Skip to main content

GCM-SST Authenticated Encryption in the Secure Real-time Transport Protocol (SRTP)
draft-westerlund-avtcore-srtp-gcm-sst-00

Document Type Active Internet-Draft (individual)
Authors Magnus Westerlund , John Preuß Mattsson
Last updated 2026-07-06
RFC stream (None)
Intended RFC status (None)
Formats
Stream Stream state (No stream defined)
Consensus boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date (None)
Responsible AD (None)
Send notices to (None)
draft-westerlund-avtcore-srtp-gcm-sst-00
Audio/Video Transport Core Maintenance                     M. Westerlund
Internet-Draft                                         J. Preuß Mattsson
Intended status: Standards Track                                Ericsson
Expires: 7 January 2027                                      6 July 2026

   GCM-SST Authenticated Encryption in the Secure Real-time Transport
                            Protocol (SRTP)
                draft-westerlund-avtcore-srtp-gcm-sst-00

Abstract

   This document defines how the GCM-SST (Galois Counter Mode with
   Strong Secure Tags) Authenticated Encryption with Associated Data
   (AEAD) algorithm family can be used to provide confidentiality and
   data authentication in the Secure Real-time Transport Protocol
   (SRTP).  GCM-SST addresses known weaknesses in AES-GCM for short
   authentication tags, making it well suited for media encryption use
   cases where low overhead is critical.

About This Document

   This note is to be removed before publishing as an RFC.

   The latest revision of this draft can be found at
   https://gloinul.github.io/draft-westerlund-avtcore-srtp-gcm-sst/
   draft-westerlund-avtcore-srtp-gcm-sst.html.  Status information for
   this document may be found at https://datatracker.ietf.org/doc/draft-
   westerlund-avtcore-srtp-gcm-sst/.

   Discussion of this document takes place on the Audio/Video Transport
   Core Maintenance (AVTCORE) Working Group mailing list
   (mailto:avt@ietf.org), which is archived at
   https://mailarchive.ietf.org/arch/browse/avt/.

   Source for this draft and an issue tracker can be found at
   https://github.com/gloinul/draft-westerlund-avtcore-srtp-gcm-sst.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

Westerlund & Preuß MattssExpires 7 January 2027                 [Page 1]
Internet-Draft              GCM-SST for SRTP                   July 2026

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 7 January 2027.

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
   2.  Conventions and Definitions . . . . . . . . . . . . . . . . .   4
   3.  Overview of the SRTP/SRTCP AEAD Security Architecture . . . .   5
   4.  Generic AEAD Processing . . . . . . . . . . . . . . . . . . .   6
     4.1.  AEAD Invocation Inputs and Outputs  . . . . . . . . . . .   6
       4.1.1.  Encrypt Mode  . . . . . . . . . . . . . . . . . . . .   6
       4.1.2.  Decrypt Mode  . . . . . . . . . . . . . . . . . . . .   6
     4.2.  Handling of AEAD Authentication . . . . . . . . . . . . .   6
   5.  GCM-SST Processing for SRTP . . . . . . . . . . . . . . . . .   6
     5.1.  SRTP IV Formation for GCM-SST . . . . . . . . . . . . . .   6
     5.2.  SRTP IV Formation for Rijndael-GCM-SST  . . . . . . . . .   7
     5.3.  Data Types in SRTP Packets  . . . . . . . . . . . . . . .   8
     5.4.  Handling Header Extensions  . . . . . . . . . . . . . . .   9
     5.5.  Prevention of SRTP IV Reuse . . . . . . . . . . . . . . .  10
   6.  GCM-SST Processing for SRTCP  . . . . . . . . . . . . . . . .  10
     6.1.  SRTCP IV Formation for AES-GCM-SST  . . . . . . . . . . .  10
     6.2.  SRTCP IV Formation for Rijndael-GCM-SST . . . . . . . . .  10
     6.3.  Data Types in Encrypted SRTCP Packets . . . . . . . . . .  11
     6.4.  Data Types in Unencrypted SRTCP Packets . . . . . . . . .  12
     6.5.  Prevention of SRTCP IV Reuse  . . . . . . . . . . . . . .  13
   7.  Unneeded SRTP/SRTCP Fields  . . . . . . . . . . . . . . . . .  13
     7.1.  SRTP/SRTCP Authentication Tag Field . . . . . . . . . . .  13
     7.2.  RTP Padding . . . . . . . . . . . . . . . . . . . . . . .  13
   8.  Constraints on AEAD for SRTP and SRTCP  . . . . . . . . . . .  14
   9.  Key Derivation Functions  . . . . . . . . . . . . . . . . . .  15

Westerlund & Preuß MattssExpires 7 January 2027                 [Page 2]
Internet-Draft              GCM-SST for SRTP                   July 2026

   10. Summary of GCM-SST Cipher Suites in SRTP/SRTCP  . . . . . . .  15
   11. Security Considerations . . . . . . . . . . . . . . . . . . .  20
     11.1.  Handling of Security-Critical Parameters . . . . . . . .  20
     11.2.  Size of the Authentication Tag . . . . . . . . . . . . .  21
     11.3.  Replay Protection  . . . . . . . . . . . . . . . . . . .  21
     11.4.  Rekeying . . . . . . . . . . . . . . . . . . . . . . . .  21
     11.5.  Multicast and Broadcast  . . . . . . . . . . . . . . . .  21
   12. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  21
     12.1.  DTLS-SRTP  . . . . . . . . . . . . . . . . . . . . . . .  21
     12.2.  MIKEY  . . . . . . . . . . . . . . . . . . . . . . . . .  24
     12.3.  Parameters for Use with MIKEY  . . . . . . . . . . . . .  24
   13. References  . . . . . . . . . . . . . . . . . . . . . . . . .  25
     13.1.  Normative References . . . . . . . . . . . . . . . . . .  25
     13.2.  Informative References . . . . . . . . . . . . . . . . .  26
   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  27
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  27

1.  Introduction

   The Secure Real-time Transport Protocol (SRTP) [RFC3711] is a profile
   of the Real-time Transport Protocol (RTP) [RFC3550], which can
   provide confidentiality, message authentication, and replay
   protection to the RTP traffic and to the control traffic for RTP, the
   Real-time Transport Control Protocol (RTCP).

