2 * Secure RTP with libgcrypt
3 * Copyright (C) 2007 RĂ©mi Denis-Courmont <rdenis # simphalempin , com>
5 * This library is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU Lesser General Public
7 * License as published by the Free Software Foundation; either
8 * version 2.1 of the License, or (at your option) any later version.
10 * This library is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * Lesser General Public License for more details.
15 * You should have received a copy of the GNU Lesser General Public
16 * License along with this library; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
21 * Useless stuff (because nothing depends on it):
22 * - non-nul key derivation rate
43 # include <winsock2.h>
45 # include <netinet/in.h>
47 GCRY_THREAD_OPTION_PTHREAD_IMPL
;
50 #define debug( ... ) (void)0
52 typedef struct srtp_proto_t
54 gcry_cipher_hd_t cipher
;
84 static inline unsigned rcc_mode (const srtp_session_t
*s
)
86 return (s
->flags
>> 4) & 3;
89 static bool libgcrypt_usable
= false;
91 static void initonce_libgcrypt (void)
94 gcry_control (GCRYCTL_SET_THREAD_CBS
, &gcry_threads_pthread
);
97 if ((gcry_check_version ("1.1.94") == NULL
)
98 || gcry_control (GCRYCTL_DISABLE_SECMEM
, 0)
99 || gcry_control (GCRYCTL_INITIALIZATION_FINISHED
, 0))
102 libgcrypt_usable
= true;
105 static int init_libgcrypt (void)
109 static pthread_mutex_t mutex
= PTHREAD_MUTEX_INITIALIZER
;
110 static pthread_once_t once
= PTHREAD_ONCE_INIT
;
112 pthread_mutex_lock (&mutex
);
113 pthread_once (&once
, initonce_libgcrypt
);
115 # warning FIXME: This is not thread-safe.
116 if (!libgcrypt_usable
)
117 initonce_libgcrypt ();
120 retval
= libgcrypt_usable
? 0 : -1;
123 pthread_mutex_unlock (&mutex
);
131 static void proto_destroy (srtp_proto_t
*p
)
133 gcry_md_close (p
->mac
);
134 gcry_cipher_close (p
->cipher
);
139 * Releases all resources associated with a Secure RTP session.
141 void srtp_destroy (srtp_session_t
*s
)
145 proto_destroy (&s
->rtcp
);
146 proto_destroy (&s
->rtp
);
151 static int proto_create (srtp_proto_t
*p
, int gcipher
, int gmd
)
153 if (gcry_cipher_open (&p
->cipher
, gcipher
, GCRY_CIPHER_MODE_CTR
, 0) == 0)
155 if (gcry_md_open (&p
->mac
, gmd
, GCRY_MD_FLAG_HMAC
) == 0)
157 gcry_cipher_close (p
->cipher
);
164 * Allocates a Secure RTP one-way session.
165 * The same session cannot be used both ways because this would confuse
166 * internal cryptographic counters; it is however of course feasible to open
167 * multiple simultaneous sessions with the same master key.
169 * @param encr encryption algorithm number
170 * @param auth authentication algortihm number
171 * @param tag_len authentication tag byte length (NOT including RCC)
172 * @param flags OR'ed optional flags.
