Subject: RE: [AVT] SRTP Key Derivation

From: "Karl Norrman \(KI/EAB\)" <[email-masked]>
Date: Mon, 11 Apr 2005 17:07:01 +0200

Hello!

Please note that the key derivation is conceptually performed on
a per packet basis.  This means that it does not matter if a 
packet is lost; synchronization is regained when the next packet
arrives.

Regards,
Karl

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Fries Steffen
> Sent: den 11 april 2005 16:49
> To: Mark Baugher
> Cc: Avt@Ietf. Org
> Subject: [AVT] SRTP Key Derivation
> 
> 
> Hi Mark,
> 
> I've got a short question regarding the key derivation in SRTP. 
> The packet index is one item that goes into the derivation 
> function. The
> packet index itself is build through the ROC and the RTP 
> sequence number in
> the packet. What happens if the first packet gets lost? 
> Is there any way of synchronization?
> 
> Regards
> 	Steffen
> 
> 
> --------------------------------------------
>  Steffen Fries,     Siemens AG, CT IC 3	
>  Otto-Hahn-Ring 6,  D-81730 Munich, Germany 
>  Phone:  (+49) 89 / 636-53403,    
>  Fax  :  (+49) 89 / 636-48000
>  email:  [email-masked]
> --------------------------------------------
> 
> _______________________________________________
> Audio/Video Transport Working Group
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/avt
> 

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Fries Steffen <[email-masked]>
Date: Mon, 11 Apr 2005 17:14:04 +0200

Hi Karl,

I was refering to the session keys. As far as I know the IV is constructed
on a per packet base, but the keys?

Regards
	Steffen

> From: Karl Norrman (KI/EAB) [mailto:[email-masked]] 
> Sent: Monday, April 11, 2005 5:07 PM
> To: Fries Steffen
> Cc: Avt@Ietf. Org; Mark Baugher
> Subject: RE: [AVT] SRTP Key Derivation
> 
> Hello!
> 
> Please note that the key derivation is conceptually performed 
> on a per packet basis.  This means that it does not matter if 
> a packet is lost; synchronization is regained when the next 
> packet arrives.
> 
> Regards,
> Karl
> 
> function. 
> > The packet index itself is build through the ROC and the 
> RTP sequence 
> > number in the packet. What happens if the first packet gets lost?

---

From: [email-masked]
Date: Mon, 11 Apr 2005 17:20:13 +0200

Steffen,

In the Key derivation process, there is the following formula that allows a
certain amount of packet loss with the same 'r' value since
r= index DIV key_derivation_rate.

Regards,

Laurent PILATI
Design Center
Mindspeed Technologies France

|---------+---------------------------->
|         |           Fries Steffen    |
|         |           <steffen.fries@si|
|         |           emens.com>       |
|         |           Sent by:         |
|         |           avt-bounces@ietf.|
|         |           org              |
|         |                            |
|         |                            |
|         |           11/04/2005 16:48 |
|         |                            |
|---------+---------------------------->
  >--------------------------------------------------------------------------------------------------------------------------|
  |                                                                                                                          |
  |       To:       Mark Baugher <[email-masked]>                                                                        |
  |       cc:       "Avt@Ietf. Org" <[email-masked]>                                                                           |
  |       Subject:  [AVT] SRTP Key Derivation                                                                                |
  >--------------------------------------------------------------------------------------------------------------------------|

Hi Mark,

I've got a short question regarding the key derivation in SRTP.
The packet index is one item that goes into the derivation function. The
packet index itself is build through the ROC and the RTP sequence number in
the packet. What happens if the first packet gets lost?
Is there any way of synchronization?

Regards
             Steffen

---

From: "Karl Norrman \(KI/EAB\)" <[email-masked]>
Date: Mon, 11 Apr 2005 17:34:34 +0200

Hello!

Yes, even the session keys are in theory derived for each packet.
In Section 3.3 step 4 it states that:

	4. Determine the session keys and session salt (if they are used by
      the transform) as described in Section 4.3, using master key,
      master salt, key_derivation_rate, and session key-lengths in the
      cryptographic context with the index, determined in Steps 2 and 3.

