GCM-SST Authenticated Encryption in the Secure Real-time Transport Protocol (SRTP)
draft-westerlund-avtcore-srtp-gcm-sst-00
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (individual) | |
|---|---|---|---|
| Authors | Magnus Westerlund , John Preuß Mattsson | ||
| Last updated | 2026-07-06 | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-westerlund-avtcore-srtp-gcm-sst-00
Audio/Video Transport Core Maintenance M. Westerlund
Internet-Draft J. Preuß Mattsson
Intended status: Standards Track Ericsson
Expires: 7 January 2027 6 July 2026
GCM-SST Authenticated Encryption in the Secure Real-time Transport
Protocol (SRTP)
draft-westerlund-avtcore-srtp-gcm-sst-00
Abstract
This document defines how the GCM-SST (Galois Counter Mode with
Strong Secure Tags) Authenticated Encryption with Associated Data
(AEAD) algorithm family can be used to provide confidentiality and
data authentication in the Secure Real-time Transport Protocol
(SRTP). GCM-SST addresses known weaknesses in AES-GCM for short
authentication tags, making it well suited for media encryption use
cases where low overhead is critical.
About This Document
This note is to be removed before publishing as an RFC.
The latest revision of this draft can be found at
https://gloinul.github.io/draft-westerlund-avtcore-srtp-gcm-sst/
draft-westerlund-avtcore-srtp-gcm-sst.html. Status information for
this document may be found at https://datatracker.ietf.org/doc/draft-
westerlund-avtcore-srtp-gcm-sst/.
Discussion of this document takes place on the Audio/Video Transport
Core Maintenance (AVTCORE) Working Group mailing list
(mailto:avt@ietf.org), which is archived at
https://mailarchive.ietf.org/arch/browse/avt/.
Source for this draft and an issue tracker can be found at
https://github.com/gloinul/draft-westerlund-avtcore-srtp-gcm-sst.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 1]
Internet-Draft GCM-SST for SRTP July 2026
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 7 January 2027.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Conventions and Definitions . . . . . . . . . . . . . . . . . 4
3. Overview of the SRTP/SRTCP AEAD Security Architecture . . . . 5
4. Generic AEAD Processing . . . . . . . . . . . . . . . . . . . 6
4.1. AEAD Invocation Inputs and Outputs . . . . . . . . . . . 6
4.1.1. Encrypt Mode . . . . . . . . . . . . . . . . . . . . 6
4.1.2. Decrypt Mode . . . . . . . . . . . . . . . . . . . . 6
4.2. Handling of AEAD Authentication . . . . . . . . . . . . . 6
5. GCM-SST Processing for SRTP . . . . . . . . . . . . . . . . . 6
5.1. SRTP IV Formation for GCM-SST . . . . . . . . . . . . . . 6
5.2. SRTP IV Formation for Rijndael-GCM-SST . . . . . . . . . 7
5.3. Data Types in SRTP Packets . . . . . . . . . . . . . . . 8
5.4. Handling Header Extensions . . . . . . . . . . . . . . . 9
5.5. Prevention of SRTP IV Reuse . . . . . . . . . . . . . . . 10
6. GCM-SST Processing for SRTCP . . . . . . . . . . . . . . . . 10
6.1. SRTCP IV Formation for AES-GCM-SST . . . . . . . . . . . 10
6.2. SRTCP IV Formation for Rijndael-GCM-SST . . . . . . . . . 10
6.3. Data Types in Encrypted SRTCP Packets . . . . . . . . . . 11
6.4. Data Types in Unencrypted SRTCP Packets . . . . . . . . . 12
6.5. Prevention of SRTCP IV Reuse . . . . . . . . . . . . . . 13
7. Unneeded SRTP/SRTCP Fields . . . . . . . . . . . . . . . . . 13
7.1. SRTP/SRTCP Authentication Tag Field . . . . . . . . . . . 13
7.2. RTP Padding . . . . . . . . . . . . . . . . . . . . . . . 13
8. Constraints on AEAD for SRTP and SRTCP . . . . . . . . . . . 14
9. Key Derivation Functions . . . . . . . . . . . . . . . . . . 15
Westerlund & Preuß MattssExpires 7 January 2027 [Page 2]
Internet-Draft GCM-SST for SRTP July 2026
10. Summary of GCM-SST Cipher Suites in SRTP/SRTCP . . . . . . . 15
11. Security Considerations . . . . . . . . . . . . . . . . . . . 20
11.1. Handling of Security-Critical Parameters . . . . . . . . 20
11.2. Size of the Authentication Tag . . . . . . . . . . . . . 21
11.3. Replay Protection . . . . . . . . . . . . . . . . . . . 21
11.4. Rekeying . . . . . . . . . . . . . . . . . . . . . . . . 21
11.5. Multicast and Broadcast . . . . . . . . . . . . . . . . 21
12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 21
12.1. DTLS-SRTP . . . . . . . . . . . . . . . . . . . . . . . 21
12.2. MIKEY . . . . . . . . . . . . . . . . . . . . . . . . . 24
12.3. Parameters for Use with MIKEY . . . . . . . . . . . . . 24
13. References . . . . . . . . . . . . . . . . . . . . . . . . . 25
13.1. Normative References . . . . . . . . . . . . . . . . . . 25
13.2. Informative References . . . . . . . . . . . . . . . . . 26
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 27
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 27
1. Introduction
The Secure Real-time Transport Protocol (SRTP) [RFC3711] is a profile
of the Real-time Transport Protocol (RTP) [RFC3550], which can
provide confidentiality, message authentication, and replay
protection to the RTP traffic and to the control traffic for RTP, the
Real-time Transport Control Protocol (RTCP).
Authenticated Encryption with Associated Data (AEAD) [RFC5116]
provides both confidentiality and integrity in a single cryptographic
operation. This specification makes use of the GCM-SST (Galois
Counter Mode with Strong Secure Tags) AEAD algorithm family defined
in [I-D.mattsson-cfrg-aes-gcm-sst].