174 * @return NULL in case of error
177 srtp_create (int encr
, int auth
, unsigned tag_len
, int prf
, unsigned flags
)
179 if ((flags
& ~SRTP_FLAGS_MASK
) || init_libgcrypt ())
186 cipher
= GCRY_CIPHER_NONE
;
189 case SRTP_ENCR_AES_CM
:
190 cipher
= GCRY_CIPHER_AES
;
203 case SRTP_AUTH_HMAC_SHA1
:
211 if (tag_len
> gcry_md_get_algo_dlen (md
))
214 if (prf
!= SRTP_PRF_AES_CM
)
217 srtp_session_t
*s
= malloc (sizeof (*s
));
221 memset (s
, 0, sizeof (*s
));
223 s
->tag_len
= tag_len
;
224 s
->rtp_rcc
= 1; /* Default RCC rate */
231 if (proto_create (&s
->rtp
, cipher
, md
) == 0)
233 if (proto_create (&s
->rtcp
, cipher
, md
) == 0)
235 proto_destroy (&s
->rtp
);
245 * Counter Mode encryption/decryption (ctr length = 16 bytes)
246 * with non-padded (truncated) text
249 ctr_crypt (gcry_cipher_hd_t hd
, const void *ctr
, uint8_t *data
, size_t len
)
251 const size_t ctrlen
= 16;
252 div_t d
= div (len
, ctrlen
);
254 if (gcry_cipher_setctr (hd
, ctr
, ctrlen
)
255 || gcry_cipher_encrypt (hd
, data
, d
.quot
* ctrlen
, NULL
, 0))
260 /* Truncated last block */
261 uint8_t dummy
[ctrlen
];
262 data
+= d
.quot
* ctrlen
;
263 memcpy (dummy
, data
, d
.rem
);
264 memset (dummy
+ d
.rem
, 0, ctrlen
- d
.rem
);
266 if (gcry_cipher_encrypt (hd
, dummy
, ctrlen
, data
, ctrlen
))
268 memcpy (data
, dummy
, d
.rem
);
276 * AES-CM key derivation (saltlen = 14 bytes)
279 derive (gcry_cipher_hd_t prf
, const void *salt
,
280 const uint8_t *r
, size_t rlen
, uint8_t label
,
281 void *out
, size_t outlen
)
285 memcpy (iv
, salt
, 14);
289 iv
[13 - rlen
] ^= label
;
290 for (size_t i
= 0; i
< rlen
; i
++)
291 iv
[sizeof (iv
) - rlen
+ i
] ^= r
[i
];
293 memset (out
, 0, outlen
);
294 return ctr_crypt (prf
, iv
, out
, outlen
);
299 proto_derive (srtp_proto_t
*p
, gcry_cipher_hd_t prf
,
300 const void *salt
, size_t saltlen
,
301 const uint8_t *r
, size_t rlen
, bool rtcp
)
307 uint8_t label
= rtcp
? SRTCP_CRYPT
: SRTP_CRYPT
;
309 if (derive (prf
, salt
, r
, rlen
, label
++, keybuf
, 16)
310 || gcry_cipher_setkey (p
->cipher
, keybuf
, 16)
311 || derive (prf
, salt
, r
, rlen
, label
++, keybuf
, 20)
312 || gcry_md_setkey (p
->mac
, keybuf
, 20)
313 || derive (prf
, salt
, r
, rlen
, label
, p
->salt
, 14))
321 * SRTP/SRTCP cipher/salt/MAC keys derivation.
324 srtp_derive (srtp_session_t
*s
, const void *key
, size_t keylen
,
325 const void *salt
, size_t saltlen
)
327 gcry_cipher_hd_t prf
;
330 if (gcry_cipher_open (&prf
, GCRY_CIPHER_AES
, GCRY_CIPHER_MODE_CTR
, 0)
331 || gcry_cipher_setkey (prf
, key
, keylen
))
335 /* RTP key derivation */
338 uint64_t index
= (((uint64_t)s
->rtp_roc
) << 16) | s
->rtp_seq
;
341 for (int i
= sizeof (r
) - 1; i
>= 0; i
--)
349 memset (r
, 0, sizeof (r
));
351 if (proto_derive (&s
->rtp
, prf
, salt
, saltlen
, r
, 6, false))
354 /* RTCP key derivation */
355 memcpy (r
, &(uint32_t){ htonl (s
->rtcp_index
) }, 4);
356 if (proto_derive (&s
->rtcp
, prf
, salt
, saltlen
, r
, 4, true))
359 (void)gcry_cipher_close (prf
);
365 * Sets (or resets) the master key and master salt for a SRTP session.
366 * This must be done at least once before using rtp_send(), rtp_recv(),
367 * rtcp_send() or rtcp_recv(). Also, rekeying is required every
368 * 2^48 RTP packets or 2^31 RTCP packets (whichever comes first),
369 * otherwise the protocol security might be broken.
371 * @return 0 on success, in case of error:
372 * EINVAL invalid or unsupported key/salt sizes combination
375 srtp_setkey (srtp_session_t
*s
, const void *key
, size_t keylen
,
376 const void *salt
, size_t saltlen
)
378 return srtp_derive (s
, key
, keylen
, salt
, saltlen
) ? EINVAL
: 0;
383 * Sets Roll-over-Counter Carry (RCC) rate for the SRTP session. If not
384 * specified (through this function), the default rate of ONE is assumed
385 * (i.e. every RTP packets will carry the RoC). RCC rate is ignored if none
386 * of the RCC mode has been selected.
