GCM-SST Authenticated Encryption in the Secure Real-time Transport Protocol (SRTP)

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 7 January 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

The Secure Real-time Transport Protocol (SRTP) [RFC3711] is a profile of the Real-time Transport Protocol (RTP) [RFC3550], which can provide confidentiality, message authentication, and replay protection to the RTP traffic and to the control traffic for RTP, the Real-time Transport Control Protocol (RTCP).¶

Authenticated Encryption with Associated Data (AEAD) [RFC5116] provides both confidentiality and integrity in a single cryptographic operation. This specification makes use of the GCM-SST (Galois Counter Mode with Strong Secure Tags) AEAD algorithm family defined in [I-D.mattsson-cfrg-aes-gcm-sst].¶

AES-GCM is widely used but has known weaknesses when used with short authentication tags. The forgery probability for AES-GCM is significantly worse than ideal, and a successful forgery reveals the authentication subkey H, enabling an attacker to forge all subsequent messages. GCM-SST addresses these weaknesses by introducing an additional subkey H2 and deriving fresh subkeys H and H2 for each nonce, resulting in near-ideal forgery probabilities even for short tags and even after multiple forgery attempts.¶

Short authentication tags are common in media encryption. 32-bit tags are standard in most radio link layers, 64-bit tags are common in IoT transport and application layers, and 32-, 64-, and 80-bit tags are common in media encryption applications. Audio packets are small, numerous, and ephemeral, making them highly sensitive to cryptographic overhead. GCM-SST enables the use of short tags with strong security guarantees, avoiding the need to either use larger-than-necessary tags or fall back to slower constructions such as AES-CTR combined with HMAC.¶

This document defines how to use the AES-128-GCM-SST, AES-256-GCM-SST, and Rijndael-GCM-SST AEAD algorithms in SRTP and SRTCP, with authentication tag lengths of 48, 96, and 112 bits. The following cipher suites are defined:¶

  AEAD_AES_128_GCM_SST_6       AES-128 with a 6-octet (48-bit) tag
  AEAD_AES_128_GCM_SST_12      AES-128 with a 12-octet (96-bit) tag
  AEAD_AES_128_GCM_SST_14      AES-128 with a 14-octet (112-bit) tag
  AEAD_AES_256_GCM_SST_6       AES-256 with a 6-octet (48-bit) tag
  AEAD_AES_256_GCM_SST_12      AES-256 with a 12-octet (96-bit) tag
  AEAD_AES_256_GCM_SST_14      AES-256 with a 14-octet (112-bit) tag
  AEAD_RIJNDAEL_GCM_SST_6      Rijndael-256 with a 6-octet (48-bit) tag
  AEAD_RIJNDAEL_GCM_SST_12     Rijndael-256 with a 12-octet (96-bit) tag
  AEAD_RIJNDAEL_GCM_SST_14     Rijndael-256 with a 14-octet (112-bit) tag

When using cipher suites with 48-bit (6-octet) tags for SRTP, SRTCP uses 96-bit (12-octet) tags. This provides adequate security for the less frequent SRTCP packets while minimizing overhead for the more numerous SRTP packets.¶

The Rijndael-GCM-SST cipher suites use Rijndael-256 (256-bit key, 256-bit block) in counter mode as the keystream generator. Rijndael-256 uses a 28-octet (224-bit) nonce, which requires a different IV formation than the AES-based cipher suites (see Section 5.2 and Section 6.2).¶

2. Conventions and Definitions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

The following terms have specific meanings in this document:¶

Instantiation:

In AEAD, an instantiation is an (Encryption_key, salt) pair together with all data structures needed for it to function properly. In SRTP/SRTCP, each endpoint needs two instantiations of the AEAD algorithm for each master key: one for SRTP traffic and one for SRTCP traffic.¶

Invocation:

SRTP/SRTCP data streams are broken into packets. Each packet is processed by a single invocation of the appropriate instantiation of the AEAD algorithm.¶