   Authenticated Encryption with Associated Data (AEAD) [RFC5116]
   provides both confidentiality and integrity in a single cryptographic
   operation.  This specification makes use of the GCM-SST (Galois
   Counter Mode with Strong Secure Tags) AEAD algorithm family defined
   in [I-D.mattsson-cfrg-aes-gcm-sst].

   AES-GCM is widely used but has known weaknesses when used with short
   authentication tags.  The forgery probability for AES-GCM is
   significantly worse than ideal, and a successful forgery reveals the
   authentication subkey H, enabling an attacker to forge all subsequent
   messages.  GCM-SST addresses these weaknesses by introducing an
   additional subkey H2 and deriving fresh subkeys H and H2 for each
   nonce, resulting in near-ideal forgery probabilities even for short
   tags and even after multiple forgery attempts.

Westerlund & Preuß MattssExpires 7 January 2027                 [Page 3]
Internet-Draft              GCM-SST for SRTP                   July 2026

   Short authentication tags are common in media encryption. 32-bit tags
   are standard in most radio link layers, 64-bit tags are common in IoT
   transport and application layers, and 32-, 64-, and 80-bit tags are
   common in media encryption applications.  Audio packets are small,
   numerous, and ephemeral, making them highly sensitive to
   cryptographic overhead.  GCM-SST enables the use of short tags with
   strong security guarantees, avoiding the need to either use larger-
   than-necessary tags or fall back to slower constructions such as AES-
   CTR combined with HMAC.

   This document defines how to use the AES-128-GCM-SST, AES-256-GCM-
   SST, and Rijndael-GCM-SST AEAD algorithms in SRTP and SRTCP, with
   authentication tag lengths of 48, 96, and 112 bits.  The following
   cipher suites are defined:

  AEAD_AES_128_GCM_SST_6       AES-128 with a 6-octet (48-bit) tag
  AEAD_AES_128_GCM_SST_12      AES-128 with a 12-octet (96-bit) tag
  AEAD_AES_128_GCM_SST_14      AES-128 with a 14-octet (112-bit) tag
  AEAD_AES_256_GCM_SST_6       AES-256 with a 6-octet (48-bit) tag
  AEAD_AES_256_GCM_SST_12      AES-256 with a 12-octet (96-bit) tag
  AEAD_AES_256_GCM_SST_14      AES-256 with a 14-octet (112-bit) tag
  AEAD_RIJNDAEL_GCM_SST_6      Rijndael-256 with a 6-octet (48-bit) tag
  AEAD_RIJNDAEL_GCM_SST_12     Rijndael-256 with a 12-octet (96-bit) tag
  AEAD_RIJNDAEL_GCM_SST_14     Rijndael-256 with a 14-octet (112-bit) tag

   When using cipher suites with 48-bit (6-octet) tags for SRTP, SRTCP
   uses 96-bit (12-octet) tags.  This provides adequate security for the
   less frequent SRTCP packets while minimizing overhead for the more
   numerous SRTP packets.

   The Rijndael-GCM-SST cipher suites use Rijndael-256 (256-bit key,
   256-bit block) in counter mode as the keystream generator.
   Rijndael-256 uses a 28-octet (224-bit) nonce, which requires a
   different IV formation than the AES-based cipher suites (see
   Section 5.2 and Section 6.2).

2.  Conventions and Definitions

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

   The following terms have specific meanings in this document:

   Instantiation:  In AEAD, an instantiation is an (Encryption_key,

Westerlund & Preuß MattssExpires 7 January 2027                 [Page 4]
Internet-Draft              GCM-SST for SRTP                   July 2026

      salt) pair together with all data structures needed for it to
      function properly.  In SRTP/SRTCP, each endpoint needs two
      instantiations of the AEAD algorithm for each master key: one for
      SRTP traffic and one for SRTCP traffic.

   Invocation:  SRTP/SRTCP data streams are broken into packets.  Each
      packet is processed by a single invocation of the appropriate
      instantiation of the AEAD algorithm.

   Associated Data:  Data that is authenticated but not encrypted.

   Plaintext:  Data that is both encrypted and authenticated.

   Ciphertext:  The output of the AEAD encryption function, consisting
      of the encrypted Plaintext followed by the authentication tag.

   Raw Data:  Data that is neither encrypted nor authenticated.

3.  Overview of the SRTP/SRTCP AEAD Security Architecture

   SRTP/SRTCP AEAD security is based upon the following principles:

   a.  Both privacy and authentication are based upon the use of
   symmetric algorithms.  An AEAD algorithm such as GCM-SST combines
   privacy and authentication into a single process.

   b.  A secret master key is shared by all participating endpoints.
   Any given master key MAY be used simultaneously by several endpoints
   to originate SRTP/SRTCP packets.

   c.  A Key Derivation Function (KDF) is applied to the shared master
   key to form separate encryption keys and salting keys for SRTP and
   SRTCP.  Since AEAD algorithms combine encryption and authentication
   into a single process, AEAD algorithms do not make use of separate
   authentication keys.

   d.  The details of how the master key is established and shared
   between participants are outside the scope of this document.  Any
   mechanism for rekeying an existing session is also outside the scope
   of this document.

   e.  Each time GCM-SST is invoked to encrypt and authenticate an SRTP
   or SRTCP packet, a new Initialization Vector (IV) is used.  For AES-
   based cipher suites, SRTP combines the 4-octet Synchronization Source
   (SSRC) identifier, the 4-octet Rollover Counter (ROC), and the
   2-octet Sequence Number (SEQ) with the 12-octet encryption salt to
   form a 12-octet IV (see Section 5.1).  SRTCP combines the SSRC and
   31-bit SRTCP index with the encryption salt to form a 12-octet IV

Westerlund & Preuß MattssExpires 7 January 2027                 [Page 5]
Internet-Draft              GCM-SST for SRTP                   July 2026

   (see Section 6.1).  For Rijndael-GCM-SST cipher suites, the same
   packet fields are combined with a 28-octet encryption salt to form a
   28-octet IV (see Section 5.2 and Section 6.2).

4.  Generic AEAD Processing

4.1.  AEAD Invocation Inputs and Outputs

4.1.1.  Encrypt Mode

     Inputs:
       Encryption_key         Octet string, 16 or 32 octets
       Initialization_Vector  Octet string, 12 or 28 octets
       Associated_Data        Octet string of variable length
       Plaintext              Octet string of variable length

     Outputs:
       Ciphertext             Octet string, length =
                                length(Plaintext) + tag_length

   The ciphertext consists of the encrypted Plaintext followed by the
   authentication tag.