388 * The RCC mode is selected through one of these flags for srtp_create():
389 * SRTP_RCC_MODE1: integrity protection only for RoC carrying packets
390 * SRTP_RCC_MODE2: integrity protection for all packets
391 * SRTP_RCC_MODE3: no integrity protection
393 * RCC mode 3 is insecure. Compared to plain RTP, it provides confidentiality
394 * (through encryption) but is much more prone to DoS. It can only be used if
395 * anti-spoofing protection is provided by lower network layers (e.g. IPsec,
396 * or trusted routers and proper source address filtering).
398 * If RCC rate is 1, RCC mode 1 and 2 are functionally identical.
400 * @param rate RoC Carry rate (MUST NOT be zero)
402 void srtp_setrcc_rate (srtp_session_t
*s
, uint16_t rate
)
409 /** AES-CM for RTP (salt = 14 bytes + 2 nul bytes) */
411 rtp_crypt (gcry_cipher_hd_t hd
, uint32_t ssrc
, uint32_t roc
, uint16_t seq
,
412 const uint32_t *salt
, uint8_t *data
, size_t len
)
414 /* Determines cryptographic counter (IV) */
416 counter
[0] = salt
[0];
417 counter
[1] = salt
[1] ^ ssrc
;
418 counter
[2] = salt
[2] ^ htonl (roc
);
419 counter
[3] = salt
[3] ^ htonl (seq
<< 16);
422 return ctr_crypt (hd
, counter
, data
, len
);
426 /** Determines SRTP Roll-Over-Counter (in host-byte order) */
428 srtp_compute_roc (const srtp_session_t
*s
, uint16_t seq
)
430 uint32_t roc
= s
->rtp_roc
;
432 if (((seq
- s
->rtp_seq
) & 0xffff) < 0x8000)
434 /* Sequence is ahead, good */
435 if (seq
< s
->rtp_seq
)
436 roc
++; /* Sequence number wrap */
440 /* Sequence is late, bad */
441 if (seq
> s
->rtp_seq
)
442 roc
--; /* Wrap back */
448 /** Returns RTP sequence (in host-byte order) */
449 static inline uint16_t rtp_seq (const uint8_t *buf
)
451 return (buf
[2] << 8) | buf
[3];
455 /** Message Authentication and Integrity for RTP */
456 static const uint8_t *
457 rtp_digest (srtp_session_t
*s
, const uint8_t *data
, size_t len
,
460 const gcry_md_hd_t md
= s
->rtp
.mac
;
463 gcry_md_write (md
, data
, len
);
464 gcry_md_write (md
, &(uint32_t){ htonl (roc
) }, 4);
465 return gcry_md_read (md
, 0);
470 * Encrypts/decrypts a RTP packet and updates SRTP context
471 * (CTR block cypher mode of operation has identical encryption and
472 * decryption function).
474 * @param buf RTP packet to be en-/decrypted
475 * @param len RTP packet length
477 * @return 0 on success, in case of error:
478 * EINVAL malformatted RTP packet
479 * EACCES replayed packet or out-of-window or sync lost
481 static int srtp_crypt (srtp_session_t
*s
, uint8_t *buf
, size_t len
)
485 if ((len
< 12) || ((buf
[0] >> 6) != 2))
488 /* Computes encryption offset */
489 uint16_t offset
= 12;
490 offset
+= (buf
[0] & 0xf) * 4; // skips CSRC
500 memcpy (&extlen
, buf
+ offset
- 2, 2);
501 offset
+= htons (extlen
); // skips RTP extension header
507 /* Determines RTP 48-bits counter and SSRC */
508 uint16_t seq
= rtp_seq (buf
);
509 uint32_t roc
= srtp_compute_roc (s
, seq
), ssrc
;
510 memcpy (&ssrc
, buf
+ 8, 4);
512 /* Updates ROC and sequence (it's safe now) */
513 int16_t diff
= seq
- s
->rtp_seq
;
516 /* Sequence in the future, good */
517 s
->rtp
.window
= s
->rtp
.window
<< diff
;
519 s
->rtp_seq
= seq
, s
->rtp_roc
= roc
;
523 /* Sequence in the past/present, bad */
525 if ((diff
>= 64) || ((s
->rtp
.window
>> diff
) & 1))
526 return EACCES
; /* Replay attack */
527 s
->rtp
.window
|= 1 << diff
;
530 /* Encrypt/Decrypt */
531 if (s
->flags
& SRTP_UNENCRYPTED
)
534 if (rtp_crypt (s
->rtp
.cipher
, ssrc
, roc
, seq
, s
->rtp
.salt
,
535 buf
+ offset
, len
- offset
))
543 * Turns a RTP packet into a SRTP packet: encrypt it, then computes
544 * the authentication tag and appends it.
