Subject: [AVT] RTP padding, part 2 (RFC3550)

From: Andrei Iarus <[email-masked]>
Date: Sat, 12 Jul 2008 20:25:51 -0700 (PDT)

Hello,
Daniele Renzi had in his last email some questions regarding the RTP padding standard.
For details: http://www.ietf.org/mail-archive/web/avt/current/msg08938.html
If the P bit in the RTP header is 1, then the last byte in the payload specifies the number of padded bytes, and the padded bytes are requested by standard to be 0 (except the last one). 
Serge Vaudenay presents in his work "Security Flaws Induced by CBC Padding - Applications to SSL, IPSEC, WTLS..." a side-channel attack in which are used padding-schemes whose correctness can be verified and its checking result is available to the attacker. The Padding scheme requested in RTP can be verified, and if the attacker has access to the result of padding correctness checking, the ciphertext can be very effectively decrypted. 
Also there is specified, that if the plaintext is padded with random bytes (except the last one), the attack would decrypt only the last byte.
Of course, in a multimedia transmission a bad-padded payload shouldn't generate any reaction, but one cannot be sure of this.
Now my question/request for some comments is:
Isn't better the random padding?
SRTP uses CTR as the mode of operation in encryption (that does not request message padding), but the problem is: does RTP standard "force" an encryption profile to avoid CBC?
Thank you for your valuable answers,
Andrei.

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www.ietf.org/mailman/listinfo/avt

---

From: Magnus Westerlund <[email-masked]>
Date: Mon, 14 Jul 2008 11:03:13 +0200

Hi Andrei,

When it comes to RTP security there is several cases when there will be 
known plain text in the encrypted payload. Thus any encryption transform 
for RTP will need to have enough cipher strength to handle breaking 
attempts with known plain-text.

Changing the padding mechanism will not gain anything, as there are 
other parts of the different payload formats that can similarly be used 
when verifying attacks against the cipher.

Best Regards

Magnus

Andrei Iarus skrev:
> If the P bit in the RTP header is 1, then the last byte in the payload 
> specifies the number of padded bytes, and the padded bytes are requested 
> by standard to be 0 (except the last one).
>  
> Serge Vaudenay presents in his work "Security Flaws Induced by CBC 
> Padding - Applications to SSL, IPSEC, WTLS..." a side-channel attack in 
> which are used padding-schemes whose correctness can be verified and its 
> checking result is available to the attacker. The Padding scheme 
> requested in RTP can be verified, and if the attacker has access to the 
> result of padding correctness checking, the ciphertext can be very 
> effectively decrypted.
>  
> Also there is specified, that if the plaintext is padded with random 
> bytes (except the last one), the attack would decrypt only the last byte.
>  
> Of course, in a multimedia transmission a bad-padded payload shouldn't 
> generate any reaction, but one cannot be sure of this.
>  
> SRTP uses CTR as the mode of operation in encryption (that does not 
> request message padding), but the problem is: does RTP standard "force" 
> an encryption profile to avoid CBC?
>  
> ------------------------------------------------------------------------
> 

-- 

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Färögatan 6                | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------