1. Introduction

   This document describes the Secure Real-time Transport Protocol
   (SRTP), a profile of the Real-time Transport Protocol (RTP), which
   can provide confidentiality, message authentication, and replay
   protection to the RTP traffic and to the control traffic for RTP,
   RTCP (the Real-time Transport Control Protocol) [RFC].

   SRTP provides a framework for encryption and message authentication
   of RTP and RTCP streams (Section 3).  SRTP defines a set of default
   cryptographic transforms (Sections 4 and 5), and it allows new
   transforms to be introduced in the future (Section 6).  With
   appropriate key management (Sections 7 and 8), SRTP is secure
   (Sections 9) for unicast and multicast RTP applications (Section 11).

   SRTP can achieve high throughput and low packet expansion.  SRTP
   proves to be a suitable protection for heterogeneous environments
   (mix of wired and wireless networks).  To get such features, default
   transforms are described, based on an additive stream cipher for
   encryption, a keyed-hash based function for message authentication,
   and an "implicit" index for sequencing/synchronization based on the
   RTP sequence number for SRTP and an index number for Secure RTCP
   (SRTCP).

1.1. Notational Conventions

   The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].  The
   terminology conforms to [RFC2828] with the following exception.  For
   simplicity we use the term "random" throughout the document to denote
   randomly or pseudo-randomly generated values.  Large amounts of
   random bits may be difficult to obtain, and for the security of SRTP,
   pseudo-randomness is sufficient [RFC1750].

   By convention, the adopted representation is the network byte order,
   i.e., the left most bit (octet) is the most significant one.  By XOR
   we mean bitwise addition modulo 2 of binary strings, and || denotes
   concatenation.  In other words, if C = A || B, then the most
   significant bits of C are the bits of A, and the least significant
   bits of C equal the bits of B.  Hexadecimal numbers are prefixed by
   0x.

   The word "encryption" includes also use of the NULL algorithm (which
   in practice does leave the data in the clear).

   With slight abuse of notation, we use the terms "message
   authentication" and "authentication tag" as is common practice, even
   though in some circumstances, e.g., group communication, the service
   provided is actually only integrity protection and not data origin
   authentication.