4.1.2.  Decrypt Mode

  Inputs:
    Encryption_key         Octet string, 16 or 32 octets
    Initialization_Vector  Octet string, 12 or 28 octets
    Associated_Data        Octet string of variable length
    Ciphertext             Octet string of variable length

  Outputs:
    Plaintext              Octet string, length = length(Ciphertext) - tag_length
    Validity_Flag          Boolean, TRUE if valid, FALSE otherwise

4.2.  Handling of AEAD Authentication

   All incoming packets MUST pass AEAD authentication before any other
   action takes place.  Plaintext and Associated Data MUST NOT be
   released until the AEAD authentication tag has been validated.
   Should the AEAD authentication tag prove to be invalid, the packet
   MUST be discarded.

5.  GCM-SST Processing for SRTP

5.1.  SRTP IV Formation for GCM-SST

Westerlund & Preuß MattssExpires 7 January 2027                 [Page 6]
Internet-Draft              GCM-SST for SRTP                   July 2026

                 0  0  0  0  0  0  0  0  0  0  1  1
                 0  1  2  3  4  5  6  7  8  9  0  1
               +--+--+--+--+--+--+--+--+--+--+--+--+
               |00|00|    SSRC   |     ROC   | SEQ |---+
               +--+--+--+--+--+--+--+--+--+--+--+--+   |
                                                       |
               +--+--+--+--+--+--+--+--+--+--+--+--+   |
               |         Encryption Salt           |->(+)
               +--+--+--+--+--+--+--+--+--+--+--+--+   |
                                                       |
               +--+--+--+--+--+--+--+--+--+--+--+--+   |
               |       Initialization Vector       |<--+
               +--+--+--+--+--+--+--+--+--+--+--+--+

        Figure 1: GCM-SST SRTP Initialization Vector Formation (AES)

   The 12-octet IV used by AES-GCM-SST SRTP is formed by first
   concatenating 2 octets of zeroes, the 4-octet SSRC, the 4-octet
   rollover counter (ROC), and the 2-octet sequence number (SEQ).  The
   resulting 12-octet value is then XORed with the 12-octet salt to form
   the IV.

5.2.  SRTP IV Formation for Rijndael-GCM-SST

     0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |         0 (18 octets)             |  SSRC | ROC   |SEQ|---+
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
                                                                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
    |             Encryption Salt (28 octets)               |->(+)
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
                                                                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
    |          Initialization Vector (28 octets)            |<--+
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      Figure 2: Rijndael-GCM-SST SRTP Initialization Vector Formation

   The 28-octet IV used by Rijndael-GCM-SST SRTP is formed by first
   concatenating 18 octets of zeroes, the 4-octet SSRC, the 4-octet
   rollover counter (ROC), and the 2-octet sequence number (SEQ).  The
   resulting 28-octet value is then XORed with the 28-octet salt to form
   the IV.  The larger salt provides significantly greater security
   against precomputation and multi-key attacks compared to the AES-
   based cipher suites.

Westerlund & Preuß MattssExpires 7 January 2027                 [Page 7]
Internet-Draft              GCM-SST for SRTP                   July 2026

5.3.  Data Types in SRTP Packets

   All SRTP packets MUST be both authenticated and encrypted.  The data
   fields within RTP packets are broken into Associated Data, Plaintext,
   and Raw Data as follows:

   Associated Data:  The RTP header fields: version V (2 bits), padding
      flag P (1 bit), extension flag X (1 bit), CSRC count CC (4 bits),
      marker M (1 bit), Payload Type PT (7 bits), sequence number (16
      bits), timestamp (32 bits), SSRC (32 bits), optional CSRC
      identifiers, and optional RTP extension.

   Plaintext:  The RTP payload, RTP padding (if used), and RTP pad count
      (if used).

   Raw Data:  The optional SRTP Master Key Identifier (MKI) and SRTP
      authentication tag (whose use is NOT RECOMMENDED).

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|V=2|P|X|  CC   |M|     PT      |       sequence number         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|                           timestamp                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|           synchronization source (SSRC) identifier            |
    +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
   A|            contributing source (CSRC) identifiers             |
   A|                             ....                              |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|                   RTP extension (OPTIONAL)                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   P|                          payload  ...                         |
   P|                               +-------------------------------+
   P|                               | RTP padding   | RTP pad count |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     P = Plaintext   A = Associated Data

            Figure 3: RTP Packet before Authenticated Encryption

Westerlund & Preuß MattssExpires 7 January 2027                 [Page 8]
Internet-Draft              GCM-SST for SRTP                   July 2026

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|V=2|P|X|  CC   |M|     PT      |       sequence number         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|                           timestamp                           |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|           synchronization source (SSRC) identifier            |
    +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
   A|            contributing source (CSRC) identifiers             |
   A|                             ....                              |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|                   RTP extension (OPTIONAL)                    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   C|                          cipher ...                           |
   C|                             ...                               |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   R:                     SRTP MKI (OPTIONAL)                       :
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   R:           SRTP authentication tag (NOT RECOMMENDED)           :
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     C = Ciphertext   A = Associated Data   R = Raw Data

            Figure 4: SRTP Packet after Authenticated Encryption

5.4.  Handling Header Extensions

   When [RFC6904] is in use, a separate keystream is generated to
   encrypt selected RTP header extension elements.  For GCM-SST cipher
   suites using AES-128 keys, this keystream MUST be generated using the
   AES_128_CM transform.  For GCM-SST cipher suites using AES-256 keys
   (including the Rijndael-GCM-SST cipher suites), the keystream MUST be
   generated using the AES_256_CM transform.  The originator MUST
   perform any required header extension encryption before the AEAD
   algorithm is invoked.

   Both encrypted and unencrypted header extensions are treated by the
   AEAD algorithm as Associated Data.  The AEAD algorithm therefore
   provides integrity and authentication for header extensions but no
   additional privacy beyond what RFC 6904 provides.

Westerlund & Preuß MattssExpires 7 January 2027                 [Page 9]
Internet-Draft              GCM-SST for SRTP                   July 2026

5.5.  Prevention of SRTP IV Reuse

   To prevent IV reuse, the (ROC, SEQ, SSRC) triple MUST never be used
   twice with the same master key.  A rekey MUST be performed before the
   (ROC, SEQ) pair cycles back to its original value.  For a given
   master key, the set of all SSRC values MUST be partitioned into
   disjoint pools, one per originating endpoint, and each endpoint MUST
   only use SSRC values from its assigned pool.