So, the key derivation is applied like this for each packet:

	PRF(master_key, key_label  ||  index DIV key_derivation_rate) 

Now, if key_derivation_rate = 0, the operation a DIV b is defined to
be 0. This implies that the session key will be the same for all
packets in the stream.
If the key_derivation_rate is r != 0, the key will be the same
for r consecutive packets, and will then change.

Hope this helps.

Regards,
Karl 

> From: Fries Steffen [mailto:[email-masked]]
> Sent: den 11 april 2005 17:14
> To: Karl Norrman (KI/EAB)

---

From: Fries Steffen <[email-masked]>
Date: Tue, 12 Apr 2005 14:15:58 +0200

Hi Maets,

after thinking twice, you are right ;-)
At the beginning we have a somewhat different situation. As ROC is "0" index
equeals to SEQ#. RFC3711 states that " ... a key derivation is performed
whenever index mod r equals zero..." So the flowchart you were providing was
fine, when SEQ2 is use a new key is derived, even the first key has only
been used for a single packet. 
Sorry for the confusion.

Regards
	Steffen

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Fries Steffen
> Sent: Tuesday, April 12, 2005 12:27 PM
> To: Mats Näslund
> Cc: Karl Norrman (KI/EAB); Mark Baugher; Sylvain Latulippe; 
> Avt@Ietf. Org
> Hi Maets, 
> no, what I meant is the following
>  Sender                                      Rec.
>  ------                                      ----
>  
>  Initial packet
>  SEQ1 = N*keyDerivationRate-1
>  k1 = KDF(SEQ1)
>  
>                 --------> packet lost
>  
>  SEQ2 = SEQ1+1
>  k1 is still used, as the key derivation rate is not reached.
>  
>                 --------------------------> packet containing
>                                             SEQ = N*keyDerivationRate
>                                             arrives
>  
>                                             k = KDF(SEQ) (== k2) 
> 
> 
> The sender pics the first sequence number randomly and 
> increments this by 1 for each new packet. If the initial 
> sequence number is accedently KeyDerivationRate-1, and the 
> packet gets lost, then sender and receiver will derive 
> different keys. The sender is still using the first derived 
> key, while the receiver only sees the second packet, for 
> which the result of SEQ# DIV KeyDerivationRate is different 
> than for the sender.
> 
> Regards
> 	Steffen
> 
> > From: Mats Näslund [mailto:[email-masked]]
> > Sent: Tuesday, April 12, 2005 11:16 AM
> > To: Fries Steffen
> > Cc: Mark Baugher; Sylvain Latulippe; Karl Norrman (KI/EAB); 
> Avt@Ietf. 
> > Org
> > Subject: Re: [AVT] SRTP Key Derivation
> > 
> > Hi Steffen,
> > 
> > Fries Steffen wrote:
> > 
> > > Based on the remarks from Sylvain, I think one could even
> > generalize
> > > the guideline to the case when the initial SEQ# is 0xFFFF. 
> > The SEQ# is
> > > randomly chosen, but if the SEQ# of the first packet is
> > > (N*keyDerivationRate-1 ) and the packet gets lost, than the DIV 
> > > operation on both sides will produce different results. I'm
> > not quite
> > > sure about the probability of this happen, but maybe we
> > could extend the guideline to cover that case too.
> > 
> > We don't see why this would create problems. The first succesfully 
> > arriving packet will contain the SEQ# which the sender used 
> to derive 
> > keys for that very packet, so the receiver will use the 
> same SEQ# as 
> > input to the KDF on his side. That is:
> > 
> > Sender                                      Rec.
> > ------                                      ----
> > 
> > SEQ1 = N*keyDerivationRate-1
> > k1 = KDF(SEQ1)
> > 
> >                --------> packet lost
> > 
> > SEQ2 = N*keyDerivationRate
> > k2 = KDF(SEQ2)
> > 
> >                --------------------------> packet containing
> >                                            SEQ = N*keyDerivationRate
> >                                            arrives
> > 
> >                                            k = KDF(SEQ) (== k2)
> > 
> > etc.
> > 
> > 
> > 
> > Cheers
> > 
> > /Mats
> > 
> > 
>