Associated Data:

Data that is authenticated but not encrypted.¶

Plaintext:

Data that is both encrypted and authenticated.¶

Ciphertext:

The output of the AEAD encryption function, consisting of the encrypted Plaintext followed by the authentication tag.¶

Raw Data:

Data that is neither encrypted nor authenticated.¶

3. Overview of the SRTP/SRTCP AEAD Security Architecture

SRTP/SRTCP AEAD security is based upon the following principles:¶

a. Both privacy and authentication are based upon the use of symmetric algorithms. An AEAD algorithm such as GCM-SST combines privacy and authentication into a single process.¶

b. A secret master key is shared by all participating endpoints. Any given master key MAY be used simultaneously by several endpoints to originate SRTP/SRTCP packets.¶

c. A Key Derivation Function (KDF) is applied to the shared master key to form separate encryption keys and salting keys for SRTP and SRTCP. Since AEAD algorithms combine encryption and authentication into a single process, AEAD algorithms do not make use of separate authentication keys.¶

d. The details of how the master key is established and shared between participants are outside the scope of this document. Any mechanism for rekeying an existing session is also outside the scope of this document.¶

e. Each time GCM-SST is invoked to encrypt and authenticate an SRTP or SRTCP packet, a new Initialization Vector (IV) is used. For AES-based cipher suites, SRTP combines the 4-octet Synchronization Source (SSRC) identifier, the 4-octet Rollover Counter (ROC), and the 2-octet Sequence Number (SEQ) with the 12-octet encryption salt to form a 12-octet IV (see Section 5.1). SRTCP combines the SSRC and 31-bit SRTCP index with the encryption salt to form a 12-octet IV (see Section 6.1). For Rijndael-GCM-SST cipher suites, the same packet fields are combined with a 28-octet encryption salt to form a 28-octet IV (see Section 5.2 and Section 6.2).¶

4. Generic AEAD Processing

  Inputs:
    Encryption_key         Octet string, 16 or 32 octets
    Initialization_Vector  Octet string, 12 or 28 octets
    Associated_Data        Octet string of variable length
    Plaintext              Octet string of variable length

  Outputs:
    Ciphertext             Octet string, length =
                             length(Plaintext) + tag_length

  Inputs:
    Encryption_key         Octet string, 16 or 32 octets
    Initialization_Vector  Octet string, 12 or 28 octets
    Associated_Data        Octet string of variable length
    Ciphertext             Octet string of variable length

  Outputs:
    Plaintext              Octet string, length = length(Ciphertext) - tag_length
    Validity_Flag          Boolean, TRUE if valid, FALSE otherwise

5. GCM-SST Processing for SRTP

              0  0  0  0  0  0  0  0  0  0  1  1
              0  1  2  3  4  5  6  7  8  9  0  1
            +--+--+--+--+--+--+--+--+--+--+--+--+
            |00|00|    SSRC   |     ROC   | SEQ |---+
            +--+--+--+--+--+--+--+--+--+--+--+--+   |
                                                    |
            +--+--+--+--+--+--+--+--+--+--+--+--+   |
            |         Encryption Salt           |->(+)
            +--+--+--+--+--+--+--+--+--+--+--+--+   |
                                                    |
            +--+--+--+--+--+--+--+--+--+--+--+--+   |
            |       Initialization Vector       |<--+
            +--+--+--+--+--+--+--+--+--+--+--+--+

  0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |         0 (18 octets)             |  SSRC | ROC   |SEQ|---+
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
                                                             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
 |             Encryption Salt (28 octets)               |->(+)
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
                                                             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
 |          Initialization Vector (28 octets)            |<--+
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|V=2|P|X|  CC   |M|     PT      |       sequence number         |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|                           timestamp                           |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|           synchronization source (SSRC) identifier            |
 +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A|            contributing source (CSRC) identifiers             |
A|                             ....                              |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|                   RTP extension (OPTIONAL)                    |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
P|                          payload  ...                         |
P|                               +-------------------------------+
P|                               | RTP padding   | RTP pad count |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