AES-GCM is widely used but has known weaknesses when used with short
authentication tags. The forgery probability for AES-GCM is
significantly worse than ideal, and a successful forgery reveals the
authentication subkey H, enabling an attacker to forge all subsequent
messages. GCM-SST addresses these weaknesses by introducing an
additional subkey H2 and deriving fresh subkeys H and H2 for each
nonce, resulting in near-ideal forgery probabilities even for short
tags and even after multiple forgery attempts.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 3]
Internet-Draft GCM-SST for SRTP July 2026
Short authentication tags are common in media encryption. 32-bit tags
are standard in most radio link layers, 64-bit tags are common in IoT
transport and application layers, and 32-, 64-, and 80-bit tags are
common in media encryption applications. Audio packets are small,
numerous, and ephemeral, making them highly sensitive to
cryptographic overhead. GCM-SST enables the use of short tags with
strong security guarantees, avoiding the need to either use larger-
than-necessary tags or fall back to slower constructions such as AES-
CTR combined with HMAC.
This document defines how to use the AES-128-GCM-SST, AES-256-GCM-
SST, and Rijndael-GCM-SST AEAD algorithms in SRTP and SRTCP, with
authentication tag lengths of 48, 96, and 112 bits. The following
cipher suites are defined:
AEAD_AES_128_GCM_SST_6 AES-128 with a 6-octet (48-bit) tag
AEAD_AES_128_GCM_SST_12 AES-128 with a 12-octet (96-bit) tag
AEAD_AES_128_GCM_SST_14 AES-128 with a 14-octet (112-bit) tag
AEAD_AES_256_GCM_SST_6 AES-256 with a 6-octet (48-bit) tag
AEAD_AES_256_GCM_SST_12 AES-256 with a 12-octet (96-bit) tag
AEAD_AES_256_GCM_SST_14 AES-256 with a 14-octet (112-bit) tag
AEAD_RIJNDAEL_GCM_SST_6 Rijndael-256 with a 6-octet (48-bit) tag
AEAD_RIJNDAEL_GCM_SST_12 Rijndael-256 with a 12-octet (96-bit) tag
AEAD_RIJNDAEL_GCM_SST_14 Rijndael-256 with a 14-octet (112-bit) tag
When using cipher suites with 48-bit (6-octet) tags for SRTP, SRTCP
uses 96-bit (12-octet) tags. This provides adequate security for the
less frequent SRTCP packets while minimizing overhead for the more
numerous SRTP packets.
The Rijndael-GCM-SST cipher suites use Rijndael-256 (256-bit key,
256-bit block) in counter mode as the keystream generator.
Rijndael-256 uses a 28-octet (224-bit) nonce, which requires a
different IV formation than the AES-based cipher suites (see
Section 5.2 and Section 6.2).
2. Conventions and Definitions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
The following terms have specific meanings in this document:
Instantiation: In AEAD, an instantiation is an (Encryption_key,
Westerlund & Preuß MattssExpires 7 January 2027 [Page 4]
Internet-Draft GCM-SST for SRTP July 2026
salt) pair together with all data structures needed for it to
function properly. In SRTP/SRTCP, each endpoint needs two
instantiations of the AEAD algorithm for each master key: one for
SRTP traffic and one for SRTCP traffic.
Invocation: SRTP/SRTCP data streams are broken into packets. Each
packet is processed by a single invocation of the appropriate
instantiation of the AEAD algorithm.
Associated Data: Data that is authenticated but not encrypted.
Plaintext: Data that is both encrypted and authenticated.
Ciphertext: The output of the AEAD encryption function, consisting
of the encrypted Plaintext followed by the authentication tag.
Raw Data: Data that is neither encrypted nor authenticated.
3. Overview of the SRTP/SRTCP AEAD Security Architecture
SRTP/SRTCP AEAD security is based upon the following principles:
a. Both privacy and authentication are based upon the use of
symmetric algorithms. An AEAD algorithm such as GCM-SST combines
privacy and authentication into a single process.
b. A secret master key is shared by all participating endpoints.
Any given master key MAY be used simultaneously by several endpoints
to originate SRTP/SRTCP packets.
c. A Key Derivation Function (KDF) is applied to the shared master
key to form separate encryption keys and salting keys for SRTP and
SRTCP. Since AEAD algorithms combine encryption and authentication
into a single process, AEAD algorithms do not make use of separate
authentication keys.
d. The details of how the master key is established and shared
between participants are outside the scope of this document. Any
mechanism for rekeying an existing session is also outside the scope
of this document.
e. Each time GCM-SST is invoked to encrypt and authenticate an SRTP
or SRTCP packet, a new Initialization Vector (IV) is used. For AES-
based cipher suites, SRTP combines the 4-octet Synchronization Source
(SSRC) identifier, the 4-octet Rollover Counter (ROC), and the
2-octet Sequence Number (SEQ) with the 12-octet encryption salt to
form a 12-octet IV (see Section 5.1). SRTCP combines the SSRC and
31-bit SRTCP index with the encryption salt to form a 12-octet IV
Westerlund & Preuß MattssExpires 7 January 2027 [Page 5]
Internet-Draft GCM-SST for SRTP July 2026
(see Section 6.1). For Rijndael-GCM-SST cipher suites, the same
packet fields are combined with a 28-octet encryption salt to form a
28-octet IV (see Section 5.2 and Section 6.2).
4. Generic AEAD Processing
4.1. AEAD Invocation Inputs and Outputs
4.1.1. Encrypt Mode
Inputs:
Encryption_key Octet string, 16 or 32 octets
Initialization_Vector Octet string, 12 or 28 octets
Associated_Data Octet string of variable length
Plaintext Octet string of variable length
Outputs:
Ciphertext Octet string, length =
length(Plaintext) + tag_length
The ciphertext consists of the encrypted Plaintext followed by the
authentication tag.
4.1.2. Decrypt Mode
Inputs:
Encryption_key Octet string, 16 or 32 octets
Initialization_Vector Octet string, 12 or 28 octets
Associated_Data Octet string of variable length
Ciphertext Octet string of variable length
Outputs:
Plaintext Octet string, length = length(Ciphertext) - tag_length
Validity_Flag Boolean, TRUE if valid, FALSE otherwise
4.2. Handling of AEAD Authentication
All incoming packets MUST pass AEAD authentication before any other
action takes place. Plaintext and Associated Data MUST NOT be
released until the AEAD authentication tag has been validated.
Should the AEAD authentication tag prove to be invalid, the packet
MUST be discarded.
5. GCM-SST Processing for SRTP
5.1. SRTP IV Formation for GCM-SST
Westerlund & Preuß MattssExpires 7 January 2027 [Page 6]
Internet-Draft GCM-SST for SRTP July 2026
0 0 0 0 0 0 0 0 0 0 1 1
0 1 2 3 4 5 6 7 8 9 0 1
+--+--+--+--+--+--+--+--+--+--+--+--+
|00|00| SSRC | ROC | SEQ |---+
+--+--+--+--+--+--+--+--+--+--+--+--+ |
|
+--+--+--+--+--+--+--+--+--+--+--+--+ |
| Encryption Salt |->(+)
+--+--+--+--+--+--+--+--+--+--+--+--+ |
|
+--+--+--+--+--+--+--+--+--+--+--+--+ |
| Initialization Vector |<--+
+--+--+--+--+--+--+--+--+--+--+--+--+
Figure 1: GCM-SST SRTP Initialization Vector Formation (AES)
The 12-octet IV used by AES-GCM-SST SRTP is formed by first
concatenating 2 octets of zeroes, the 4-octet SSRC, the 4-octet
rollover counter (ROC), and the 2-octet sequence number (SEQ). The
resulting 12-octet value is then XORed with the 12-octet salt to form
the IV.
5.2. SRTP IV Formation for Rijndael-GCM-SST
0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0 (18 octets) | SSRC | ROC |SEQ|---+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| Encryption Salt (28 octets) |->(+)
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| Initialization Vector (28 octets) |<--+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: Rijndael-GCM-SST SRTP Initialization Vector Formation
The 28-octet IV used by Rijndael-GCM-SST SRTP is formed by first
concatenating 18 octets of zeroes, the 4-octet SSRC, the 4-octet
rollover counter (ROC), and the 2-octet sequence number (SEQ). The
resulting 28-octet value is then XORed with the 28-octet salt to form
the IV. The larger salt provides significantly greater security
against precomputation and multi-key attacks compared to the AES-
based cipher suites.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 7]
Internet-Draft GCM-SST for SRTP July 2026
5.3. Data Types in SRTP Packets
All SRTP packets MUST be both authenticated and encrypted. The data
fields within RTP packets are broken into Associated Data, Plaintext,
and Raw Data as follows:
Associated Data: The RTP header fields: version V (2 bits), padding
flag P (1 bit), extension flag X (1 bit), CSRC count CC (4 bits),
marker M (1 bit), Payload Type PT (7 bits), sequence number (16
bits), timestamp (32 bits), SSRC (32 bits), optional CSRC
identifiers, and optional RTP extension.
Plaintext: The RTP payload, RTP padding (if used), and RTP pad count
(if used).
Raw Data: The optional SRTP Master Key Identifier (MKI) and SRTP
authentication tag (whose use is NOT RECOMMENDED).
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|V=2|P|X| CC |M| PT | sequence number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| timestamp |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| synchronization source (SSRC) identifier |
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A| contributing source (CSRC) identifiers |
A| .... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| RTP extension (OPTIONAL) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
P| payload ... |
P| +-------------------------------+
P| | RTP padding | RTP pad count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
P = Plaintext A = Associated Data
Figure 3: RTP Packet before Authenticated Encryption
Westerlund & Preuß MattssExpires 7 January 2027 [Page 8]
Internet-Draft GCM-SST for SRTP July 2026
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|V=2|P|X| CC |M| PT | sequence number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| timestamp |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| synchronization source (SSRC) identifier |
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A| contributing source (CSRC) identifiers |
A| .... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| RTP extension (OPTIONAL) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
C| cipher ... |
C| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R: SRTP MKI (OPTIONAL) :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R: SRTP authentication tag (NOT RECOMMENDED) :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
C = Ciphertext A = Associated Data R = Raw Data
Figure 4: SRTP Packet after Authenticated Encryption
5.4. Handling Header Extensions
When [RFC6904] is in use, a separate keystream is generated to
encrypt selected RTP header extension elements. For GCM-SST cipher
suites using AES-128 keys, this keystream MUST be generated using the
AES_128_CM transform. For GCM-SST cipher suites using AES-256 keys
(including the Rijndael-GCM-SST cipher suites), the keystream MUST be
generated using the AES_256_CM transform. The originator MUST
perform any required header extension encryption before the AEAD
algorithm is invoked.
Both encrypted and unencrypted header extensions are treated by the
AEAD algorithm as Associated Data. The AEAD algorithm therefore
provides integrity and authentication for header extensions but no
additional privacy beyond what RFC 6904 provides.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 9]
Internet-Draft GCM-SST for SRTP July 2026
5.5. Prevention of SRTP IV Reuse
To prevent IV reuse, the (ROC, SEQ, SSRC) triple MUST never be used
twice with the same master key. A rekey MUST be performed before the
(ROC, SEQ) pair cycles back to its original value. For a given
master key, the set of all SSRC values MUST be partitioned into
disjoint pools, one per originating endpoint, and each endpoint MUST
only use SSRC values from its assigned pool.
6. GCM-SST Processing for SRTCP
All SRTCP compound packets MUST be authenticated. SRTCP packet
encryption is optional and indicated by a 1-bit Encryption flag
located just before the 31-bit SRTCP index.
When using the AEAD_AES_128_GCM_SST_6, AEAD_AES_256_GCM_SST_6, or
AEAD_RIJNDAEL_GCM_SST_6 cipher suites (which use 48-bit tags for
SRTP), implementations MUST use 96-bit (12-octet) authentication tags
for SRTCP packets. For all other cipher suites, the SRTCP tag length
MUST match the SRTP tag length.
