Messaging supports Secure RTP media encryption based on RFC3711. Dynamically-generated, symmetric encryption keys are used for encrypting RTP bearer traffic when enabled for SIP-based integration. SRTP for SIP uses RFC 4568 Session Description Protocol (SDP) Security Descriptions for Media Streams to distribute the media encryption keys over SIP-TLS signaling channel which is protected with a 128-bit, AES-encrypted TLS connection.
In all of these media encryption solutions, the media encryption keys are dynamically created on a per-connection basis. Separate keys are produced for the transmit and receive streams of each call. Since all of these keys are dynamically created and assigned, they are stored only in RAM and are not accessible by administrators or users. RTP keys are not escrowed.
SRTP inherently provides anti-replay and integrity protection because once Messaging accepts a packet, it will not accept the same packet again. In addition, packets contain the session key along with the SSRC (synchronization source) that are different for each packet.
| Encryption Technique | Available algorithms | Description |
|---|---|---|
| SRTP | SRTP provides encryption and authentication of RTP streams for calls between SIP-SIP endpoints, and SIP-H.323 endpoints. SIP endpoints cannot use AEA or AES encryption. | |
| 1-srtp-aescm128-hmac80 | Encrypted/Authenticated RTP with 80-bit authentication tag | |
| 2-srtp-aescm128-hmac32 | Encrypted/Authenticated RTP with 32-bit authentication tag | |
| 3-srtp-aescm128-hmac80-unauth | Encrypted RTP but not authenticated | |
| 4-srtp-aescm128-hmac32-unauth | Encrypted RTP but not authenticated | |
| 5-srtp-aescm128-hmac80-unenc | Authenticated RTP with 80-bit authentication tag but not encrypted | |
| 6-srtp-aescm128-hmac32-unenc | Authenticated RTP with 32-bit authentication tag but not encrypted | |
| 7-srtp-aescm128-hmac80-unenc-unauth | Unencrypted/Unauthenticated RTP | |
| 8-srtp-aescm128-hmac32-unenc-unauth | Unencrypted/Unauthenticated RTP |