  P = Plaintext   A = Associated Data

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|V=2|P|X|  CC   |M|     PT      |       sequence number         |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|                           timestamp                           |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|           synchronization source (SSRC) identifier            |
 +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A|            contributing source (CSRC) identifiers             |
A|                             ....                              |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|                   RTP extension (OPTIONAL)                    |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
C|                          cipher ...                           |
C|                             ...                               |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R:                     SRTP MKI (OPTIONAL)                       :
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R:           SRTP authentication tag (NOT RECOMMENDED)           :
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

  C = Ciphertext   A = Associated Data   R = Raw Data

6. GCM-SST Processing for SRTCP

All SRTCP compound packets MUST be authenticated. SRTCP packet encryption is optional and indicated by a 1-bit Encryption flag located just before the 31-bit SRTCP index.¶

When using the AEAD_AES_128_GCM_SST_6, AEAD_AES_256_GCM_SST_6, or AEAD_RIJNDAEL_GCM_SST_6 cipher suites (which use 48-bit tags for SRTP), implementations MUST use 96-bit (12-octet) authentication tags for SRTCP packets. For all other cipher suites, the SRTCP tag length MUST match the SRTP tag length.¶

              0  1  2  3  4  5  6  7  8  9 10 11
            +--+--+--+--+--+--+--+--+--+--+--+--+
            |00|00|    SSRC   |00|00|0+SRTCP Idx|---+
            +--+--+--+--+--+--+--+--+--+--+--+--+   |
                                                    |
            +--+--+--+--+--+--+--+--+--+--+--+--+   |
            |         Encryption Salt           |->(+)
            +--+--+--+--+--+--+--+--+--+--+--+--+   |
                                                    |
            +--+--+--+--+--+--+--+--+--+--+--+--+   |
            |       Initialization Vector       |<--+
            +--+--+--+--+--+--+--+--+--+--+--+--+

  0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |         0 (18 octets)             |  SSRC |0 0|0+RTCPi|---+
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
                                                             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
 |             Encryption Salt (28 octets)               |->(+)
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
                                                             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
 |          Initialization Vector (28 octets)            |<--+
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|V=2|P|   RC    |  Packet Type  |            length             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|           synchronization source (SSRC) of sender             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
P|                         sender info                           :
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
P|                        report blocks ...                      :
 +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
P|                       additional packets ...                  :
 +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A|1|                         SRTCP index                         |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R:                  SRTCP MKI (OPTIONAL)                         :
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R:           SRTCP authentication tag (NOT RECOMMENDED)          :
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

  P = Plaintext   A = Associated Data   R = Raw Data

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|V=2|P|   RC    |  Packet Type  |            length             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|           synchronization source (SSRC) of sender             |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|                         sender info                           :
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|                        report blocks ...                      :
 +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A|                       additional packets ...                  :
 +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A|0|                         SRTCP index                         |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R:                  SRTCP MKI (OPTIONAL)                         :
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R:              authentication tag (NOT RECOMMENDED)             :
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

  A = Associated Data   R = Raw Data

7. Unneeded SRTP/SRTCP Fields

8. Constraints on AEAD for SRTP and SRTCP

All AEAD algorithms used with SRTP/SRTCP MUST satisfy the following constraints:¶

Additional parameters:¶

• E_MAX (maximum number of encryption invocations per key): E_MAX is 2^48 for SRTP and 2^31 for SRTCP. SRTP and SRTCP use separate derived keys and therefore have independent invocation counts.¶

• D_MAX (maximum number of decryption invocations per key): For AES-GCM-SST cipher suites, D_MAX is 2^54. For Rijndael-GCM-SST cipher suites, D_MAX is 2^118.¶