545 * Note that you can encrypt packet in disorder.
547 * @param buf RTP packet to be encrypted/digested
548 * @param lenp pointer to the RTP packet length on entry,
549 * set to the SRTP length on exit (undefined on non-ENOSPC error)
550 * @param bufsize size (bytes) of the packet buffer
552 * @return 0 on success, in case of error:
553 * EINVAL malformatted RTP packet or internal error
554 * ENOSPC bufsize is too small to add authentication tag
555 * (<lenp> will hold the required byte size)
556 * EACCES packet would trigger a replay error on receiver
559 srtp_send (srtp_session_t
*s
, uint8_t *buf
, size_t *lenp
, size_t bufsize
)
562 int val
= srtp_crypt (s
, buf
, len
);
566 if (!(s
->flags
& SRTP_UNAUTHENTICATED
))
568 size_t tag_len
= s
->tag_len
;
569 *lenp
= len
+ tag_len
;
570 if (bufsize
< (len
+ tag_len
))
573 uint32_t roc
= srtp_compute_roc (s
, rtp_seq (buf
));
574 const uint8_t *tag
= rtp_digest (s
, buf
, len
, roc
);
578 if ((rtp_seq (buf
) % s
->rtp_rcc
) == 0)
580 memcpy (buf
+ len
, &(uint32_t){ htonl (s
->rtp_roc
) }, 4);
582 if (rcc_mode (s
) == 3)
589 if (rcc_mode (s
) & 1)
593 memcpy (buf
+ len
, tag
, tag_len
);
601 * Turns a SRTP packet into a RTP packet: authenticates the packet,
604 * @param buf RTP packet to be digested/decrypted
605 * @param lenp pointer to the SRTP packet length on entry,
606 * set to the RTP length on exit (undefined in case of error)
608 * @return 0 on success, in case of error:
609 * EINVAL malformatted SRTP packet
610 * EACCES authentication failed (spoofed packet or out-of-sync)
613 srtp_recv (srtp_session_t
*s
, uint8_t *buf
, size_t *lenp
)
619 if (!(s
->flags
& SRTP_UNAUTHENTICATED
))
621 size_t tag_len
= s
->tag_len
, roc_len
= 0;
624 if ((rtp_seq (buf
) % s
->rtp_rcc
) == 0)
627 if (rcc_mode (s
) == 3)
634 if (rcc_mode (s
) & 1)
635 tag_len
= 0; // RCC mode 1 or 3: no auth
639 if (len
< (12u + roc_len
+ tag_len
))
641 len
-= roc_len
+ tag_len
;
643 uint32_t roc
= srtp_compute_roc (s
, rtp_seq (buf
)), rcc
;
646 assert (roc_len
== 4);
647 memcpy (&rcc
, buf
+ len
, 4);
653 const uint8_t *tag
= rtp_digest (s
, buf
, len
, rcc
);
655 printf ("Computed: 0x");
656 for (unsigned i
= 0; i
< tag_len
; i
++)
657 printf ("%02x", tag
[i
]);
658 printf ("\nReceived: 0x");
659 for (unsigned i
= 0; i
< tag_len
; i
++)
660 printf ("%02x", buf
[len
+ roc_len
+ i
]);
663 if (memcmp (buf
+ len
+ roc_len
, tag
, tag_len
))
668 /* Authenticated packet carried a Roll-Over-Counter */
669 s
->rtp_roc
+= rcc
- roc
;
670 assert (srtp_compute_roc (s
, rtp_seq (buf
)) == rcc
);
675 return srtp_crypt (s
, buf
, len
);
679 /** AES-CM for RTCP (salt = 14 bytes + 2 nul bytes) */
681 rtcp_crypt (gcry_cipher_hd_t hd
, uint32_t ssrc
, uint32_t index
,
682 const uint32_t *salt
, uint8_t *data
, size_t len
)
684 return rtp_crypt (hd
, ssrc
, index
>> 16, index
& 0xffff, salt
, data
, len
);
688 /** Message Authentication and Integrity for RTCP */
689 static const uint8_t *
690 rtcp_digest (gcry_md_hd_t md
, const void *data
, size_t len
)
693 gcry_md_write (md
, data
, len
);
694 return gcry_md_read (md
, 0);
699 * Encrypts/decrypts a RTCP packet and updates SRTCP context
700 * (CTR block cypher mode of operation has identical encryption and
701 * decryption function).