6.1. SRTCP IV Formation for AES-GCM-SST
0 1 2 3 4 5 6 7 8 9 10 11
+--+--+--+--+--+--+--+--+--+--+--+--+
|00|00| SSRC |00|00|0+SRTCP Idx|---+
+--+--+--+--+--+--+--+--+--+--+--+--+ |
|
+--+--+--+--+--+--+--+--+--+--+--+--+ |
| Encryption Salt |->(+)
+--+--+--+--+--+--+--+--+--+--+--+--+ |
|
+--+--+--+--+--+--+--+--+--+--+--+--+ |
| Initialization Vector |<--+
+--+--+--+--+--+--+--+--+--+--+--+--+
Figure 5: GCM-SST SRTCP Initialization Vector Formation (AES)
The 12-octet IV used by AES-GCM-SST SRTCP is formed by concatenating
2 octets of zeroes, the 4-octet SSRC, 2 octets of zeroes, a single
"0" bit, and the 31-bit SRTCP index. The resulting 12-octet value is
then XORed with the 12-octet salt to form the IV.
6.2. SRTCP IV Formation for Rijndael-GCM-SST
Westerlund & Preuß MattssExpires 7 January 2027 [Page 10]
Internet-Draft GCM-SST for SRTP July 2026
0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0 (18 octets) | SSRC |0 0|0+RTCPi|---+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| Encryption Salt (28 octets) |->(+)
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| Initialization Vector (28 octets) |<--+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 6: Rijndael-GCM-SST SRTCP Initialization Vector Formation
The 28-octet IV used by Rijndael-GCM-SST SRTCP is formed by
concatenating 18 octets of zeroes, the 4-octet SSRC, 2 octets of
zeroes, a single "0" bit, and the 31-bit SRTCP index. The resulting
28-octet value is then XORed with the 28-octet salt to form the IV.
6.3. Data Types in Encrypted SRTCP Packets
When the Encryption flag is set to 1:
Associated Data: Version V (2 bits), padding flag P (1 bit),
reception report count RC (5 bits), Packet Type (8 bits), length
(2 octets), SSRC (4 octets), Encryption flag (1 bit), and SRTCP
index (31 bits).
Plaintext: All other data.
Raw Data: The optional SRTCP MKI and SRTCP authentication tag (NOT
RECOMMENDED).
Westerlund & Preuß MattssExpires 7 January 2027 [Page 11]
Internet-Draft GCM-SST for SRTP July 2026
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|V=2|P| RC | Packet Type | length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| synchronization source (SSRC) of sender |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
P| sender info :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
P| report blocks ... :
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
P| additional packets ... :
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A|1| SRTCP index |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R: SRTCP MKI (OPTIONAL) :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R: SRTCP authentication tag (NOT RECOMMENDED) :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
P = Plaintext A = Associated Data R = Raw Data
Figure 7: AEAD SRTCP Inputs When Encryption Flag = 1
6.4. Data Types in Unencrypted SRTCP Packets
When the Encryption flag is set to 0:
Plaintext: None.
Associated Data: All data except the optional SRTCP MKI and
authentication tag.
Raw Data: The optional SRTCP MKI and SRTCP authentication tag (NOT
RECOMMENDED).
Westerlund & Preuß MattssExpires 7 January 2027 [Page 12]
Internet-Draft GCM-SST for SRTP July 2026
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A|V=2|P| RC | Packet Type | length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| synchronization source (SSRC) of sender |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| sender info :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A| report blocks ... :
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A| additional packets ... :
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
A|0| SRTCP index |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R: SRTCP MKI (OPTIONAL) :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
R: authentication tag (NOT RECOMMENDED) :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
A = Associated Data R = Raw Data
Figure 8: AEAD SRTCP Inputs When Encryption Flag = 0
6.5. Prevention of SRTCP IV Reuse
A new master key MUST be established before the 31-bit SRTCP index
cycles back to its original value. The comments on SSRC management
in Section 5.5 also apply to SRTCP.
7. Unneeded SRTP/SRTCP Fields
7.1. SRTP/SRTCP Authentication Tag Field
The AEAD message authentication mechanism MUST be the primary message
authentication mechanism. Additional SRTP/SRTCP authentication
mechanisms SHOULD NOT be used, and the optional SRTP/SRTCP
authentication tags are NOT RECOMMENDED and SHOULD NOT be present.
7.2. RTP Padding
GCM-SST does not require data to be padded to a specific block size.
It is RECOMMENDED that the RTP padding mechanism not be used unless
necessary to disguise the length of the underlying Plaintext.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 13]
Internet-Draft GCM-SST for SRTP July 2026
8. Constraints on AEAD for SRTP and SRTCP
All AEAD algorithms used with SRTP/SRTCP MUST satisfy the following
constraints:
+===========+====================+========================+
| Parameter | Meaning | Value |
+===========+====================+========================+
| A_MAX | Maximum Associated | MUST be at least 12 |
| | Data length | octets |
+-----------+--------------------+------------------------+
| N_MIN | Minimum nonce (IV) | 12 octets (AES) or 28 |
| | length | octets (Rijndael) |
+-----------+--------------------+------------------------+
| N_MAX | Maximum nonce (IV) | 12 octets (AES) or 28 |
| | length | octets (Rijndael) |
+-----------+--------------------+------------------------+
| P_MAX | Maximum Plaintext | 2^15 octets (AES) or |
| | length | 2^16 octets (Rijndael) |
+-----------+--------------------+------------------------+
| C_MAX | Maximum ciphertext | P_MAX + tag_length |
| | length | |
+-----------+--------------------+------------------------+
Table 1: AEAD Constraints for SRTP/SRTCP
Additional parameters:
* E_MAX (maximum number of encryption invocations per key): E_MAX is
2^48 for SRTP and 2^31 for SRTCP. SRTP and SRTCP use separate
derived keys and therefore have independent invocation counts.
* D_MAX (maximum number of decryption invocations per key): For AES-
GCM-SST cipher suites, D_MAX is 2^54. For Rijndael-GCM-SST cipher
suites, D_MAX is 2^118.