For AES-GCM-SST, [I-D.mattsson-cfrg-aes-gcm-sst] recommends that protocols enforce E_MAX · P_MAX / 16 ⪅ 2^59. With E_MAX of 2^48 and P_MAX of 2^15 octets, the product E_MAX · P_MAX / 16 = 2^59, which satisfies this bound. If an application requires larger packets, P_MAX MAY be increased provided that E_MAX is reduced accordingly so that E_MAX · P_MAX / 16 ⪅ 2^59 remains satisfied, and a rekey MUST be performed before E_MAX is reached. For Rijndael-GCM-SST, the 256-bit block size guarantees δ ≈ 1 without requiring this constraint, and P_MAX is set to 2^16 octets with E_MAX of 2^48.¶

9. Key Derivation Functions

A Key Derivation Function (KDF) is used to derive all required encryption keys and salts from the shared master key. The AES-128-GCM-SST cipher suites MUST use the AES_128_CM_PRF KDF described in [RFC3711]. The AES-256-GCM-SST and Rijndael-GCM-SST cipher suites MUST use the AES_256_CM_PRF KDF described in [RFC6188].¶

For the Rijndael-GCM-SST cipher suites, the KDF MUST derive a 256-bit encryption key and a 224-bit (28-octet) encryption salt. The master salt for Rijndael-GCM-SST is 224 bits.¶

10. Summary of GCM-SST Cipher Suites in SRTP/SRTCP

The following GCM-SST cipher suites are defined for use with SRTP/SRTCP:¶

11. Security Considerations

12. IANA Considerations

  SRTP_AEAD_AES_128_GCM_SST_6   = {0x00, TBD1}
  SRTP_AEAD_AES_128_GCM_SST_12  = {0x00, TBD2}
  SRTP_AEAD_AES_128_GCM_SST_14  = {0x00, TBD3}
  SRTP_AEAD_AES_256_GCM_SST_6   = {0x00, TBD4}
  SRTP_AEAD_AES_256_GCM_SST_12  = {0x00, TBD5}
  SRTP_AEAD_AES_256_GCM_SST_14  = {0x00, TBD6}
  SRTP_AEAD_RIJNDAEL_GCM_SST_6  = {0x00, TBD7}
  SRTP_AEAD_RIJNDAEL_GCM_SST_12 = {0x00, TBD8}
  SRTP_AEAD_RIJNDAEL_GCM_SST_14 = {0x00, TBD9}

  SRTP_AEAD_AES_128_GCM_SST_6
    cipher:                 AES_128_GCM_SST
    cipher_key_length:      128 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   6 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_128_GCM_SST_12
    cipher:                 AES_128_GCM_SST
    cipher_key_length:      128 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   12 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_128_GCM_SST_14
    cipher:                 AES_128_GCM_SST
    cipher_key_length:      128 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   14 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_256_GCM_SST_6
    cipher:                 AES_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   6 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_256_GCM_SST_12
    cipher:                 AES_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   12 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_256_GCM_SST_14
    cipher:                 AES_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   14 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_RIJNDAEL_GCM_SST_6
    cipher:                 RIJNDAEL_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     224 bits
    aead_auth_tag_length:   6 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_RIJNDAEL_GCM_SST_12
    cipher:                 RIJNDAEL_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     224 bits
    aead_auth_tag_length:   12 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_RIJNDAEL_GCM_SST_14
    cipher:                 RIJNDAEL_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     224 bits
    aead_auth_tag_length:   14 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

Acknowledgments

The authors would like to thank the authors of RFC 7714, David McGrew and Kevin Igoe, whose document structure this specification closely follows. The authors also thank the authors of [I-D.mattsson-cfrg-aes-gcm-sst], Matthew Campagna, Alexander Maximov, and John Preuß Mattsson, for defining the GCM-SST algorithm.¶

Authors' Addresses