF input)
x*2^16: c8522f3acd4ce86c5add78edbb110000 (AES-192-CM in)Below, the AES-192 output blocks that form the auth key are on the left, and the matching AES-192 input blocks are on the right. Note that the final AES-192 output gets truncated to a four-byte length. ✨ Here's the final auth key:
auth key blocks AES-192 input blocks
355b10973cd95b9eacf4061c7e1a7151 c8522f3acd4ce86c5add78edbb110000
e7cfbfcb c8522f3acd4ce86c5add78edbb110001
auth key: 355b10973cd95b9eacf4061c7e1a7151e7cfbfcb8. Acknowledgements 🫶
Thanks are due to John Mattsson for verifying the test cases in the document and providing comments, to Bob Bell for feedback and encouragement, and to Richard Barnes and Hilarie Orman for constructive review. 💖 Honestly, the people who check the math are the real MVPs. 👑
9. References 📚
9.1. Normative References
[FIPS197] "The Advanced Encryption Standard (AES)", FIPS-197 Federal Information Processing Standard.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V. Jacobson, "RTP: A Transport Protocol for Real-Time Applications", STD 64, RFC 3550, July 2003.
[RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K. Norrman, "The Secure Real-time Transport Protocol (SRTP)", RFC 3711, March 2004.
[RFC4568] Andreasen, F., Baugher, M., and D. Wing, "Session Description Protocol (SDP) Security Descriptions for Media Streams", RFC 4568, July 2006.
9.2. Informative References
[suiteB] "Suite B Cryptography", http://www.nsa.gov/ia/programs/suiteb_cryptography/index.shtml.
Author's Address 💜
David A. McGrew Cisco Systems, Inc. 510 McCarthy Blvd. Milpitas, CA 95035 US
Phone: (408) 525 8651 EMail: mcgrew@cisco.com URI: http://www.mindspring.com/~dmcgrew/dam.htm
📦 where this page comes from
- ietf: rfc6188 2011-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms