Re: [AVT] Key exchange for multicast SRTP

["Dan Wing" <[e-mail]>]

 

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On 
> Behalf Of Romain Biehlmann
> Sent: Monday, December 21, 2009 8:34 AM
> To: [e-mail]
> Subject: [AVT] Key exchange for multicast SRTP
> 
> Hi all,
> 
> In advance, I apologize if my request is misplaced: I just 
> had no idea where to ask for expert advice.
> I'd like to use multicast SRTP on a 802.1x network (i.e. 
> eavesdroppers are the only problem, there should be no man in 
> the middle) and to have a frequently renewed group master key.
> From my point of view, the best solution would be to have a 
> Diffie-Hellman key exchange (in order not to have more public 
> key infrastructure) where the group symmetric key would be 
> ciphered by the symmetric key (and therefore sent in the same 
> time as DHr, so everything would still be done in one round trip).

I'm not sure how DH could be used to establish the same
symmetric key with a bunch of different listeners.

> EKT would be used for the group symmetric key renewal.
> Have I missed an article already describing such a solution?
> Would it be a clean solution according to you?

EKT is helpful to rotate the SRTP key.  It isn't helpful to
change the group symmetric key (that is, the key that encrypts
the SRTP key -- the "KEK"), because every authorized listener 
needs to know the KEK.  So if you have listeners joining/leaving,
and want to deny members that are not current 'active' 
listeners the SRTP key, they need to be denied the KEK, too --
which means the KEK needs to be changed and the SRTP key
needs to be changed.

-d

> I thank you very much for your valuable time.
> 
> ---
> Alice
> p = D303B61A16A14BA5B482C7F23EDBC22F906267596AC32797AEF306138A44DE73
> g = 5
> privateKey = 
> 75C31F842480CEBF87B6F091C2CBAFF931690C8967F310B34C5E14D086D141C4
> publicKey = 
> 2054F2452528B0CBACD9ED31A92304F40F262F60560AAD2969C95DDD1CDBF1B6
> ---
> Alice -> p, g, publicKeyAlice -> Bob
> ---
> Bob
> p = D303B61A16A14BA5B482C7F23EDBC22F906267596AC32797AEF306138A44DE73
> g = 5
> privateKey = 
> 7E15B2E88394C2206E43E2AB44734D7317D14067133C818AF081A607B63ADF9F
> publicKey = 
> E7453D0D9E142C1C83C81E596ABE092FE92E0C952ACE7E71E30B81359A58737
> Symmetric key = 
> 5872C67E4BDA9A407B180891B1EA9EE5C4D3E719417A4477328B87D99DC6EB79
> <Group symmetric key ciphered here with the symmetric key>
> ---
> Bob -> p, g, publicKeyBob, groupSymmetricKey -> Alice
> ---
> Alice
> Symmetric key = 
> 5872C67E4BDA9A407B180891B1EA9EE5C4D3E719417A4477328B87D99DC6EB79
> <Group symmetric key deciphered here with the symmetric key>
> ---
> 
> RB
> 
>