Re: [rtcweb] Question about srtp_mki in DTLS/SRTP

[Martin Thomson <[e-mail]>]

On 14 January 2015 at 11:37, Simon Perreault <[e-mail]> wrote:
> use_srtp is in ClientHello, and that's renegotiation, right? If so, can you
> end up with new keys without a new MKI?

The use_srtp extension really only allows the peers to negotiate which
SRTP cipher they want to use, it doesn't really establish the keys.
That's the role of the exporter.

In theory, you could derive new SRTP keys without doing a
renegotiation, but we don't have a defined way of doing that.

SRTP is somewhat disconnected from the whole DTLS thing.  So I think
that the idea is that it continues with the old keys until it receives
some signal.  Either an MKI bump, or the sequence number discontinuity
thing Roman suggests using.  Either way, you need some signal *in
SRTP* that the keys have changed.

And then it's down to assumptions: assume that the DTLS master secret
has changed and re-export to get new traffic keys.  Of course, you
*really* need to check that the master secret has changed or you get
into trouble.