For AES-GCM-SST, [I-D.mattsson-cfrg-aes-gcm-sst] recommends that
protocols enforce E_MAX · P_MAX / 16 ⪅ 2^59. With E_MAX of 2^48 and
P_MAX of 2^15 octets, the product E_MAX · P_MAX / 16 = 2^59, which
satisfies this bound. If an application requires larger packets,
P_MAX MAY be increased provided that E_MAX is reduced accordingly so
that E_MAX · P_MAX / 16 ⪅ 2^59 remains satisfied, and a rekey MUST be
performed before E_MAX is reached. For Rijndael-GCM-SST, the 256-bit
block size guarantees δ ≈ 1 without requiring this constraint, and
P_MAX is set to 2^16 octets with E_MAX of 2^48.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 14]
Internet-Draft GCM-SST for SRTP July 2026
9. Key Derivation Functions
A Key Derivation Function (KDF) is used to derive all required
encryption keys and salts from the shared master key. The AES-128-
GCM-SST cipher suites MUST use the AES_128_CM_PRF KDF described in
[RFC3711]. The AES-256-GCM-SST and Rijndael-GCM-SST cipher suites
MUST use the AES_256_CM_PRF KDF described in [RFC6188].
For the Rijndael-GCM-SST cipher suites, the KDF MUST derive a 256-bit
encryption key and a 224-bit (28-octet) encryption salt. The master
salt for Rijndael-GCM-SST is 224 bits.
10. Summary of GCM-SST Cipher Suites in SRTP/SRTCP
The following GCM-SST cipher suites are defined for use with SRTP/
SRTCP:
+==========================+===========+===========+
| Name | Key Size | Tag Size |
+==========================+===========+===========+
| AEAD_AES_128_GCM_SST_6 | 16 octets | 6 octets |
+--------------------------+-----------+-----------+
| AEAD_AES_128_GCM_SST_12 | 16 octets | 12 octets |
+--------------------------+-----------+-----------+
| AEAD_AES_128_GCM_SST_14 | 16 octets | 14 octets |
+--------------------------+-----------+-----------+
| AEAD_AES_256_GCM_SST_6 | 32 octets | 6 octets |
+--------------------------+-----------+-----------+
| AEAD_AES_256_GCM_SST_12 | 32 octets | 12 octets |
+--------------------------+-----------+-----------+
| AEAD_AES_256_GCM_SST_14 | 32 octets | 14 octets |
+--------------------------+-----------+-----------+
| AEAD_RIJNDAEL_GCM_SST_6 | 32 octets | 6 octets |
+--------------------------+-----------+-----------+
| AEAD_RIJNDAEL_GCM_SST_12 | 32 octets | 12 octets |
+--------------------------+-----------+-----------+
| AEAD_RIJNDAEL_GCM_SST_14 | 32 octets | 14 octets |
+--------------------------+-----------+-----------+
Table 2: GCM-SST Cipher Suites for SRTP/SRTCP
Westerlund & Preuß MattssExpires 7 January 2027 [Page 15]
Internet-Draft GCM-SST for SRTP July 2026
+================================+=============================+
| Parameter | AEAD_AES_128_GCM_SST_6 |
+================================+=============================+
| Master key length | 128 bits |
+--------------------------------+-----------------------------+
| Master salt length | 96 bits |
+--------------------------------+-----------------------------+
| Key Derivation Function | AES_128_CM_PRF [RFC3711] |
+--------------------------------+-----------------------------+
| E_MAX (SRTP) | 2^48 encryption invocations |
+--------------------------------+-----------------------------+
| E_MAX (SRTCP) | 2^31 encryption invocations |
+--------------------------------+-----------------------------+
| D_MAX | 2^54 decryption invocations |
+--------------------------------+-----------------------------+
| AEAD authentication tag length | 48 bits |
+--------------------------------+-----------------------------+
Table 3: AEAD_AES_128_GCM_SST_6 Crypto Suite
+================================+=============================+
| Parameter | AEAD_AES_128_GCM_SST_12 |
+================================+=============================+
| Master key length | 128 bits |
+--------------------------------+-----------------------------+
| Master salt length | 96 bits |
+--------------------------------+-----------------------------+
| Key Derivation Function | AES_128_CM_PRF [RFC3711] |
+--------------------------------+-----------------------------+
| E_MAX (SRTP) | 2^48 encryption invocations |
+--------------------------------+-----------------------------+
| E_MAX (SRTCP) | 2^31 encryption invocations |
+--------------------------------+-----------------------------+
| D_MAX | 2^54 decryption invocations |
+--------------------------------+-----------------------------+
| AEAD authentication tag length | 96 bits |
+--------------------------------+-----------------------------+
Table 4: AEAD_AES_128_GCM_SST_12 Crypto Suite
Westerlund & Preuß MattssExpires 7 January 2027 [Page 16]
Internet-Draft GCM-SST for SRTP July 2026
+================================+=============================+
| Parameter | AEAD_AES_128_GCM_SST_14 |
+================================+=============================+
| Master key length | 128 bits |
+--------------------------------+-----------------------------+
| Master salt length | 96 bits |
+--------------------------------+-----------------------------+
| Key Derivation Function | AES_128_CM_PRF [RFC3711] |
+--------------------------------+-----------------------------+
| E_MAX (SRTP) | 2^48 encryption invocations |
+--------------------------------+-----------------------------+
| E_MAX (SRTCP) | 2^31 encryption invocations |
+--------------------------------+-----------------------------+
| D_MAX | 2^54 decryption invocations |
+--------------------------------+-----------------------------+
| AEAD authentication tag length | 112 bits |
+--------------------------------+-----------------------------+
Table 5: AEAD_AES_128_GCM_SST_14 Crypto Suite
+================================+=============================+
| Parameter | AEAD_AES_256_GCM_SST_6 |
+================================+=============================+
| Master key length | 256 bits |
+--------------------------------+-----------------------------+
| Master salt length | 96 bits |
+--------------------------------+-----------------------------+
| Key Derivation Function | AES_256_CM_PRF [RFC6188] |
+--------------------------------+-----------------------------+
| E_MAX (SRTP) | 2^48 encryption invocations |
+--------------------------------+-----------------------------+
| E_MAX (SRTCP) | 2^31 encryption invocations |
+--------------------------------+-----------------------------+
| D_MAX | 2^54 decryption invocations |
+--------------------------------+-----------------------------+
| AEAD authentication tag length | 48 bits |
+--------------------------------+-----------------------------+
Table 6: AEAD_AES_256_GCM_SST_6 Crypto Suite
Westerlund & Preuß MattssExpires 7 January 2027 [Page 17]
Internet-Draft GCM-SST for SRTP July 2026
