The SEED Cipher Algorithm and Its Use with the Secure Real-Time Transport Protocol (SRTP)
Extracted elements (16)
SEED is a 128-bit symmetric block cipher with a 128-bit key developed by KISA in 1998, featuring a 16-round Feistel structure. It was designed to increase memory storage efficiency and key generation simplicity without degrading security, making it suitable for resource-constrained environments such as mobile devices and smart cards.
All SRTP packets using SEED-CCM MUST be authenticated and encrypted. SRTCP packet encryption is optional but authentication is mandatory; the encryption choice is indicated by a 1-bit encryption flag in the leftmost bit of the 32-bit word containing the SRTCP index.
An RTP implementation that supports SEED MUST implement SEED-CTR for encryption, HMAC-SHA1 for message integrity, and SEED-CTR for key derivation (PRF). SEED-CCM and SEED-GCM are optional for both encryption and message integrity.
For SEED-CCM, a full 80-bit authentication tag SHOULD be used and implementations MUST support M values of 10 octets. The nonce MUST be 12 octets (L=3).
For SRTP with SEED-CTR, smaller authentication key or tag values are NOT RECOMMENDED but MAY be used after careful consideration of the issues discussed in Sections 7.5 and 9.5 of RFC 3711.
HMAC-SHA1 SHALL be the default message-authentication code used with SEED-CTR. The default session-authentication key length SHALL be 160 bits, the default authentication tag length SHALL be 80 bits, and SRTP_PREFIX_LENGTH SHALL be zero.
When SEED-CTR is used, it MUST be used only in conjunction with an authentication function.
SEED-CCM accepts four inputs: a 128-bit key (SEED supports only 128-bit keys), a 12-octet nonce (15-L octets, L=3), plaintext (RTP payload and padding for SRTP; Encrypted Portion for SRTCP when encryption flag=1), and AAD (RTP header including CSRC and extension for SRTP; first 8 octets, encryption flag, and SRTCP index for SRTCP when encryption flag=1).
SEED-CCM is SEED operating in Counter with CBC-MAC (CCM) mode. For SEED-CCM in SRTP, authentication is performed on the plaintext rather than the ciphertext: the sender performs Step 7 (authentication) before Step 5 (encryption), and the receiver verifies after decryption.
SEED-CTR is SEED operating in counter mode, defined analogously to AES-CM in RFC 3711. Plaintext inputs and block cipher outputs are processed identically to AES-CM, with SEED substituted as the underlying encryption primitive.
SEED-CTR PRF is the key derivation function for SEED-based SRTP, defined analogously to AES-CM PRF in RFC 3711 Section 4.3.3, with each AES invocation replaced by SEED. Keyed by a 128-bit master key, it has input block size m=128 and produces outputs up to 2^23 bits. SEED-PRF_n(k_master, x) = SEED-CTR applied to k_master with IV=(x*2^16), output truncated to n leftmost bits.
SEED-GCM is SEED operating in Galois/Counter Mode, providing both confidentiality and data origin authentication. It uses the same four inputs as SEED-CCM (key, plaintext, nonce, AAD) with an authentication tag length t=12 octets (96 bits).
Three SRTP crypto suites are registered in the IANA subregistry for SRTP crypto suites under SDP Security Descriptions for Media Streams (RFC 4568): SEED_CTR_128_HMAC_SHA1_80, SEED_128_CCM_80, and SEED_128_GCM_96.
No security problem has been found on SEED. It is secure against differential cryptanalysis, linear cryptanalysis, and related key attacks; the best known attack is exhaustive key search. Non-reuse of counter values, critical for CTR and CCM/GCM security, is ensured by SRTP procedures from RFC 3711.
The SRTCP nonce for SEED-CCM and SEED-GCM is 12 octets, formed as: (16 bits of zeroes || 4-octet SSRC || 16 bits of zeroes || 4-octet SRTCP index, zero-filled right-justified) XOR 12-octet Salt. SSRC is from the RTCP header; Salt from the SRTP key derivation function.
The SRTP nonce for SEED-CCM and SEED-GCM is 12 octets, formed as: (16 bits of zeroes || 4-octet SSRC || 4-octet ROC || 2-octet SEQ) XOR 12-octet Salt. SSRC and SEQ are taken from the RTP header; ROC from the cryptographic context; Salt from the SRTP key derivation function.