6.  GCM-SST Processing for SRTCP

   All SRTCP compound packets MUST be authenticated.  SRTCP packet
   encryption is optional and indicated by a 1-bit Encryption flag
   located just before the 31-bit SRTCP index.

   When using the AEAD_AES_128_GCM_SST_6, AEAD_AES_256_GCM_SST_6, or
   AEAD_RIJNDAEL_GCM_SST_6 cipher suites (which use 48-bit tags for
   SRTP), implementations MUST use 96-bit (12-octet) authentication tags
   for SRTCP packets.  For all other cipher suites, the SRTCP tag length
   MUST match the SRTP tag length.

6.1.  SRTCP IV Formation for AES-GCM-SST

                 0  1  2  3  4  5  6  7  8  9 10 11
               +--+--+--+--+--+--+--+--+--+--+--+--+
               |00|00|    SSRC   |00|00|0+SRTCP Idx|---+
               +--+--+--+--+--+--+--+--+--+--+--+--+   |
                                                       |
               +--+--+--+--+--+--+--+--+--+--+--+--+   |
               |         Encryption Salt           |->(+)
               +--+--+--+--+--+--+--+--+--+--+--+--+   |
                                                       |
               +--+--+--+--+--+--+--+--+--+--+--+--+   |
               |       Initialization Vector       |<--+
               +--+--+--+--+--+--+--+--+--+--+--+--+

       Figure 5: GCM-SST SRTCP Initialization Vector Formation (AES)

   The 12-octet IV used by AES-GCM-SST SRTCP is formed by concatenating
   2 octets of zeroes, the 4-octet SSRC, 2 octets of zeroes, a single
   "0" bit, and the 31-bit SRTCP index.  The resulting 12-octet value is
   then XORed with the 12-octet salt to form the IV.

6.2.  SRTCP IV Formation for Rijndael-GCM-SST

Westerlund & Preuß MattssExpires 7 January 2027                [Page 10]
Internet-Draft              GCM-SST for SRTP                   July 2026

     0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |         0 (18 octets)             |  SSRC |0 0|0+RTCPi|---+
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
                                                                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
    |             Encryption Salt (28 octets)               |->(+)
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
                                                                |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   |
    |          Initialization Vector (28 octets)            |<--+
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      Figure 6: Rijndael-GCM-SST SRTCP Initialization Vector Formation

   The 28-octet IV used by Rijndael-GCM-SST SRTCP is formed by
   concatenating 18 octets of zeroes, the 4-octet SSRC, 2 octets of
   zeroes, a single "0" bit, and the 31-bit SRTCP index.  The resulting
   28-octet value is then XORed with the 28-octet salt to form the IV.

6.3.  Data Types in Encrypted SRTCP Packets

   When the Encryption flag is set to 1:

   Associated Data:  Version V (2 bits), padding flag P (1 bit),
      reception report count RC (5 bits), Packet Type (8 bits), length
      (2 octets), SSRC (4 octets), Encryption flag (1 bit), and SRTCP
      index (31 bits).

   Plaintext:  All other data.

   Raw Data:  The optional SRTCP MKI and SRTCP authentication tag (NOT
      RECOMMENDED).

Westerlund & Preuß MattssExpires 7 January 2027                [Page 11]
Internet-Draft              GCM-SST for SRTP                   July 2026

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|V=2|P|   RC    |  Packet Type  |            length             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|           synchronization source (SSRC) of sender             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   P|                         sender info                           :
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   P|                        report blocks ...                      :
    +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
   P|                       additional packets ...                  :
    +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
   A|1|                         SRTCP index                         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   R:                  SRTCP MKI (OPTIONAL)                         :
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   R:           SRTCP authentication tag (NOT RECOMMENDED)          :
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     P = Plaintext   A = Associated Data   R = Raw Data

            Figure 7: AEAD SRTCP Inputs When Encryption Flag = 1

6.4.  Data Types in Unencrypted SRTCP Packets

   When the Encryption flag is set to 0:

   Plaintext:  None.

   Associated Data:  All data except the optional SRTCP MKI and
      authentication tag.

   Raw Data:  The optional SRTCP MKI and SRTCP authentication tag (NOT
      RECOMMENDED).

Westerlund & Preuß MattssExpires 7 January 2027                [Page 12]
Internet-Draft              GCM-SST for SRTP                   July 2026

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|V=2|P|   RC    |  Packet Type  |            length             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|           synchronization source (SSRC) of sender             |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|                         sender info                           :
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   A|                        report blocks ...                      :
    +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
   A|                       additional packets ...                  :
    +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
   A|0|                         SRTCP index                         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   R:                  SRTCP MKI (OPTIONAL)                         :
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   R:              authentication tag (NOT RECOMMENDED)             :
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

     A = Associated Data   R = Raw Data

            Figure 8: AEAD SRTCP Inputs When Encryption Flag = 0

6.5.  Prevention of SRTCP IV Reuse

   A new master key MUST be established before the 31-bit SRTCP index
   cycles back to its original value.  The comments on SSRC management
   in Section 5.5 also apply to SRTCP.

7.  Unneeded SRTP/SRTCP Fields

7.1.  SRTP/SRTCP Authentication Tag Field

   The AEAD message authentication mechanism MUST be the primary message
   authentication mechanism.  Additional SRTP/SRTCP authentication
   mechanisms SHOULD NOT be used, and the optional SRTP/SRTCP
   authentication tags are NOT RECOMMENDED and SHOULD NOT be present.

7.2.  RTP Padding

   GCM-SST does not require data to be padded to a specific block size.
   It is RECOMMENDED that the RTP padding mechanism not be used unless
   necessary to disguise the length of the underlying Plaintext.