+================================+=============================+
| Parameter | AEAD_AES_256_GCM_SST_12 |
+================================+=============================+
| Master key length | 256 bits |
+--------------------------------+-----------------------------+
| Master salt length | 96 bits |
+--------------------------------+-----------------------------+
| Key Derivation Function | AES_256_CM_PRF [RFC6188] |
+--------------------------------+-----------------------------+
| E_MAX (SRTP) | 2^48 encryption invocations |
+--------------------------------+-----------------------------+
| E_MAX (SRTCP) | 2^31 encryption invocations |
+--------------------------------+-----------------------------+
| D_MAX | 2^54 decryption invocations |
+--------------------------------+-----------------------------+
| AEAD authentication tag length | 96 bits |
+--------------------------------+-----------------------------+
Table 7: AEAD_AES_256_GCM_SST_12 Crypto Suite
+================================+=============================+
| Parameter | AEAD_AES_256_GCM_SST_14 |
+================================+=============================+
| Master key length | 256 bits |
+--------------------------------+-----------------------------+
| Master salt length | 96 bits |
+--------------------------------+-----------------------------+
| Key Derivation Function | AES_256_CM_PRF [RFC6188] |
+--------------------------------+-----------------------------+
| E_MAX (SRTP) | 2^48 encryption invocations |
+--------------------------------+-----------------------------+
| E_MAX (SRTCP) | 2^31 encryption invocations |
+--------------------------------+-----------------------------+
| D_MAX | 2^54 decryption invocations |
+--------------------------------+-----------------------------+
| AEAD authentication tag length | 112 bits |
+--------------------------------+-----------------------------+
Table 8: AEAD_AES_256_GCM_SST_14 Crypto Suite
Westerlund & Preuß MattssExpires 7 January 2027 [Page 18]
Internet-Draft GCM-SST for SRTP July 2026
+================================+==============================+
| Parameter | AEAD_RIJNDAEL_GCM_SST_6 |
+================================+==============================+
| Master key length | 256 bits |
+--------------------------------+------------------------------+
| Master salt length | 224 bits |
+--------------------------------+------------------------------+
| Key Derivation Function | AES_256_CM_PRF [RFC6188] |
+--------------------------------+------------------------------+
| E_MAX (SRTP) | 2^48 encryption invocations |
+--------------------------------+------------------------------+
| E_MAX (SRTCP) | 2^31 encryption invocations |
+--------------------------------+------------------------------+
| D_MAX | 2^118 decryption invocations |
+--------------------------------+------------------------------+
| AEAD authentication tag length | 48 bits |
+--------------------------------+------------------------------+
Table 9: AEAD_RIJNDAEL_GCM_SST_6 Crypto Suite
+================================+==============================+
| Parameter | AEAD_RIJNDAEL_GCM_SST_12 |
+================================+==============================+
| Master key length | 256 bits |
+--------------------------------+------------------------------+
| Master salt length | 224 bits |
+--------------------------------+------------------------------+
| Key Derivation Function | AES_256_CM_PRF [RFC6188] |
+--------------------------------+------------------------------+
| E_MAX (SRTP) | 2^48 encryption invocations |
+--------------------------------+------------------------------+
| E_MAX (SRTCP) | 2^31 encryption invocations |
+--------------------------------+------------------------------+
| D_MAX | 2^118 decryption invocations |
+--------------------------------+------------------------------+
| AEAD authentication tag length | 96 bits |
+--------------------------------+------------------------------+
Table 10: AEAD_RIJNDAEL_GCM_SST_12 Crypto Suite
Westerlund & Preuß MattssExpires 7 January 2027 [Page 19]
Internet-Draft GCM-SST for SRTP July 2026
+================================+==============================+
| Parameter | AEAD_RIJNDAEL_GCM_SST_14 |
+================================+==============================+
| Master key length | 256 bits |
+--------------------------------+------------------------------+
| Master salt length | 224 bits |
+--------------------------------+------------------------------+
| Key Derivation Function | AES_256_CM_PRF [RFC6188] |
+--------------------------------+------------------------------+
| E_MAX (SRTP) | 2^48 encryption invocations |
+--------------------------------+------------------------------+
| E_MAX (SRTCP) | 2^31 encryption invocations |
+--------------------------------+------------------------------+
| D_MAX | 2^118 decryption invocations |
+--------------------------------+------------------------------+
| AEAD authentication tag length | 112 bits |
+--------------------------------+------------------------------+
Table 11: AEAD_RIJNDAEL_GCM_SST_14 Crypto Suite
11. Security Considerations
11.1. Handling of Security-Critical Parameters
The following security-critical parameters must be handled properly:
* The master salt, if kept secret, MUST be properly erased when no
longer needed.
* The secret master key and all keys derived from it MUST be kept
secret and MUST be properly erased when no longer needed.
* Each time a rekey occurs, the initial values of both the 31-bit
SRTCP index and the 48-bit SRTP packet index (ROC||SEQ) MUST be
saved to prevent IV reuse.
* Processing MUST cease if either the 31-bit SRTCP index or the
48-bit SRTP packet index cycles back to its initial value.
Processing MUST NOT resume until a new session has been
established using a new master key.
* GCM-SST MUST be used in a nonce-respecting setting. For a given
key, a nonce MUST only be used once in the encryption function and
only once in a successful decryption function call. Nonce reuse
enables universal forgery.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 20]
Internet-Draft GCM-SST for SRTP July 2026
11.2. Size of the Authentication Tag
The GCM-SST tag_length SHOULD NOT be smaller than 4 octets. Unlike
AES-GCM, GCM-SST provides near-ideal forgery probabilities even for
short tags, making 48-bit tags suitable for applications such as
audio packet encryption where overhead is critical. The 96-bit and
112-bit tag lengths provide higher security margins suitable for most
other SRTP use cases. Implementations MUST use the tag length
associated with the negotiated cipher suite and MUST NOT truncate or
extend the tag.
