Re: [rtcweb] Question about srtp_mki in DTLS/SRTP

[Roman Shpount <[e-mail]>]

On Wed, Jan 14, 2015 at 1:21 PM, Simon Perreault <[e-mail]>
wrote:

>
> On Wed, Jan 14, 2015 at 12:43 PM, Roman Shpount <[e-mail]> wrote:
>
>> Yes, SRTP doesn't carry the epoch and trial decryption sucks, so the
>>> MKI is quite attractive... if you rekey.  However, as it stands, very
>>> few implementations will permit a DTLS re-handshake.  Firefox and
>>> Chrome actively disable renegotiation (desktop Chrome anyway, I'm not
>>> 100% on the BoringSSL-based versions, like Android).
>>>
>>>
>> You can handle the key transition based on the SRTP sequence numbers. Not
>> the greatest thing but it does work.
>>
>
> Please explain.
>
>
You can use the old key, until the first SRTP packet fails to verify, try
to verify the SRTP packet using new key and record sequence number for this
SSRC as the first sequence for which new key is used. For all subsequent
packets use the new SRTP key. For all previous -- repeat the above process.
This should work in the absence of MKI. At the end of the day this is
simply optimization of trying to decode using multiple keys. You do need to
maintain the list of old keys, time them out, and keep the sequence numbers
for each SSRC where you start using each key.

_____________
Roman Shpount