Westerlund & Preuß MattssExpires 7 January 2027                [Page 13]
Internet-Draft              GCM-SST for SRTP                   July 2026

8.  Constraints on AEAD for SRTP and SRTCP

   All AEAD algorithms used with SRTP/SRTCP MUST satisfy the following
   constraints:

        +===========+====================+========================+
        | Parameter | Meaning            | Value                  |
        +===========+====================+========================+
        | A_MAX     | Maximum Associated | MUST be at least 12    |
        |           | Data length        | octets                 |
        +-----------+--------------------+------------------------+
        | N_MIN     | Minimum nonce (IV) | 12 octets (AES) or 28  |
        |           | length             | octets (Rijndael)      |
        +-----------+--------------------+------------------------+
        | N_MAX     | Maximum nonce (IV) | 12 octets (AES) or 28  |
        |           | length             | octets (Rijndael)      |
        +-----------+--------------------+------------------------+
        | P_MAX     | Maximum Plaintext  | 2^15 octets (AES) or   |
        |           | length             | 2^16 octets (Rijndael) |
        +-----------+--------------------+------------------------+
        | C_MAX     | Maximum ciphertext | P_MAX + tag_length     |
        |           | length             |                        |
        +-----------+--------------------+------------------------+

                  Table 1: AEAD Constraints for SRTP/SRTCP

   Additional parameters:

   *  E_MAX (maximum number of encryption invocations per key): E_MAX is
      2^48 for SRTP and 2^31 for SRTCP.  SRTP and SRTCP use separate
      derived keys and therefore have independent invocation counts.

   *  D_MAX (maximum number of decryption invocations per key): For AES-
      GCM-SST cipher suites, D_MAX is 2^54.  For Rijndael-GCM-SST cipher
      suites, D_MAX is 2^118.

   For AES-GCM-SST, [I-D.mattsson-cfrg-aes-gcm-sst] recommends that
   protocols enforce E_MAX · P_MAX / 16 ⪅ 2^59.  With E_MAX of 2^48 and
   P_MAX of 2^15 octets, the product E_MAX · P_MAX / 16 = 2^59, which
   satisfies this bound.  If an application requires larger packets,
   P_MAX MAY be increased provided that E_MAX is reduced accordingly so
   that E_MAX · P_MAX / 16 ⪅ 2^59 remains satisfied, and a rekey MUST be
   performed before E_MAX is reached.  For Rijndael-GCM-SST, the 256-bit
   block size guarantees δ ≈ 1 without requiring this constraint, and
   P_MAX is set to 2^16 octets with E_MAX of 2^48.

Westerlund & Preuß MattssExpires 7 January 2027                [Page 14]
Internet-Draft              GCM-SST for SRTP                   July 2026

9.  Key Derivation Functions

   A Key Derivation Function (KDF) is used to derive all required
   encryption keys and salts from the shared master key.  The AES-128-
   GCM-SST cipher suites MUST use the AES_128_CM_PRF KDF described in
   [RFC3711].  The AES-256-GCM-SST and Rijndael-GCM-SST cipher suites
   MUST use the AES_256_CM_PRF KDF described in [RFC6188].

   For the Rijndael-GCM-SST cipher suites, the KDF MUST derive a 256-bit
   encryption key and a 224-bit (28-octet) encryption salt.  The master
   salt for Rijndael-GCM-SST is 224 bits.

10.  Summary of GCM-SST Cipher Suites in SRTP/SRTCP

   The following GCM-SST cipher suites are defined for use with SRTP/
   SRTCP:

           +==========================+===========+===========+
           | Name                     | Key Size  | Tag Size  |
           +==========================+===========+===========+
           | AEAD_AES_128_GCM_SST_6   | 16 octets | 6 octets  |
           +--------------------------+-----------+-----------+
           | AEAD_AES_128_GCM_SST_12  | 16 octets | 12 octets |
           +--------------------------+-----------+-----------+
           | AEAD_AES_128_GCM_SST_14  | 16 octets | 14 octets |
           +--------------------------+-----------+-----------+
           | AEAD_AES_256_GCM_SST_6   | 32 octets | 6 octets  |
           +--------------------------+-----------+-----------+
           | AEAD_AES_256_GCM_SST_12  | 32 octets | 12 octets |
           +--------------------------+-----------+-----------+
           | AEAD_AES_256_GCM_SST_14  | 32 octets | 14 octets |
           +--------------------------+-----------+-----------+
           | AEAD_RIJNDAEL_GCM_SST_6  | 32 octets | 6 octets  |
           +--------------------------+-----------+-----------+
           | AEAD_RIJNDAEL_GCM_SST_12 | 32 octets | 12 octets |
           +--------------------------+-----------+-----------+
           | AEAD_RIJNDAEL_GCM_SST_14 | 32 octets | 14 octets |
           +--------------------------+-----------+-----------+

              Table 2: GCM-SST Cipher Suites for SRTP/SRTCP

Westerlund & Preuß MattssExpires 7 January 2027                [Page 15]
Internet-Draft              GCM-SST for SRTP                   July 2026

     +================================+=============================+
     | Parameter                      | AEAD_AES_128_GCM_SST_6      |
     +================================+=============================+
     | Master key length              | 128 bits                    |
     +--------------------------------+-----------------------------+
     | Master salt length             | 96 bits                     |
     +--------------------------------+-----------------------------+
     | Key Derivation Function        | AES_128_CM_PRF [RFC3711]    |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTP)                   | 2^48 encryption invocations |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTCP)                  | 2^31 encryption invocations |
     +--------------------------------+-----------------------------+
     | D_MAX                          | 2^54 decryption invocations |
     +--------------------------------+-----------------------------+
     | AEAD authentication tag length | 48 bits                     |
     +--------------------------------+-----------------------------+

               Table 3: AEAD_AES_128_GCM_SST_6 Crypto Suite

     +================================+=============================+
     | Parameter                      | AEAD_AES_128_GCM_SST_12     |
     +================================+=============================+
     | Master key length              | 128 bits                    |
     +--------------------------------+-----------------------------+
     | Master salt length             | 96 bits                     |
     +--------------------------------+-----------------------------+
     | Key Derivation Function        | AES_128_CM_PRF [RFC3711]    |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTP)                   | 2^48 encryption invocations |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTCP)                  | 2^31 encryption invocations |
     +--------------------------------+-----------------------------+
     | D_MAX                          | 2^54 decryption invocations |
     +--------------------------------+-----------------------------+
     | AEAD authentication tag length | 96 bits                     |
     +--------------------------------+-----------------------------+

              Table 4: AEAD_AES_128_GCM_SST_12 Crypto Suite

Westerlund & Preuß MattssExpires 7 January 2027                [Page 16]
Internet-Draft              GCM-SST for SRTP                   July 2026

