/* TODO:
* Useful stuff:
- * - ROC profil thingy (multicast really needs this)
+ * - ROC profile thingy (multicast really needs this)
* - replay protection
*
- * Requirements for conformance:
- * - suites with NULL cipher
- * - SRTCP
- *
* Useless stuff (because nothing depends on it):
* - non-nul key derivation rate
* - MKI payload
{
gcry_cipher_hd_t cipher;
gcry_md_hd_t mac;
+ uint64_t window;
uint32_t salt[4];
} srtp_proto_t;
/**
- * Allocates a Secure RTP session.
+ * Allocates a Secure RTP one-way session.
+ * The same session cannot be used both ways because this would confuse
+ * internal cryptographic counters; it is however of course feasible to open
+ * multiple simultaneous sessions with the same master key.
*
* @param name cipher-suite name
* @param kdr key derivation rate
- * @param winsize anti-replay windows size (between 64 and 32767 inclusive)
- * 0 disable replay attack protection (OK for send only)
* @param flags OR'ed optional flags.
*
* @return NULL in case of error
*/
srtp_session_t *
-srtp_create (const char *name, unsigned flags, unsigned kdr, uint16_t winsize)
+srtp_create (const char *name, unsigned flags, unsigned kdr)
{
assert (name != NULL);
if (kdr != 0)
return NULL; // FIXME: KDR not implemented yet
- if (winsize != 0)
- return NULL; // FIXME: replay protection not implemented yet
uint8_t tag_len;
int cipher = GCRY_CIPHER_AES, md = GCRY_MD_SHA1;
// F8_128_HMAC_SHA1_80 is not implemented
return NULL;
- if ((flags & ~SRTP_FLAGS_MASK) || (winsize > 32767) || init_libgcrypt ())
+ if ((flags & ~SRTP_FLAGS_MASK) || init_libgcrypt ())
return NULL;
srtp_session_t *s = malloc (sizeof (*s));
return 0;
}
-#include <stdio.h>
static int
proto_derive (srtp_proto_t *p, gcry_cipher_hd_t prf,
if (saltlen != 14)
return -1;
- uint32_t cipherkey[4], authkey[5];
+ uint8_t keybuf[20];
uint8_t label = rtcp ? SRTCP_CRYPT : SRTP_CRYPT;
- if (derive (prf, salt, r, rlen, label++, cipherkey, 16)
- || gcry_cipher_setkey (p->cipher, cipherkey, 16)
- || derive (prf, salt, r, rlen, label++, authkey, 20)
- || gcry_md_setkey (p->mac, authkey, 20)
- || derive (prf, salt, r, rlen, label++, p->salt, 14))
+ if (derive (prf, salt, r, rlen, label++, keybuf, 16)
+ || gcry_cipher_setkey (p->cipher, keybuf, 16)
+ || derive (prf, salt, r, rlen, label++, keybuf, 20)
+ || gcry_md_setkey (p->mac, keybuf, 20)
+ || derive (prf, salt, r, rlen, label, p->salt, 14))
return -1;
- debug (" cipher key: %08x%08x%08x%08x\n auth key: %08x%08x%08x%08x%08x\n",
- ntohl (cipherkey[0]), ntohl (cipherkey[1]), ntohl (cipherkey[2]),
- ntohl (cipherkey[3]), ntohl (authkey[0]), ntohl (authkey[1]),
- ntohl (authkey[2]), ntohl (authkey[3]), ntohl (authkey[4]));
-
return 0;
}
}
-
/**
* Sets (or resets) the master key and master salt for a SRTP session.
