Secure Real-time Transport Protocol

Description

The Secure Real-time Transport Protocol (SRTP) is a 3GPP-standardized protocol that provides security services for Real-time Transport Protocol (RTP) traffic and its control counterpart, RTCP (secured via SRTCP). SRTP is defined as a cryptographic profile of RTP, meaning it adds security features to the standard RTP packet format without altering the underlying RTP header structure. It operates on a packet-by-packet basis, providing end-to-end security between the media endpoints, such as a UE and a Media Resource Function Processor (MRFP) or another UE in a direct communication.

SRTP works by applying cryptographic transforms to the RTP payload. For confidentiality, it encrypts the payload using a symmetric cipher, typically the Advanced Encryption Standard (AES) in Counter Mode (AES-CM). This mode is chosen because it generates a keystream that can be applied via bitwise XOR, making it efficient and error-tolerant—a single bit error in ciphertext only corrupts the corresponding bit in plaintext. For authentication and integrity, SRTP appends a Message Authentication Code (MAC), computed using a keyed hash function like HMAC-SHA1, to each packet. This MAC covers the RTP header, payload, and a packet index. A crucial mechanism is the use of a rolling packet index (derived from the RTP sequence number) and a master key to generate unique session keys for encryption and authentication for each packet, preventing key reuse.

Architecturally, SRTP relies on an external key management protocol (e.g., MIKEY, DTLS-SRTP, or 3GPP-specific key delivery from the core network) to establish a shared security context between endpoints. This context includes the master key, master salt, cryptographic suite, and the SRTP/SRTCP index rollover counters. The SRTP processing layer is typically implemented within the media stack. When sending media, the RTP payload is encrypted, the authentication tag is calculated and appended, and the resulting SRTP packet is sent over UDP/IP. The receiver performs the inverse operations: it validates the authentication tag using the replay list for replay protection, then decrypts the payload. In 3GPP networks, SRTP is mandatory for protecting media streams in IMS-based services like VoLTE, ViLTE, and Rich Communication Services (RCS), ensuring privacy and integrity for millions of real-time communications.

Purpose & Motivation

SRTP was developed to address the severe security shortcomings of the standard RTP protocol, which transmits media in the clear. As telecommunications migrated to all-IP networks with 3GPP's IMS, voice and video became vulnerable to eavesdropping, tampering, and replay attacks over untrusted IP networks like the public internet. The purpose of SRTP is to provide a standardized, efficient, and mandatory security layer specifically designed for the unique constraints of real-time media: low latency, tolerance to packet loss, and high packet rates.

The creation of SRTP within the 3GPP ecosystem was motivated by the need for a solution that could be deployed ubiquitously across devices and networks without breaking existing RTP-based applications. Previous network-level security (e.g., IPsec) was often too heavy, complex to manage end-to-end, and could introduce unacceptable latency or incompatibility with Network Address Translation (NAT). SRTP solves these problems by operating at the application layer, adding minimal overhead (typically 4-10 bytes for the auth tag and 4 bytes for the index), and using ciphers suitable for streaming media. It enables secure commercial VoIP and video services, protects user privacy, and allows operators to meet regulatory requirements for communication security, forming the bedrock for trusted multimedia delivery in 4G and 5G.

Key Features

• Provides confidentiality for RTP media payloads using efficient stream ciphers like AES in Counter Mode (AES-CM)
• Ensures message authentication and integrity for entire RTP packets using a keyed Message Authentication Code (MAC)
• Includes built-in replay protection through a packet index and replay list mechanism
• Defined as a profile of RTP, maintaining compatibility with existing RTP infrastructure and middleboxes
• Uses a derived key mechanism to generate unique encryption and authentication keys for each packet from a master key
• Mandatory for protecting media streams in 3GPP IMS services (e.g., VoLTE, ViLTE) and other packet-switched multimedia applications

Evolution Across Releases

Defining Specifications