     +================================+=============================+
     | Parameter                      | AEAD_AES_128_GCM_SST_14     |
     +================================+=============================+
     | Master key length              | 128 bits                    |
     +--------------------------------+-----------------------------+
     | Master salt length             | 96 bits                     |
     +--------------------------------+-----------------------------+
     | Key Derivation Function        | AES_128_CM_PRF [RFC3711]    |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTP)                   | 2^48 encryption invocations |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTCP)                  | 2^31 encryption invocations |
     +--------------------------------+-----------------------------+
     | D_MAX                          | 2^54 decryption invocations |
     +--------------------------------+-----------------------------+
     | AEAD authentication tag length | 112 bits                    |
     +--------------------------------+-----------------------------+

              Table 5: AEAD_AES_128_GCM_SST_14 Crypto Suite

     +================================+=============================+
     | Parameter                      | AEAD_AES_256_GCM_SST_6      |
     +================================+=============================+
     | Master key length              | 256 bits                    |
     +--------------------------------+-----------------------------+
     | Master salt length             | 96 bits                     |
     +--------------------------------+-----------------------------+
     | Key Derivation Function        | AES_256_CM_PRF [RFC6188]    |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTP)                   | 2^48 encryption invocations |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTCP)                  | 2^31 encryption invocations |
     +--------------------------------+-----------------------------+
     | D_MAX                          | 2^54 decryption invocations |
     +--------------------------------+-----------------------------+
     | AEAD authentication tag length | 48 bits                     |
     +--------------------------------+-----------------------------+

               Table 6: AEAD_AES_256_GCM_SST_6 Crypto Suite

Westerlund & Preuß MattssExpires 7 January 2027                [Page 17]
Internet-Draft              GCM-SST for SRTP                   July 2026

     +================================+=============================+
     | Parameter                      | AEAD_AES_256_GCM_SST_12     |
     +================================+=============================+
     | Master key length              | 256 bits                    |
     +--------------------------------+-----------------------------+
     | Master salt length             | 96 bits                     |
     +--------------------------------+-----------------------------+
     | Key Derivation Function        | AES_256_CM_PRF [RFC6188]    |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTP)                   | 2^48 encryption invocations |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTCP)                  | 2^31 encryption invocations |
     +--------------------------------+-----------------------------+
     | D_MAX                          | 2^54 decryption invocations |
     +--------------------------------+-----------------------------+
     | AEAD authentication tag length | 96 bits                     |
     +--------------------------------+-----------------------------+

              Table 7: AEAD_AES_256_GCM_SST_12 Crypto Suite

     +================================+=============================+
     | Parameter                      | AEAD_AES_256_GCM_SST_14     |
     +================================+=============================+
     | Master key length              | 256 bits                    |
     +--------------------------------+-----------------------------+
     | Master salt length             | 96 bits                     |
     +--------------------------------+-----------------------------+
     | Key Derivation Function        | AES_256_CM_PRF [RFC6188]    |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTP)                   | 2^48 encryption invocations |
     +--------------------------------+-----------------------------+
     | E_MAX (SRTCP)                  | 2^31 encryption invocations |
     +--------------------------------+-----------------------------+
     | D_MAX                          | 2^54 decryption invocations |
     +--------------------------------+-----------------------------+
     | AEAD authentication tag length | 112 bits                    |
     +--------------------------------+-----------------------------+

              Table 8: AEAD_AES_256_GCM_SST_14 Crypto Suite

Westerlund & Preuß MattssExpires 7 January 2027                [Page 18]
Internet-Draft              GCM-SST for SRTP                   July 2026

     +================================+==============================+
     | Parameter                      | AEAD_RIJNDAEL_GCM_SST_6      |
     +================================+==============================+
     | Master key length              | 256 bits                     |
     +--------------------------------+------------------------------+
     | Master salt length             | 224 bits                     |
     +--------------------------------+------------------------------+
     | Key Derivation Function        | AES_256_CM_PRF [RFC6188]     |
     +--------------------------------+------------------------------+
     | E_MAX (SRTP)                   | 2^48 encryption invocations  |
     +--------------------------------+------------------------------+
     | E_MAX (SRTCP)                  | 2^31 encryption invocations  |
     +--------------------------------+------------------------------+
     | D_MAX                          | 2^118 decryption invocations |
     +--------------------------------+------------------------------+
     | AEAD authentication tag length | 48 bits                      |
     +--------------------------------+------------------------------+

               Table 9: AEAD_RIJNDAEL_GCM_SST_6 Crypto Suite

     +================================+==============================+
     | Parameter                      | AEAD_RIJNDAEL_GCM_SST_12     |
     +================================+==============================+
     | Master key length              | 256 bits                     |
     +--------------------------------+------------------------------+
     | Master salt length             | 224 bits                     |
     +--------------------------------+------------------------------+
     | Key Derivation Function        | AES_256_CM_PRF [RFC6188]     |
     +--------------------------------+------------------------------+
     | E_MAX (SRTP)                   | 2^48 encryption invocations  |
     +--------------------------------+------------------------------+
     | E_MAX (SRTCP)                  | 2^31 encryption invocations  |
     +--------------------------------+------------------------------+
     | D_MAX                          | 2^118 decryption invocations |
     +--------------------------------+------------------------------+
     | AEAD authentication tag length | 96 bits                      |
     +--------------------------------+------------------------------+

              Table 10: AEAD_RIJNDAEL_GCM_SST_12 Crypto Suite

Westerlund & Preuß MattssExpires 7 January 2027                [Page 19]
Internet-Draft              GCM-SST for SRTP                   July 2026

     +================================+==============================+
     | Parameter                      | AEAD_RIJNDAEL_GCM_SST_14     |
     +================================+==============================+
     | Master key length              | 256 bits                     |
     +--------------------------------+------------------------------+
     | Master salt length             | 224 bits                     |
     +--------------------------------+------------------------------+
     | Key Derivation Function        | AES_256_CM_PRF [RFC6188]     |
     +--------------------------------+------------------------------+
     | E_MAX (SRTP)                   | 2^48 encryption invocations  |
     +--------------------------------+------------------------------+
     | E_MAX (SRTCP)                  | 2^31 encryption invocations  |
     +--------------------------------+------------------------------+
     | D_MAX                          | 2^118 decryption invocations |
     +--------------------------------+------------------------------+
     | AEAD authentication tag length | 112 bits                     |
     +--------------------------------+------------------------------+

              Table 11: AEAD_RIJNDAEL_GCM_SST_14 Crypto Suite

11.  Security Considerations

11.1.  Handling of Security-Critical Parameters

   The following security-critical parameters must be handled properly:

   *  The master salt, if kept secret, MUST be properly erased when no
      longer needed.