703 * @param buf RTCP packet to be en-/decrypted
704 * @param len RTCP packet length
706 * @return 0 on success, in case of error:
707 * EINVAL malformatted RTCP packet
709 static int srtcp_crypt (srtp_session_t
*s
, uint8_t *buf
, size_t len
)
713 /* 8-bytes unencrypted header, and 4-bytes unencrypted footer */
714 if ((len
< 12) || ((buf
[0] >> 6) != 2))
718 memcpy (&index
, buf
+ len
, 4);
719 index
= ntohl (index
);
720 if (((index
>> 31) != 0) != ((s
->flags
& SRTCP_UNENCRYPTED
) == 0))
721 return EINVAL
; // E-bit mismatch
723 index
&= ~(1 << 31); // clear E-bit for counter
725 /* Updates SRTCP index (safe here) */
726 int32_t diff
= index
- s
->rtcp_index
;
729 /* Packet in the future, good */
730 s
->rtcp
.window
= s
->rtcp
.window
<< diff
;
732 s
->rtcp_index
= index
;
736 /* Packet in the past/present, bad */
738 if ((diff
>= 64) || ((s
->rtcp
.window
>> diff
) & 1))
739 return EACCES
; // replay attack!
740 s
->rtp
.window
|= 1 << diff
;
744 if (s
->flags
& SRTCP_UNENCRYPTED
)
748 memcpy (&ssrc
, buf
+ 4, 4);
750 if (rtcp_crypt (s
->rtcp
.cipher
, ssrc
, index
, s
->rtp
.salt
,
758 * Turns a RTCP packet into a SRTCP packet: encrypt it, then computes
759 * the authentication tag and appends it.
761 * @param buf RTCP packet to be encrypted/digested
762 * @param lenp pointer to the RTCP packet length on entry,
763 * set to the SRTCP length on exit (undefined in case of error)
764 * @param bufsize size (bytes) of the packet buffer
766 * @return 0 on success, in case of error:
767 * EINVAL malformatted RTCP packet or internal error
768 * ENOSPC bufsize is too small (to add index and authentication tag)
771 srtcp_send (srtp_session_t
*s
, uint8_t *buf
, size_t *lenp
, size_t bufsize
)
774 if (bufsize
< (len
+ 4 + s
->tag_len
))
777 uint32_t index
= ++s
->rtcp_index
;
779 s
->rtcp_index
= index
= 0; /* 31-bit wrap */
781 if ((s
->flags
& SRTCP_UNENCRYPTED
) == 0)
782 index
|= 0x80000000; /* Set Encrypted bit */
783 memcpy (buf
+ len
, &(uint32_t){ htonl (index
) }, 4);
785 int val
= srtcp_crypt (s
, buf
, len
);
789 len
+= 4; /* Digests SRTCP index too */
791 const uint8_t *tag
= rtcp_digest (s
->rtp
.mac
, buf
, len
);
792 memcpy (buf
+ len
, tag
, s
->tag_len
);
793 *lenp
= len
+ s
->tag_len
;
799 * Turns a SRTCP packet into a RTCP packet: authenticates the packet,
802 * @param buf RTCP packet to be digested/decrypted
803 * @param lenp pointer to the SRTCP packet length on entry,
804 * set to the RTCP length on exit (undefined in case of error)
806 * @return 0 on success, in case of error:
807 * EINVAL malformatted SRTCP packet
808 * EACCES authentication failed (spoofed packet or out-of-sync)
811 srtcp_recv (srtp_session_t
*s
, uint8_t *buf
, size_t *lenp
)
815 if (len
< (4u + s
->tag_len
))
819 const uint8_t *tag
= rtcp_digest (s
->rtp
.mac
, buf
, len
);
820 if (memcmp (buf
+ len
, tag
, s
->tag_len
))
823 len
-= 4; /* Remove SRTCP index before decryption */
825 return srtp_crypt (s
, buf
, len
);