Conversation
A crypto context now holds a list of master keys, each tagged with an MKI,
rather than a single key. On protect the active send key's MKI is written
after the payload (RTP) or the SRTCP index, ahead of the auth tag; on
unprotect that MKI selects the decrypting key. The MKI is left outside the
authenticated portion (RFC 3711 3.1/3.4), so the existing auth ranges are
unchanged.
Session keys are derived lazily per stream and re-derived only when the
selected key changes, so a rollover keeps the replay window and packet index
-- the same crypto context continues (RFC 3711 8.1). For that re-derivation
to agree between peers it must not depend on the stream index: with KDR 0 the
generation counter is always 0, so the packet index no longer enters the KDF.
SRTCP unprotect drops replays before selecting the key, so a replayed packet
cannot force key derivation.
New API: r_srtp_add_crypto_context_{for_ssrc,with_filter}_with_mki create an
MKI context with its first key, r_srtp_add_master_key stages a rollover key,
and r_srtp_set_send_master_key switches the sending key.
Closes #441
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements RFC 3711 Master Key Identifier (MKI) support, closing #441.
What
A crypto context now holds a list of master keys, each tagged with an MKI, instead of a single key. On protect the active send key's MKI is written between the payload (RTP) / SRTCP index and the auth tag; on unprotect the trailing MKI selects the decrypting key. The MKI is left outside the authenticated portion per RFC 3711 §3.1/§3.4, so the existing auth ranges are untouched.
Session keys are derived lazily per stream and re-derived only when the selected key changes, so a key rollover preserves the replay window and packet index — the same crypto context continues (RFC 3711 §8.1). SRTCP unprotect drops replays before selecting the key, so a replayed packet cannot force key derivation.
KDF correctness for rollover
Re-derivation must be independent of the stream index or two peers (at different indices) would derive different keys and break interop with any correct implementation. With KDR 0 — the default — the generation counter
ris always 0, so the packet index is no longer mixed into the KDF. Covered by a test that produces byte-identical ciphertext for the same key derived at two different stream indices.API
r_srtp_add_crypto_context_for_ssrc_with_mki/..._with_filter_with_mki— create an MKI context with its first key (dual recv/send keys, fixedmkisize).r_srtp_add_master_key— stage a rollover key.r_srtp_set_send_master_key— switch the sending key once both peers know it.R_SRTP_MAX_MKI_SIZE.Master-key material is cleared on teardown.
Testing
New tests cover MKI wire position (RTP + SRTCP), two-key rollover via
set_send, index-independent rollover derivation, unknown-MKI rejection, and the invalid-argument matrix. Validated on the linux and ASan tiers (both warning-free); full suite 2334 passed / 0 failed.🤖 Generated with Claude Code