Subject: [AVT] RFC3711: SRTP session keys derivation with non-zero key derivatio n rate

From: Vavilapalli Srikanth-A19563 <[email-masked]>
Date: Mon, 22 Nov 2004 18:15:44 +0530

David, Karl and SRTP Community

RFC: 3711
Section: 4.3.1 (Key Derivation Algorithm)
Scenario: Unicast Bidirectional single stream RTP session

RFC States: that the sender and receiver of a SRTP session derive all the
SRTP/SRTCP session keys from master key using Master key, Master salt,
Packet Index and Key Derivation Rate (KDR).
Mathematically k_e = PRF_n_e (k_master, ((0x00 || (index DIV KDR)) XOR
master_salt)
And also it mentions that the derivation should happen before the first
packet sent or first packet is received. 

Description: In this scenario how can the sender of SRTP packets make sure
that the receiver uses the same packet index to derive the same session keys
at receiver's place that are used at sender side? I mean what if the packet
with packet index (which is used for key derivation at the sender side) is
not reached to the receiver's and the KDR used for this session is non-zero.
Then I guess the sender and receivers will be out of sync in terms of
session keys. Am I right in stating that?

OR

Are the applications using a non-zero value of KDR out of scope of this
document? 

There will not be any issues in this approach if the KDR is zero because
"(index DIV zero)" produces zero every where. Even in the examples, the
session keys are derived with KDR as zero.

Could you please clarify this point?

Thanks & Regards
Srikanth Vavilapalli

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of David
A. McGrew
Sent: Friday, November 19, 2004 9:34 PM
To: milo diurn
Cc: [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: [AVT] RFC3711: Srtp key_id ?

Milo,

On Nov 19, 2004, at 7:12 AM, milo diurn wrote:

> Karl, and Srtp community,
>
> In RFC3711,
> how is key_id defined and by which part (external/internal) ?

it is defined externally.  From Section 3.1:

    MKI (Master Key Identifier): configurable length, OPTIONAL.  The
               MKI is defined, signaled, and used by key management.

>
> If key_id belongs to the Srtp parameters, why do not referring to it in
> the parameters list (chap 8.2) ?

It is there, but you might have missed it because it is only referred 
to by the acronym "MKI"

Hope this helps!

David

>
> Could you, please, clarify this point ?
>
> Thanks
>
> Regards
>
> _________________________________________________________________
> FREE pop-up blocking with the new MSN Toolbar - get it now! 
> http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/
>

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: "Karl Norrman \(KI/EAB\)" <[email-masked]>
Date: Mon, 22 Nov 2004 14:56:32 +0100

Hello!

First, please refer to our previous answer (in another thread)
where we explained that "parameters" in general need to be communicated
out-of-band by key management.

Specifically, in this case, the current ROC is communicated
to the receiver as he joins the session. Alternatively, the
session just starts and the ROC is zero. On consecutive packets,
an "estimation" of the index is done at the receiver (as also
explained in the RFC). 

To be more specific, the packet index is the
concatenation of the roll-over counter and the sequence number. 
The roll-over counter can be estimated from the sequence number 
carried with each SRTP packet using, e.g., the algorithm in appendix A.
Hence, the sender and receiver would be synchronized when the next
packet arrives.

You are absolutely right that there *are* (extreme) cases when
the receiver *can* get out of synch.

Regards,
Karl & Co

> From: Vavilapalli Srikanth-A19563 [mailto:[email-masked]]
> Sent: den 22 november 2004 13:46
> To: David A. McGrew; Karl Norrman (KI/EAB); [email-masked]
> Cc: milo diurn; Elisabetta Carrara (KI/EAB); [email-masked]
> Subject: RFC3711: SRTP session keys derivation with non-zero key
> derivatio n rate
> 
>