* This must be done at least once before using rtp_send(), rtp_recv(),
/** AES-CM encryption/decryption (ctr length = 16 bytes) */
static int
-encrypt (gcry_cipher_hd_t hd, uint32_t *ctr, uint8_t *data, size_t len)
+ctr_crypt (gcry_cipher_hd_t hd, uint32_t *ctr, uint8_t *data, size_t len)
{
const size_t ctrlen = 16;
while (len >= ctrlen)
/** AES-CM for RTP (salt = 14 bytes + 2 nul bytes) */
-static inline int
-rtp_encrypt (gcry_cipher_hd_t hd, uint32_t ssrc, uint32_t roc, uint16_t seq,
- const uint32_t *salt, uint8_t *data, size_t len)
+static int
+rtp_crypt (gcry_cipher_hd_t hd, uint32_t ssrc, uint32_t roc, uint16_t seq,
+ const uint32_t *salt, uint8_t *data, size_t len)
{
/* Determines cryptographic counter (IV) */
uint32_t counter[4];
counter[3] = salt[3] ^ htonl (seq << 16);
/* Encryption */
- return encrypt (hd, counter, data, len);
+ return ctr_crypt (hd, counter, data, len);
+}
+
+
+/** Determines SRTP Roll-Over-Counter (in host-byte order) */
+static uint32_t
+srtp_compute_roc (const srtp_session_t *s, uint16_t seq)
+{
+ uint32_t roc = s->rtp_roc;
+
+ if (((seq - s->rtp_seq) & 0xffff) < 0x8000)
+ {
+ /* Sequence is ahead, good */
+ if (seq < s->rtp_seq)
+ roc++; /* Sequence number wrap */
+ }
+ else
+ {
+ /* Sequence is late, bad */
+ if (seq > s->rtp_seq)
+ roc--; /* Wrap back */
+ }
+ return roc;
+}
+
+
+/** Returns RTP sequence (in host-byte order) */
+static inline uint16_t rtp_seq (const uint8_t *buf)
+{
+ return (buf[2] << 8) | buf[3];
}
/** Message Authentication and Integrity for RTP */
static const uint8_t *
-rtp_digest (gcry_md_hd_t md, const void *data, size_t len, uint32_t roc)
+rtp_digest (srtp_session_t *s, const uint8_t *data, size_t len)
{
+ const gcry_md_hd_t md = s->rtp.mac;
+ uint32_t roc = htonl (srtp_compute_roc (s, rtp_seq (data)));
+
gcry_md_reset (md);
gcry_md_write (md, data, len);
- gcry_md_write (md, &(uint32_t){ htonl (roc) }, 4);
+ gcry_md_write (md, &roc, 4);
return gcry_md_read (md, 0);
}
* (CTR block cypher mode of operation has identical encryption and
* decryption function).
*
- * @param buf RTP packet to be encrypted/digested
+ * @param buf RTP packet to be en-/decrypted
* @param len RTP packet length
*
* @return 0 on success, in case of error:
return EINVAL;
/* Determines RTP 48-bits counter and SSRC */
- uint32_t ssrc;
+ uint16_t seq = rtp_seq (buf);
+ uint32_t roc = srtp_compute_roc (s, seq), ssrc;
memcpy (&ssrc, buf + 8, 4);
- uint16_t seq = (buf[2] << 8) | buf[3];
- if (((seq - s->rtp_seq) & 0xffff) < 32768)
- {
- if (seq < s->rtp_seq)
- s->rtp_roc++; /* Sequence number wrap */
- }
+ /* Updates ROC and sequence (it's safe now) */
+ if (roc > s->rtp_roc)
+ s->rtp_seq = seq, s->rtp_roc = roc;
else
- {
- if (seq > s->rtp_seq)
- s->rtp_roc--;
- }
-
- s->rtp_seq = seq;
+ if (seq > s->rtp_seq)
+ s->rtp_seq = seq;
+ /* Encrypt/Decrypt */
if (s->flags & SRTP_UNENCRYPTED)
return 0;
- if (rtp_encrypt (s->rtp.cipher, ssrc, s->rtp_roc, seq, s->rtp.salt,
- buf + offset, len - offset))
+ if (rtp_crypt (s->rtp.cipher, ssrc, roc, seq, s->rtp.salt,
+ buf + offset, len - offset))
return EINVAL;
return 0;
if (val)
return val;
- if (s->flags & SRTP_UNAUTHENTICATED)
- return 0;
-
- if (bufsize < (len + s->tag_len))
- return ENOSPC;
+ if (!(s->flags & SRTP_UNAUTHENTICATED))
+ {
+ if (bufsize < (len + s->tag_len))
+ return ENOSPC;
- const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, s->rtp_roc);
- memcpy (buf + len, tag, s->tag_len);
- *lenp = len + s->tag_len;
+ const uint8_t *tag = rtp_digest (s, buf, len);
+ memcpy (buf + len, tag, s->tag_len);
+ *lenp = len + s->tag_len;
+ }
return 0;
}
* then decrypts it.
*
* @param buf RTP packet to be digested/decrypted
- * @param lenp pointer to the RTP packet length on entry,
- * set to the SRTP length on exit (undefined in case of error)
+ * @param lenp pointer to the SRTP packet length on entry,
+ * set to the RTP length on exit (undefined in case of error)
*
* @return 0 on success, in case of error:
* EINVAL malformatted SRTP packet
srtp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp)
{
size_t len = *lenp;
+ /* FIXME: anti-replay */
if (!(s->flags & SRTP_UNAUTHENTICATED))
{
- if (len < s->tag_len)
+ if (len < (12u + s->tag_len))
return EINVAL;
len -= s->tag_len;
- *lenp = len;
- const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, s->rtp_roc);
- debug (" Auth tag: %08x%08x%04x (wanted)\n"
- " Auth tag: %08x%08x%04x (recv'd)\n",
- ntohl (((uint32_t *)tag)[0]), ntohl (((uint32_t *)tag)[1]),
- ntohs (((uint16_t *)tag)[4]),
- ntohl (((uint32_t *)w)[0]), ntohl (((uint32_t *)w)[1]),
- ntohs (((uint16_t *)w)[4]));
+ const uint8_t *tag = rtp_digest (s, buf, len);
if (memcmp (buf + len, tag, s->tag_len))
return EACCES;
+
+ *lenp = len;
}
- /* FIXME: anti-replay */
+ return srtp_crypt (s, buf, len);
+}
+
+
+/** AES-CM for RTCP (salt = 14 bytes + 2 nul bytes) */
+static int
+rtcp_crypt (gcry_cipher_hd_t hd, uint32_t ssrc, uint32_t index,
+ const uint32_t *salt, uint8_t *data, size_t len)
+{
+ return rtp_crypt (hd, ssrc, index >> 16, index & 0xffff, salt, data, len);
+}
+
+
+/** Message Authentication and Integrity for RTCP */
+static const uint8_t *
+rtcp_digest (gcry_md_hd_t md, const void *data, size_t len)
+{
+ gcry_md_reset (md);
+ gcry_md_write (md, data, len);
+ return gcry_md_read (md, 0);
+}
+
+
+/**
+ * Encrypts/decrypts a RTCP packet and updates SRTCP context
+ * (CTR block cypher mode of operation has identical encryption and
+ * decryption function).
