Guidelines for the Use of Variable Bit Rate Audio with Secure RTP
Extracted elements (16)
The significance of VBR information leakage is highly scenario-dependent. Near-perfect recognition is possible for prerecorded messages with a known message set; structured dialogs are also vulnerable. Recognizing unconstrained conversational speech from rate information alone is currently unreliable but expected to improve over time.
VAD information leakage in SRTP is less severe than full VBR leakage because VAD produces only two possible rates (active speech vs. silence/comfort noise), whereas VBR exposes a continuous range of packet sizes correlated with fine-grained speech characteristics.
VBR audio can be safely used with SRTP for congestion control purposes provided the packet size variation is driven entirely by available network bandwidth rather than by the speech signal itself — in that case, packet sizes and spacing are constant unless network conditions change, so no speech information is exposed.
SRTP leaves the RTP header and any header extension in the clear and provides only payload encryption. None of the predefined SRTP encryption transforms apply any padding, so RTP and SRTP payload sizes match exactly, meaning packet-length variation directly reflects codec output variation.
An RTP sender using VAD with encrypted SRTP audio SHOULD insert an unpredictable overhang period at the end of each talkspurt, delaying the start of the silence/comfort noise interval by a random amount to obscure the actual length of active speech intervals.
Applications conveying highly sensitive unstructured information SHOULD NOT use codecs in VBR mode.
Applications that use prerecorded messages whose contents may be of any value to an eavesdropper SHOULD NOT use codecs in VBR mode. IVR applications are particularly vulnerable because rate information can be used to recognize prompts.
For scenarios where VBR is considered unsafe, a CBR codec SHOULD be negotiated and used instead, or the VBR codec SHOULD be operated in a CBR mode. If the codec does not support CBR, RTP padding SHOULD be used to reduce the information leak to an insignificant level.
It is RECOMMENDED to add at least one octet of RTP padding to all packets in a media stream. Because SRTP encrypts the padding octet count but not the RTP header padding bit, adding padding to every packet prevents an attacker from determining which packets required padding.
The most secure and RECOMMENDED padding option is to pad all packets throughout the call to the same constant size. Padding to the next multiple of 16 octets has been shown to achieve good results in practice.
The overhang period length MUST be randomly chosen such that it is computationally infeasible for an attacker to reliably estimate the talkspurt length. Audio data comprising the overhang MUST be packetized and transmitted in a manner indistinguishable from other talkspurt data.
The VAD overhang period SHOULD have an exponentially decreasing probability distribution function, and it is RECOMMENDED to use an overhang with a half-life of a few hundred milliseconds to obscure interword pauses and single-word lengths without excessively reducing VAD effectiveness.
VAD SHOULD NOT be used in encrypted IVR applications where the content of prerecorded messages may be of any value to an eavesdropper, because information about talkspurt start times still leaks even with overhang applied.
When padded packet sizes vary over time, padding SHOULD NOT be reduced without waiting for a random hold time. The RECOMMENDED hold time uses the same exponentially distributed duration as the VAD overhang (half-life of a few hundred milliseconds).
SRTP encrypts the count of padding octets added to a packet but leaves the RTP header padding indicator bit in the clear. Without uniform padding across all packets, an attacker can identify which packets were padded, partially defeating the padding-based mitigation.
When VBR audio codecs are used with SRTP, the variation in compressed packet sizes leaks information about the speech signal content. Research shows that known phrases in encrypted VBR Speex calls can be recognized with high accuracy, and approximate transcripts can be derived without breaking encryption.