   *  The secret master key and all keys derived from it MUST be kept
      secret and MUST be properly erased when no longer needed.

   *  Each time a rekey occurs, the initial values of both the 31-bit
      SRTCP index and the 48-bit SRTP packet index (ROC||SEQ) MUST be
      saved to prevent IV reuse.

   *  Processing MUST cease if either the 31-bit SRTCP index or the
      48-bit SRTP packet index cycles back to its initial value.
      Processing MUST NOT resume until a new session has been
      established using a new master key.

   *  GCM-SST MUST be used in a nonce-respecting setting.  For a given
      key, a nonce MUST only be used once in the encryption function and
      only once in a successful decryption function call.  Nonce reuse
      enables universal forgery.

Westerlund & Preuß MattssExpires 7 January 2027                [Page 20]
Internet-Draft              GCM-SST for SRTP                   July 2026

11.2.  Size of the Authentication Tag

   The GCM-SST tag_length SHOULD NOT be smaller than 4 octets.  Unlike
   AES-GCM, GCM-SST provides near-ideal forgery probabilities even for
   short tags, making 48-bit tags suitable for applications such as
   audio packet encryption where overhead is critical.  The 96-bit and
   112-bit tag lengths provide higher security margins suitable for most
   other SRTP use cases.  Implementations MUST use the tag length
   associated with the negotiated cipher suite and MUST NOT truncate or
   extend the tag.

11.3.  Replay Protection

   GCM-SST MUST be used with replay protection.  The SRTP sequence
   number and rollover counter, or the SRTCP index, provide the basis
   for replay protection.  For examples of replay protection mechanisms,
   see [RFC4303] and [RFC6479].

11.4.  Rekeying

   Implementations SHOULD rekey well before reaching E_MAX.  To minimize
   the impact of key compromise, rekeying via ephemeral key exchange
   providing forward secrecy SHOULD occur after at most 1 hour or 2^30
   to 2^37 octets of data, whichever comes first.

11.5.  Multicast and Broadcast

   Although GCM-SST offers stronger security than AES-GCM for short
   tags, it is not ideal in multicast or broadcast settings.  A few
   successful forgeries against one or more recipients enable the
   attacker to create a new forgery targeting all other recipients
   sharing the same key.  See Section 5.6 of
   [I-D.mattsson-cfrg-aes-gcm-sst] for further details.

12.  IANA Considerations

12.1.  DTLS-SRTP

   DTLS-SRTP [RFC5764] defines SRTP protection profiles.  IANA is
   requested to register the following SRTP protection profiles:

Westerlund & Preuß MattssExpires 7 January 2027                [Page 21]
Internet-Draft              GCM-SST for SRTP                   July 2026

     SRTP_AEAD_AES_128_GCM_SST_6   = {0x00, TBD1}
     SRTP_AEAD_AES_128_GCM_SST_12  = {0x00, TBD2}
     SRTP_AEAD_AES_128_GCM_SST_14  = {0x00, TBD3}
     SRTP_AEAD_AES_256_GCM_SST_6   = {0x00, TBD4}
     SRTP_AEAD_AES_256_GCM_SST_12  = {0x00, TBD5}
     SRTP_AEAD_AES_256_GCM_SST_14  = {0x00, TBD6}
     SRTP_AEAD_RIJNDAEL_GCM_SST_6  = {0x00, TBD7}
     SRTP_AEAD_RIJNDAEL_GCM_SST_12 = {0x00, TBD8}
     SRTP_AEAD_RIJNDAEL_GCM_SST_14 = {0x00, TBD9}

   The SRTP transform parameters for each protection profile are as
   follows:

  SRTP_AEAD_AES_128_GCM_SST_6
    cipher:                 AES_128_GCM_SST
    cipher_key_length:      128 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   6 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_128_GCM_SST_12
    cipher:                 AES_128_GCM_SST
    cipher_key_length:      128 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   12 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_128_GCM_SST_14
    cipher:                 AES_128_GCM_SST
    cipher_key_length:      128 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   14 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_256_GCM_SST_6
    cipher:                 AES_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   6 octets

Westerlund & Preuß MattssExpires 7 January 2027                [Page 22]
Internet-Draft              GCM-SST for SRTP                   July 2026

    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_256_GCM_SST_12
    cipher:                 AES_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   12 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_AES_256_GCM_SST_14
    cipher:                 AES_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     96 bits
    aead_auth_tag_length:   14 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_RIJNDAEL_GCM_SST_6
    cipher:                 RIJNDAEL_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     224 bits
    aead_auth_tag_length:   6 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_RIJNDAEL_GCM_SST_12
    cipher:                 RIJNDAEL_256_GCM_SST
    cipher_key_length:      256 bits
    cipher_salt_length:     224 bits
    aead_auth_tag_length:   12 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

  SRTP_AEAD_RIJNDAEL_GCM_SST_14
    cipher:                 RIJNDAEL_256_GCM_SST
    cipher_key_length:      256 bits

Westerlund & Preuß MattssExpires 7 January 2027                [Page 23]
Internet-Draft              GCM-SST for SRTP                   July 2026

    cipher_salt_length:     224 bits
    aead_auth_tag_length:   14 octets
    auth_function:          NULL
    auth_key_length:        N/A
    auth_tag_length:        N/A
    maximum lifetime:       at most 2^31 SRTCP packets and at most 2^48 SRTP packets

12.2.  MIKEY

   In accordance with [RFC3830], IANA is requested to add the following
   to the "Encryption algorithm (Value 0)" subregistry:

   +=======================+=======+===================+===============+
   | SRTP Encr.            | Value | Default Session   | Default Auth. |
   | Algorithm             |       | Encr.  Key Length | Tag Length    |
   +=======================+=======+===================+===============+
   | AES-GCM-SST           | TBD10 | 16 octets         | variable      |
   +-----------------------+-------+-------------------+---------------+
   | RIJNDAEL-256-GCM-SST  | TBD11 | 32 octets         | variable      |
   +-----------------------+-------+-------------------+---------------+

             Table 12: MIKEY Encryption Algorithm Registration

12.3.  Parameters for Use with MIKEY

   MIKEY specifies the algorithm family separately from the key length
   and authentication tag length.