+ *
+ * @param buf RTCP packet to be en-/decrypted
+ * @param len RTCP packet length
+ *
+ * @return 0 on success, in case of error:
+ * EINVAL malformatted RTCP packet
+ */
+static int srtcp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
+{
+ assert (s != NULL);
+
+ /* 8-bytes unencrypted header, and 4-bytes unencrypted footer */
+ if ((len < 12) || ((buf[0] >> 6) != 2))
+ return EINVAL;
+
+ uint32_t index = s->rtcp_index++;
+ if (index == 0x7fffffff)
+ s->rtcp_index = 0; /* 31-bit wrap */
+
+ if (s->flags & SRTCP_UNENCRYPTED)
+ return 0;
+
+ uint32_t ssrc;
+ memcpy (&ssrc, buf + 4, 4);
+
+ if (rtcp_crypt (s->rtcp.cipher, ssrc, index, s->rtp.salt,
+ buf + 8, len - 8))
+ return EINVAL;
+ return 0;
+}
+
+
+/**
+ * Turns a RTCP packet into a SRTCP packet: encrypt it, then computes
+ * the authentication tag and appends it.
+ *
+ * @param buf RTCP packet to be encrypted/digested
+ * @param lenp pointer to the RTCP packet length on entry,
+ * set to the SRTCP length on exit (undefined in case of error)
+ * @param bufsize size (bytes) of the packet buffer
+ *
+ * @return 0 on success, in case of error:
+ * EINVAL malformatted RTCP packet or internal error
+ * ENOSPC bufsize is too small (to add index and authentication tag)
+ */
+int
+srtcp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t bufsize)
+{
+ size_t len = *lenp;
+ if (bufsize < (len + 4 + s->tag_len))
+ return ENOSPC;
+
+ uint32_t index = s->rtcp_index;
+ if ((s->flags & SRTCP_UNENCRYPTED) == 0)
+ index |= 0x80000000; /* Set Encrypted bit */
+ memcpy (buf + len, &(uint32_t){ htonl (index) }, 4);
+
+ int val = srtcp_crypt (s, buf, len);
+ if (val)
+ return val;
+
+ len += 4; /* Digest SRTCP index too */
+
+ const uint8_t *tag = rtcp_digest (s->rtp.mac, buf, len);
+ memcpy (buf + len, tag, s->tag_len);
+ *lenp = len + s->tag_len;
+ s->rtcp_index++; /* Update index */
+ return 0;
+}
+
+
+/**
+ * Turns a SRTCP packet into a RTCP packet: authenticates the packet,
+ * then decrypts it.
+ *
+ * @param buf RTCP packet to be digested/decrypted
+ * @param lenp pointer to the SRTCP packet length on entry,
+ * set to the RTCP length on exit (undefined in case of error)
+ *
+ * @return 0 on success, in case of error:
+ * EINVAL malformatted SRTCP packet
+ * EACCES authentication failed (spoofed packet or out-of-sync)
+ */
+int
+srtcp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp)
+{
+ size_t len = *lenp;
+ /* FIXME: anti-replay ?? */
+
+ if (len < (4u + s->tag_len))
+ return EINVAL;
+ len -= s->tag_len;
+
+ const uint8_t *tag = rtcp_digest (s->rtp.mac, buf, len);
+ if (memcmp (buf + len, tag, s->tag_len))
+ return EACCES;
+
+ len -= 4; /* Remove SRTCP index before decryption */
+ uint32_t index;
+ memcpy (&index, buf + len, 4);
+ index = ntohl (index);
+ if (((index - s->rtcp_index) & 0xffffffff) < 0x80000000)
+ s->rtcp_index = index; /* Update index */
+ *lenp = len;
return srtp_crypt (s, buf, len);
}
projects / vlc / blobdiff