The Use of AES-192 and AES-256 in Secure RTP
Extracted elements (20)
The crypto suites retain HMAC-SHA1 with 160-bit authentication keys (rather than 192- or 256-bit keys) because HMAC-SHA1 has only 160 bits of internal state and larger keys provide no additional security. This also maximizes compatibility with existing SRTP implementations.
The KDF strength requirement (KDF must meet or exceed cipher strength) is the reason a weaker PRF is prohibited with a stronger cipher. Using the same function for both encryption and KDF is natural but not required, to allow future alternative KDFs to be paired with these ciphers.
The crypto functions in RFC 6188 are an addition to, not a replacement for, the crypto functions defined in RFC 3711 (SRTP). The Suite B profile requires AES-256, but the crypto suites here use HMAC-SHA1 which is not part of Suite B.
AES_256_CM_PRF MAY be used as the key derivation function when AES_CM or AES_192_CM is used for encryption. AES_192_CM_PRF MAY be used when AES_CM is used for encryption.
When AES_192_CM is used for encryption, AES_128_CM_PRF MUST NOT be used as the key derivation function. AES_192_CM_PRF SHOULD be used instead.
When AES_256_CM is used for encryption, both AES_128_CM_PRF and AES_192_CM_PRF MUST NOT be used as the key derivation function. AES_256_CM_PRF SHOULD be used.
AES_192_CM is AES counter mode encryption using a 192-bit key. It uses the same counter block structure as AES_CM (defined in RFC 3711 Section 4.1.1) with a 112-bit salt input, differing only in the key size.
AES_192_CM_PRF is the AES-192 counter mode key derivation function (KDF) for SRTP. It uses the same counter block structure as the AES_CM PRF (RFC 3711 Section 4.3.3) with a 112-bit salt, using an 8-bit label field and a block counter b_c, but operates with AES-192.
AES_256_CM is AES counter mode encryption using a 256-bit key. It uses the same counter block structure as AES_CM with a 112-bit salt input, differing only in the key size.
AES_256_CM_PRF is the AES-256 counter mode key derivation function for SRTP. It mirrors the AES_CM PRF structure with a 112-bit salt and 8-bit label, but uses AES-256 for the block cipher operation.
The AES_192_CM_HMAC_SHA1_32 crypto suite is identical to AES_192_CM_HMAC_SHA1_80 except the SRTP authentication tag length is 32 bits (SRTCP auth tag remains 80 bits).
The AES_192_CM_HMAC_SHA1_80 crypto suite uses a 192-bit master key, 112-bit master salt, AES_192_CM_PRF as KDF, AES_192_CM for encryption, HMAC-SHA1 with 160-bit auth key, 80-bit SRTP auth tag, 80-bit SRTCP auth tag, and default key lifetime of 2^31 packets.
The AES_256_CM_HMAC_SHA1_32 crypto suite is identical to AES_256_CM_HMAC_SHA1_80 except the SRTP authentication tag length is 32 bits (SRTCP auth tag remains 80 bits).
The AES_256_CM_HMAC_SHA1_80 crypto suite uses a 256-bit master key, 112-bit master salt, AES_256_CM_PRF as KDF, AES_256_CM for encryption, HMAC-SHA1 with 160-bit auth key, 80-bit SRTP auth tag, 80-bit SRTCP auth tag, and default key lifetime of 2^31 packets.
IANA registered four new crypto suite names in the SDP Security Descriptions registry: AES_192_CM_HMAC_SHA1_80, AES_192_CM_HMAC_SHA1_32, AES_256_CM_HMAC_SHA1_80, and AES_256_CM_HMAC_SHA1_32, all referencing RFC 6188.
AES-128 is considered more than adequate for confidentiality today, but AES-192 and AES-256 serve as a fallback against future cryptanalytic advances. AES-256 is conjectured to provide security even against adversaries with quantum computers operating on 256 or more qubits.
AES-256 SHOULD be used whenever the highest possible security is desired. AES-192 MAY be used when security higher than AES-128 is desired. Related-key attacks from the theoretical literature are not applicable because keys are generated from a strong pseudo-random source.
It is desirable (though not security-critical) that AES_192_CM use a 192-bit authentication key and AES_256_CM use a 256-bit authentication key. Because authentication forgery opportunities close when a session ends, this document defines new ciphers but not new authentication functions.
The KDF counter block is 16 octets: 7 zero octets, an 8-bit label byte (LB), a 6-octet (index DIV kdr) field, and a 2-octet block counter b_c. This is XORed with the master salt (padded with two zero octets) before AES encryption.
The SRTP counter mode block is 16 octets: 4 zero octets, a 4-octet SSRC field, a packet index field, and a block counter b_c. This counter block is XORed with the 112-bit salt (padded with two zero octets) before AES encryption to produce keystream blocks.