11.3. Replay Protection
GCM-SST MUST be used with replay protection. The SRTP sequence
number and rollover counter, or the SRTCP index, provide the basis
for replay protection. For examples of replay protection mechanisms,
see [RFC4303] and [RFC6479].
11.4. Rekeying
Implementations SHOULD rekey well before reaching E_MAX. To minimize
the impact of key compromise, rekeying via ephemeral key exchange
providing forward secrecy SHOULD occur after at most 1 hour or 2^30
to 2^37 octets of data, whichever comes first.
11.5. Multicast and Broadcast
Although GCM-SST offers stronger security than AES-GCM for short
tags, it is not ideal in multicast or broadcast settings. A few
successful forgeries against one or more recipients enable the
attacker to create a new forgery targeting all other recipients
sharing the same key. See Section 5.6 of
[I-D.mattsson-cfrg-aes-gcm-sst] for further details.
12. IANA Considerations
12.1. DTLS-SRTP
DTLS-SRTP [RFC5764] defines SRTP protection profiles. IANA is
requested to register the following SRTP protection profiles:
Westerlund & Preuß MattssExpires 7 January 2027 [Page 21]
Internet-Draft GCM-SST for SRTP July 2026
SRTP_AEAD_AES_128_GCM_SST_6 = {0x00, TBD1}
SRTP_AEAD_AES_128_GCM_SST_12 = {0x00, TBD2}
SRTP_AEAD_AES_128_GCM_SST_14 = {0x00, TBD3}
SRTP_AEAD_AES_256_GCM_SST_6 = {0x00, TBD4}
SRTP_AEAD_AES_256_GCM_SST_12 = {0x00, TBD5}
SRTP_AEAD_AES_256_GCM_SST_14 = {0x00, TBD6}
SRTP_AEAD_RIJNDAEL_GCM_SST_6 = {0x00, TBD7}
SRTP_AEAD_RIJNDAEL_GCM_SST_12 = {0x00, TBD8}
SRTP_AEAD_RIJNDAEL_GCM_SST_14 = {0x00, TBD9}
The SRTP transform parameters for each protection profile are as
follows:
SRTP_AEAD_AES_128_GCM_SST_6
cipher: AES_128_GCM_SST
cipher_key_length: 128 bits
cipher_salt_length: 96 bits
aead_auth_tag_length: 6 octets
auth_function: NULL
auth_key_length: N/A
auth_tag_length: N/A
maximum lifetime: at most 2^31 SRTCP packets and at most 2^48 SRTP packets
SRTP_AEAD_AES_128_GCM_SST_12
cipher: AES_128_GCM_SST
cipher_key_length: 128 bits
cipher_salt_length: 96 bits
aead_auth_tag_length: 12 octets
auth_function: NULL
auth_key_length: N/A
auth_tag_length: N/A
maximum lifetime: at most 2^31 SRTCP packets and at most 2^48 SRTP packets
SRTP_AEAD_AES_128_GCM_SST_14
cipher: AES_128_GCM_SST
cipher_key_length: 128 bits
cipher_salt_length: 96 bits
aead_auth_tag_length: 14 octets
auth_function: NULL
auth_key_length: N/A
auth_tag_length: N/A
maximum lifetime: at most 2^31 SRTCP packets and at most 2^48 SRTP packets
SRTP_AEAD_AES_256_GCM_SST_6
cipher: AES_256_GCM_SST
cipher_key_length: 256 bits
cipher_salt_length: 96 bits
aead_auth_tag_length: 6 octets
Westerlund & Preuß MattssExpires 7 January 2027 [Page 22]
Internet-Draft GCM-SST for SRTP July 2026
auth_function: NULL
auth_key_length: N/A
auth_tag_length: N/A
maximum lifetime: at most 2^31 SRTCP packets and at most 2^48 SRTP packets
SRTP_AEAD_AES_256_GCM_SST_12
cipher: AES_256_GCM_SST
cipher_key_length: 256 bits
cipher_salt_length: 96 bits
aead_auth_tag_length: 12 octets
auth_function: NULL
auth_key_length: N/A
auth_tag_length: N/A
maximum lifetime: at most 2^31 SRTCP packets and at most 2^48 SRTP packets
SRTP_AEAD_AES_256_GCM_SST_14
cipher: AES_256_GCM_SST
cipher_key_length: 256 bits
cipher_salt_length: 96 bits
aead_auth_tag_length: 14 octets
auth_function: NULL
auth_key_length: N/A
auth_tag_length: N/A
maximum lifetime: at most 2^31 SRTCP packets and at most 2^48 SRTP packets
SRTP_AEAD_RIJNDAEL_GCM_SST_6
cipher: RIJNDAEL_256_GCM_SST
cipher_key_length: 256 bits
cipher_salt_length: 224 bits
aead_auth_tag_length: 6 octets
auth_function: NULL
auth_key_length: N/A
auth_tag_length: N/A
maximum lifetime: at most 2^31 SRTCP packets and at most 2^48 SRTP packets
SRTP_AEAD_RIJNDAEL_GCM_SST_12
cipher: RIJNDAEL_256_GCM_SST
cipher_key_length: 256 bits
cipher_salt_length: 224 bits
aead_auth_tag_length: 12 octets
auth_function: NULL
auth_key_length: N/A
auth_tag_length: N/A
maximum lifetime: at most 2^31 SRTCP packets and at most 2^48 SRTP packets
SRTP_AEAD_RIJNDAEL_GCM_SST_14
cipher: RIJNDAEL_256_GCM_SST
cipher_key_length: 256 bits
Westerlund & Preuß MattssExpires 7 January 2027 [Page 23]
Internet-Draft GCM-SST for SRTP July 2026
cipher_salt_length: 224 bits
aead_auth_tag_length: 14 octets
auth_function: NULL
auth_key_length: N/A
auth_tag_length: N/A
maximum lifetime: at most 2^31 SRTCP packets and at most 2^48 SRTP packets
12.2. MIKEY
In accordance with [RFC3830], IANA is requested to add the following
to the "Encryption algorithm (Value 0)" subregistry:
+=======================+=======+===================+===============+
| SRTP Encr. | Value | Default Session | Default Auth. |
| Algorithm | | Encr. Key Length | Tag Length |
+=======================+=======+===================+===============+
| AES-GCM-SST | TBD10 | 16 octets | variable |
+-----------------------+-------+-------------------+---------------+
| RIJNDAEL-256-GCM-SST | TBD11 | 32 octets | variable |
