uint32_t rtcp_index;
uint32_t rtp_roc;
uint16_t rtp_seq;
+ uint16_t rtp_rcc;
uint8_t tag_len;
};
SRTCP_SALT
};
+
#ifdef WIN32
# include <winsock2.h>
#else
* internal cryptographic counters; it is however of course feasible to open
* multiple simultaneous sessions with the same master key.
*
- * @param name cipher-suite name
- * @param kdr key derivation rate
+ * @param encr encryption algorithm number
+ * @param auth authentication algortihm number
+ * @param tag_len authentication tag byte length (NOT including RCC)
* @param flags OR'ed optional flags.
*
* @return NULL in case of error
*/
srtp_session_t *
-srtp_create (const char *name, unsigned flags, unsigned kdr)
+srtp_create (int encr, int auth, unsigned tag_len, int prf, unsigned flags)
{
- assert (name != NULL);
+ if ((flags & ~SRTP_FLAGS_MASK) || init_libgcrypt ())
+ return NULL;
+
+ int cipher, md;
+ switch (encr)
+ {
+ case SRTP_ENCR_NULL:
+ cipher = GCRY_CIPHER_NONE;
+ break;
- if (kdr != 0)
- return NULL; // FIXME: KDR not implemented yet
+ case SRTP_ENCR_AES_CM:
+ cipher = GCRY_CIPHER_AES;
+ break;
- uint8_t tag_len;
- int cipher = GCRY_CIPHER_AES, md = GCRY_MD_SHA1;
+ default:
+ return NULL;
+ }
- if (strcmp (name, "AES_CM_128_HMAC_SHA1_80") == 0)
- tag_len = 10;
- else
- if (strcmp (name, "AES_CM_128_HMAC_SHA1_32") == 0)
- tag_len = 4;
- else
- // F8_128_HMAC_SHA1_80 is not implemented
+ switch (auth)
+ {
+ case SRTP_AUTH_NULL:
+ md = GCRY_MD_NONE;
+ break;
+
+ case SRTP_AUTH_HMAC_SHA1:
+ md = GCRY_MD_SHA1;
+ break;
+
+ default:
+ return NULL;
+ }
+
+ if (tag_len > gcry_md_get_algo_dlen (auth))
return NULL;
- if ((flags & ~SRTP_FLAGS_MASK) || init_libgcrypt ())
+ if (prf != SRTP_PRF_AES_CM)
return NULL;
srtp_session_t *s = malloc (sizeof (*s));
memset (s, 0, sizeof (*s));
s->flags = flags;
- s->kdr = kdr;
s->tag_len = tag_len;
if (proto_create (&s->rtp, cipher, md) == 0)
}
+/**
+ * Counter Mode encryption/decryption (ctr length = 16 bytes)
+ * with non-padded (truncated) text
+ */
+static int
+ctr_crypt (gcry_cipher_hd_t hd, const void *ctr, uint8_t *data, size_t len)
+{
+ const size_t ctrlen = 16;
+ div_t d = div (len, ctrlen);
+
+ if (gcry_cipher_setctr (hd, ctr, ctrlen)
+ || gcry_cipher_encrypt (hd, data, d.quot * ctrlen, NULL, 0))
+ return -1;
+
+ if (d.rem)
+ {
+ /* Truncated last block */
+ uint8_t dummy[ctrlen];
+ data += d.quot * ctrlen;
+ memcpy (dummy, data, d.rem);
+ memset (dummy + d.rem, 0, ctrlen - d.rem);
+
+ if (gcry_cipher_encrypt (hd, dummy, ctrlen, data, ctrlen))
+ return -1;
+ memcpy (data, dummy, d.rem);
+ }
+
+ return 0;
+}
+
+
/**
* AES-CM key derivation (saltlen = 14 bytes)
*/
for (size_t i = 0; i < rlen; i++)
iv[sizeof (iv) - rlen + i] ^= r[i];
- /* TODO: retry with CTR mode */
- while (outlen >= sizeof (iv))
- {
- /* AES */
- if (gcry_cipher_encrypt (prf, out, sizeof (iv), iv, sizeof (iv)))
- return EINVAL;
- outlen -= sizeof (iv);
- out = ((uint8_t *)out) + sizeof (iv);
-
- /* Increment IV in network byte order */
- if (++iv[sizeof (iv) - 1] == 0)
- ++iv[sizeof (iv) -2];
- }
-
- if (outlen > 0)
- {
- /* Truncated last AES output block */
- if (gcry_cipher_encrypt (prf, iv, sizeof (iv), NULL, 0))
- return -1;
- memcpy (out, iv, outlen);
- }
-
- return 0;
+ memset (out, 0, outlen);
+ return ctr_crypt (prf, iv, out, outlen);
}
gcry_cipher_hd_t prf;
uint8_t r[6];
- /* TODO: retry with CTR mode */
- if (gcry_cipher_open (&prf, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_ECB, 0)
+ if (gcry_cipher_open (&prf, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CTR, 0)
|| gcry_cipher_setkey (prf, key, keylen))
return -1;
}
-/** AES-CM encryption/decryption (ctr length = 16 bytes) */
-static int
-ctr_crypt (gcry_cipher_hd_t hd, uint32_t *ctr, uint8_t *data, size_t len)
+/**
+ * Sets Roll-over-Counter Carry (RCC) rate for the SRTP session. If not
+ * specified (through this function), the default rate of ONE is assumed
+ * (i.e. every RTP packets will carry the RoC). RCC rate is ignored if none
+ * of the RCC mode has been selected.
+ *
+ * The RCC mode is selected through one of these flags for srtp_create():
+ * SRTP_RCC_MODE1: integrity protection only for RoC carrying packets
+ * SRTP_RCC_MODE2: integrity protection for all packets
+ * SRTP_RCC_MODE3: no integrity protection
+ *
+ * RCC mode 3 is insecure. Compared to plain RTP, it provides confidentiality
+ * (through encryption) but is much more prone to DoS. It can only be used if
+ * anti-spoofing protection is provided by lower network layers (e.g. IPsec,
+ * or trusted routers and proper source address filtering).
+ *
+ * If RCC rate is 1, RCC mode 1 and 2 are functionally identical.
+ *
+ * @param rate RoC Carry rate (MUST NOT be zero)
+ */
+void srtp_setrcc_rate (srtp_session_t *s, uint16_t rate)
{
- const size_t ctrlen = 16;
- while (len >= ctrlen)
- {
- if (gcry_cipher_setctr (hd, ctr, ctrlen)
- || gcry_cipher_encrypt (hd, data, ctrlen, NULL, 0))
- return -1;
-
- data += ctrlen;
- len -= ctrlen;
- ctr[3] = htonl (ntohl (ctr[3]) + 1);
- }
-
- if (len > 0)
- {
- /* Truncated last block */
- uint8_t dummy[ctrlen];
- memcpy (dummy, data, len);
- memset (dummy + len, 0, ctrlen - len);
-
- if (gcry_cipher_setctr (hd, ctr, ctrlen)
- || gcry_cipher_encrypt (hd, dummy, ctrlen, data, ctrlen))
- return -1;
- memcpy (data, dummy, len);
- }
-
- return 0;
+ assert (rate != 0);
+ s->rtp_rcc = rate;
}
projects / vlc / blobdiff