Westerlund & Preuß MattssExpires 7 January 2027                [Page 24]
Internet-Draft              GCM-SST for SRTP                   July 2026

    +==========================+====================+==========+======+
    | AEAD Algorithm           |Encryption Algorithm|Encryption|AEAD  |
    |                          |                    |Key Length|Auth. |
    |                          |                    |          |Tag   |
    |                          |                    |          |Length|
    +==========================+====================+==========+======+
    | AEAD_AES_128_GCM_SST_6   |AES-GCM-SST         |16 octets |6     |
    |                          |                    |          |octets|
    +--------------------------+--------------------+----------+------+
    | AEAD_AES_128_GCM_SST_12  |AES-GCM-SST         |16 octets |12    |
    |                          |                    |          |octets|
    +--------------------------+--------------------+----------+------+
    | AEAD_AES_128_GCM_SST_14  |AES-GCM-SST         |16 octets |14    |
    |                          |                    |          |octets|
    +--------------------------+--------------------+----------+------+
    | AEAD_AES_256_GCM_SST_6   |AES-GCM-SST         |32 octets |6     |
    |                          |                    |          |octets|
    +--------------------------+--------------------+----------+------+
    | AEAD_AES_256_GCM_SST_12  |AES-GCM-SST         |32 octets |12    |
    |                          |                    |          |octets|
    +--------------------------+--------------------+----------+------+
    | AEAD_AES_256_GCM_SST_14  |AES-GCM-SST         |32 octets |14    |
    |                          |                    |          |octets|
    +--------------------------+--------------------+----------+------+
    | AEAD_RIJNDAEL_GCM_SST_6  |RIJNDAEL-256-GCM-SST|32 octets |6     |
    |                          |                    |          |octets|
    +--------------------------+--------------------+----------+------+
    | AEAD_RIJNDAEL_GCM_SST_12 |RIJNDAEL-256-GCM-SST|32 octets |12    |
    |                          |                    |          |octets|
    +--------------------------+--------------------+----------+------+
    | AEAD_RIJNDAEL_GCM_SST_14 |RIJNDAEL-256-GCM-SST|32 octets |14    |
    |                          |                    |          |octets|
    +--------------------------+--------------------+----------+------+

       Table 13: Mapping MIKEY Parameters to GCM-SST AEAD Algorithms

13.  References

13.1.  Normative References

   [I-D.mattsson-cfrg-aes-gcm-sst]
              Campagna, M., Maximov, A., and J. P. Mattsson, "Galois
              Counter Mode with Strong Secure Tags (GCM-SST)", Work in
              Progress, Internet-Draft, draft-mattsson-cfrg-aes-gcm-sst-
              21, 5 July 2026, <https://datatracker.ietf.org/doc/html/
              draft-mattsson-cfrg-aes-gcm-sst-21>.

Westerlund & Preuß MattssExpires 7 January 2027                [Page 25]
Internet-Draft              GCM-SST for SRTP                   July 2026

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

   [RFC3550]  Schulzrinne, H., Casner, S., Frederick, R., and V.
              Jacobson, "RTP: A Transport Protocol for Real-Time
              Applications", STD 64, RFC 3550, DOI 10.17487/RFC3550,
              July 2003, <https://www.rfc-editor.org/info/rfc3550>.

   [RFC3711]  Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K.
              Norrman, "The Secure Real-time Transport Protocol (SRTP)",
              RFC 3711, DOI 10.17487/RFC3711, March 2004,
              <https://www.rfc-editor.org/info/rfc3711>.

   [RFC3830]  Arkko, J., Carrara, E., Lindholm, F., Naslund, M., and K.
              Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830,
              DOI 10.17487/RFC3830, August 2004,
              <https://www.rfc-editor.org/info/rfc3830>.

   [RFC5116]  McGrew, D., "An Interface and Algorithms for Authenticated
              Encryption", RFC 5116, DOI 10.17487/RFC5116, January 2008,
              <https://www.rfc-editor.org/info/rfc5116>.

   [RFC5764]  McGrew, D. and E. Rescorla, "Datagram Transport Layer
              Security (DTLS) Extension to Establish Keys for the Secure
              Real-time Transport Protocol (SRTP)", RFC 5764,
              DOI 10.17487/RFC5764, May 2010,
              <https://www.rfc-editor.org/info/rfc5764>.

   [RFC6188]  McGrew, D., "The Use of AES-192 and AES-256 in Secure
              RTP", RFC 6188, DOI 10.17487/RFC6188, March 2011,
              <https://www.rfc-editor.org/info/rfc6188>.

   [RFC6904]  Lennox, J., "Encryption of Header Extensions in the Secure
              Real-time Transport Protocol (SRTP)", RFC 6904,
              DOI 10.17487/RFC6904, April 2013,
              <https://www.rfc-editor.org/info/rfc6904>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

13.2.  Informative References

   [RFC4303]  Kent, S., "IP Encapsulating Security Payload (ESP)",
              RFC 4303, DOI 10.17487/RFC4303, December 2005,
              <https://www.rfc-editor.org/info/rfc4303>.

Westerlund & Preuß MattssExpires 7 January 2027                [Page 26]
Internet-Draft              GCM-SST for SRTP                   July 2026

   [RFC6479]  Zhang, X. and T. Tsou, "IPsec Anti-Replay Algorithm
              without Bit Shifting", RFC 6479, DOI 10.17487/RFC6479,
              January 2012, <https://www.rfc-editor.org/info/rfc6479>.

Acknowledgments

   The authors would like to thank the authors of RFC 7714, David McGrew
   and Kevin Igoe, whose document structure this specification closely
   follows.  The authors also thank the authors of
   [I-D.mattsson-cfrg-aes-gcm-sst], Matthew Campagna, Alexander Maximov,
   and John Preuß Mattsson, for defining the GCM-SST algorithm.

Authors' Addresses

   Magnus Westerlund
   Ericsson
   Email: magnus.westerlund@ericsson.com

   John Preuß Mattsson
   Ericsson
   Email: john.mattsson@ericsson.com

Westerlund & Preuß MattssExpires 7 January 2027                [Page 27]