...
The use of SDES to exchange the keys is not a secure method, since the crypto key is transferred in the SDP as plain text string. The SDP “crypto” security description is normally used where IPsec, TLS, or some other encapsulating data-security protocol protects the SDP message. SIP layer security between SIP Client and SIP Server, such as SIP TLS will be required by some customers to use SDES. However, this document focuses only on the SDES key exchange to establish the Secure RTP session.
If the fax session is re-invited to T.38, the T.38 media will not be secure. This feature will only secure the fax media when G.711 RTP mode has been selected. Secure T.38 media will be addressed with a seperate feature request. FR17636 : Add support for secure T.38 media
Assumptions
- Forward Error Correction (FEC) is not required.
- On SDES offer, the SR140 will support only one crypto attribute per media type. If more than 1 crypto attribute is offered, we need to define the SR140 behavior.
- SIP security preconditions (sprecon) will not be supported
...
| # | Title | Importance | Notes |
|---|---|---|---|
| 1 | SHALL support SDES (RFC4568) key exchange to establish SRTP (RFC3711) Media streams | Must Have |
|
| 2 | SHALL support SDES-SRTP with or without SIP TLS session establishment. | Must Have | |
| 3 | SHALL support SDP 'crypto' attribute to exchange SDES-SRTP encryption keys. | Must Have | |
| 4 | SHALL support the following crypto suites:
| Must Have | |
| 5 | SHALL support the key-method 'inline' for crypto SDP attribute: “inline:” <key||salt> [“|”lifetime] [“|” MKI “:” length] - key || salt – concatenated master key and salt, base64 encoded - Lifetime – masterkey lifetime (max number of SRTP or SRTCP packets using this master key) - MKI:length – MKI and length of the MKI field in SRTP packets | Must Have | By default this should be forever or the largest possible value. The lifetime paramter should be configurable. |
| 6 | SHALL support key timeouts and refresh as specified by RFC4568 and key exchange parameters | Must Have | |
| 7 | Configuration Parameters. The configuration parameters for SRTP SHALL be contained within its own configuration file. The callctrl.cfg SHALL define a parameter to state if SRTP is enabled and the location of the configuration file. | Must Have | The parameters in the SRTP configuration file only apply when SRTP is enabled. |
| 8 | The parsing of the configuration parameters SHALL be present in the ecc.log file. | Must Have | |
| 9 | Lifetime: this value determines the maximum number of SRTP/SRTCP packets that can be recieved using the master key selected for the session. | ||
| 10 | Accept: this is a boolean value that enable processing of SDPs with crypto-attributes. note that if an ingress message (i.e. INVITE) contains SDP without crypto-attributes, the system shall still process the request. When "Disabled", messages with crypto-attributes are rejected. | ||
| 11 | Number of Keys: this is an integer value that specifies the number of keys to use in the key rotation refresh. | Checking on need to support multiple crypto keys. | |
| 12 | Window Size Hint: this is an integer value that sets the SRTP window size to protect against replay attacks. | Not sure about the Window Hint, but Jon M think this is pretty standard. | |
| 13 | Enforce: this is a boolean value that enable/disable mandatory enforcement of ingress calls to contain crypto-attributes. The system shall reject all calls that do NOT contain crypto-attributes in the SDP media lines. | ||
| 14 | Unencrypted SRTP: this is a boolean value that enable/disables receiving unencrypted SRTP packet payloads. | ||
| 15 | Unencrypted SRTCP: this is a boolean value that enable/disables receiving unencrypted SRTCP packet payloads. | ||
| 16 | Use Case 1: SIP Invite with SDES - SR140 SHALL support receiving SDES in a receive receiving call. SIP Invite has Offer SDP with EP 'crypto' attribute. SR140 answers with crypto to establish the SRTP session. | ||
| 17 | Use Case 2: SIP Invite with SDES - SR140 SHALL support sending SDES in a send transmitting call. SIP Invite has SDP with EP 'crypto' attribute. | ||
| 18 | SRTP supported on by a single license keywork (Security). This keyword enables SRTP functionality on a per system basis. Add on part will need to be defined to add security to an existing SR140 deployment. This part will be added to the back office for normal order processing and will allow the end user to activate a security LAC via the current methods. The SR140 base feature license will not include Security support. Added support MUST require a seperate add-on LAC for security. | Must Have | Part #951-105-20 |
| 19 | COO Will need to be updated with changes to include the updated IPP (version 8.2.x) into the product. Will be required for both Windows and Linux. | Must Have | |
| 20 | Documentation. The Brooktrout documentation SHALL be updated in the appopiate manuals. | Must Have | |
| 21 | Export requirements SHALL be completed to support releasing a product with security features | Must Have | Will be completed with SIP over TLS. |
...