+-----------------------+-------+-------------------+---------------+
Table 12: MIKEY Encryption Algorithm Registration
12.3. Parameters for Use with MIKEY
MIKEY specifies the algorithm family separately from the key length
and authentication tag length.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 24]
Internet-Draft GCM-SST for SRTP July 2026
+==========================+====================+==========+======+
| AEAD Algorithm |Encryption Algorithm|Encryption|AEAD |
| | |Key Length|Auth. |
| | | |Tag |
| | | |Length|
+==========================+====================+==========+======+
| AEAD_AES_128_GCM_SST_6 |AES-GCM-SST |16 octets |6 |
| | | |octets|
+--------------------------+--------------------+----------+------+
| AEAD_AES_128_GCM_SST_12 |AES-GCM-SST |16 octets |12 |
| | | |octets|
+--------------------------+--------------------+----------+------+
| AEAD_AES_128_GCM_SST_14 |AES-GCM-SST |16 octets |14 |
| | | |octets|
+--------------------------+--------------------+----------+------+
| AEAD_AES_256_GCM_SST_6 |AES-GCM-SST |32 octets |6 |
| | | |octets|
+--------------------------+--------------------+----------+------+
| AEAD_AES_256_GCM_SST_12 |AES-GCM-SST |32 octets |12 |
| | | |octets|
+--------------------------+--------------------+----------+------+
| AEAD_AES_256_GCM_SST_14 |AES-GCM-SST |32 octets |14 |
| | | |octets|
+--------------------------+--------------------+----------+------+
| AEAD_RIJNDAEL_GCM_SST_6 |RIJNDAEL-256-GCM-SST|32 octets |6 |
| | | |octets|
+--------------------------+--------------------+----------+------+
| AEAD_RIJNDAEL_GCM_SST_12 |RIJNDAEL-256-GCM-SST|32 octets |12 |
| | | |octets|
+--------------------------+--------------------+----------+------+
| AEAD_RIJNDAEL_GCM_SST_14 |RIJNDAEL-256-GCM-SST|32 octets |14 |
| | | |octets|
+--------------------------+--------------------+----------+------+
Table 13: Mapping MIKEY Parameters to GCM-SST AEAD Algorithms
13. References
13.1. Normative References
[I-D.mattsson-cfrg-aes-gcm-sst]
Campagna, M., Maximov, A., and J. P. Mattsson, "Galois
Counter Mode with Strong Secure Tags (GCM-SST)", Work in
Progress, Internet-Draft, draft-mattsson-cfrg-aes-gcm-sst-
21, 5 July 2026, <https://datatracker.ietf.org/doc/html/
draft-mattsson-cfrg-aes-gcm-sst-21>.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 25]
Internet-Draft GCM-SST for SRTP July 2026
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC3550] Schulzrinne, H., Casner, S., Frederick, R., and V.
Jacobson, "RTP: A Transport Protocol for Real-Time
Applications", STD 64, RFC 3550, DOI 10.17487/RFC3550,
July 2003, <https://www.rfc-editor.org/info/rfc3550>.
[RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K.
Norrman, "The Secure Real-time Transport Protocol (SRTP)",
RFC 3711, DOI 10.17487/RFC3711, March 2004,
<https://www.rfc-editor.org/info/rfc3711>.
[RFC3830] Arkko, J., Carrara, E., Lindholm, F., Naslund, M., and K.
Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830,
DOI 10.17487/RFC3830, August 2004,
<https://www.rfc-editor.org/info/rfc3830>.
[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated
Encryption", RFC 5116, DOI 10.17487/RFC5116, January 2008,
<https://www.rfc-editor.org/info/rfc5116>.
[RFC5764] McGrew, D. and E. Rescorla, "Datagram Transport Layer
Security (DTLS) Extension to Establish Keys for the Secure
Real-time Transport Protocol (SRTP)", RFC 5764,
DOI 10.17487/RFC5764, May 2010,
<https://www.rfc-editor.org/info/rfc5764>.
[RFC6188] McGrew, D., "The Use of AES-192 and AES-256 in Secure
RTP", RFC 6188, DOI 10.17487/RFC6188, March 2011,
<https://www.rfc-editor.org/info/rfc6188>.
[RFC6904] Lennox, J., "Encryption of Header Extensions in the Secure
Real-time Transport Protocol (SRTP)", RFC 6904,
DOI 10.17487/RFC6904, April 2013,
<https://www.rfc-editor.org/info/rfc6904>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
13.2. Informative References
[RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)",
RFC 4303, DOI 10.17487/RFC4303, December 2005,
<https://www.rfc-editor.org/info/rfc4303>.
Westerlund & Preuß MattssExpires 7 January 2027 [Page 26]
Internet-Draft GCM-SST for SRTP July 2026
[RFC6479] Zhang, X. and T. Tsou, "IPsec Anti-Replay Algorithm
without Bit Shifting", RFC 6479, DOI 10.17487/RFC6479,
January 2012, <https://www.rfc-editor.org/info/rfc6479>.
Acknowledgments
The authors would like to thank the authors of RFC 7714, David McGrew
and Kevin Igoe, whose document structure this specification closely
follows. The authors also thank the authors of
[I-D.mattsson-cfrg-aes-gcm-sst], Matthew Campagna, Alexander Maximov,
and John Preuß Mattsson, for defining the GCM-SST algorithm.
Authors' Addresses
Magnus Westerlund
Ericsson
Email: magnus.westerlund@ericsson.com
John Preuß Mattsson
Ericsson
Email: john.mattsson@ericsson.com
Westerlund & Preuß MattssExpires 7 January 2027 [Page 27]