TESLA extension. Note that the definition is extended from [RFC3711]
by the inclusion of the TESLA authentication extension.
We define the "TESLA Authenticated Portion" of an SRTCP packet as
consisting of the RTCP header (first 8 bytes) and the Encrypted
Portion of the SRTCP packet.
Processing of an SRTCP packets is similar to the SRTP processing
(Section 4.3), but there are SRTCP-specific changes described in
Section 3.4 of the SRTP specification [RFC3711] and in Section 4.6 of
this memo.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<+<+
|V=2|P| RC | PT=SR or RR | length | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| SSRC of sender | | |
+>+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| ~ sender info ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ report block 1 ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ report block 2 ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ ... ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| |V=2|P| SC | PT=SDES=202 | length | | |
| +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| | SSRC/CSRC_1 | | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ SDES items ~ | |
| +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| ~ ... ~ | |
+>+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | |
| |E| SRTCP index | | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<+ |
| | i | | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ Disclosed Key ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| ~ TESLA MAC ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<|-+
| ~ SRTCP MKI ~ | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| : authentication tag : | |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |
| | |
+-- Encrypted Portion TESLA Authenticated Portion -----+ |
|
Authenticated Portion -------+
Figure 3. The format of the SRTCP packet when TESLA is applied.
Note that when additional fields are added to a packet, it will
increase the packet size and thus the RTCP average packet size.
4.6. TESLA MAC
Let M’ denote packet data to be TESLA-authenticated. In the case of
SRTP, M’ SHALL consist of the SRTP TESLA Authenticated Portion (RTP
header and SRTP Encrypted Portion; see Figure 2) of the packet
concatenated with the rollover counter (ROC) of the same packet:
M’ = ROC || TESLA Authenticated Portion.
In the case of SRTCP, M’ SHALL consist of the SRTCP TESLA
Authenticated Portion only (RTCP header and SRTCP Encrypted Portion).
The normal authentication tag (OPTIONAL for SRTP, MANDATORY for
SRTCP) SHALL be applied with the same coverage as specified in
[RFC3711]. That is:
- for SRTP: Authenticated Portion || ROC (with the extended
definition of SRTP Authentication Portion as in Section 4.2).
- for SRTCP: Authenticated Portion (with the extended definition of
SRTCP Authentication Portion as in Section 4.2).
The predefined authentication transform in SRTP, HMAC-SHA1 [RFC2104],
is also used to generate the TESLA MAC. For SRTP (and respectively
for SRTCP), the HMAC SHALL be applied to the key in the TESLA chain
corresponding to a particular time interval, and to M’ as specified
above. The HMAC output SHALL then be truncated to the n_m left-most
bits. Default values are in Section 6.
As with SRTP, the predefined HMAC-SHA1 authentication algorithm MAY
be replaced with an alternative algorithm that is specified in a
future Internet RFC.
4.7. PRFs
TESLA requires a pseudo-random function (PRF) to implement
* one one-way function F(x) to derive the key chain, and
* one one-way function F’(x) to derive (from each key of the chain)
the key that is actually used to calculate the TESLA MAC.
When TESLA is used within SRTP, the default choice of the PRF SHALL
be HMAC-SHA1. Default values are in Section 6.
Other PRFs can be chosen, and their use SHALL follow the common
guidelines in [RFC3711] when adding new security parameters.
5. TESLA Bootstrapping and Cleanup
The extensions to the SRTP cryptographic context include a set of
TESLA parameters that are listed in Section 4.3 of this document.
Furthermore, TESLA MUST be bootstrapped at session setup (for the
parameter exchange and the initial key commitment) through a regular
data authentication system (a digital signature algorithm is
RECOMMENDED). Key management procedures can take care of this
bootstrapping prior to the commencement of an SRTP session where
TESLA authentication is used. The bootstrapping mechanism is out of
scope for this document (it could, for example, be part of the key
management protocol).
A critical factor for the security of TESLA is that the sender and
receiver need to be loosely synchronized. TESLA requires a bound on
clock drift to be known (D_t). Use of TESLA in SRTP assumes that the
time synchronization is guaranteed by out-of-band schemes (e.g., key
management). That is, it is not in the scope of SRTP.
It also should be noted that TESLA has some reliability requirements
in that a key is disclosed for a packet in a subsequent packet, which
can get lost. Since a key in a lost packet can be derived from a
future packet, TESLA is robust to packet loss. This key stream
stops, however, when the key-bearing data stream packets stop at the
conclusion of the RTP session. To avoid this nasty boundary
condition, send null packets with TESLA keys for one entire key-
disclosure period following the interval in which the stream ceases:
Null packets SHOULD be sent for d intervals of duration t_int (items
8 and 9 of Section 4.3). The rate of null packets SHOULD be the
average rate of the session media stream.
6. SRTP TESLA Default Parameters
Key management procedures establish SRTP TESLA operating parameters,
which are listed in Section 4.3 of this document. The operating
parameters appear in the SRTP cryptographic context and have the
default values that are described in this section. In the future, an
Internet RFC MAY define alternative settings for SRTP TESLA that are
different than those specified here. In particular, note that the
settings defined in this memo can have a large impact on bandwidth,
as they add 38 bytes to each packet (when the field length values are
the default ones). For certain applications, this overhead may
represent more than a 50% increase in packet size. Alternative
settings might seek to reduce the number and length of various TESLA
fields and outputs. No such optimizations are considered in this
memo.
It is RECOMMENDED that the SRTP MAC be truncated to 32 bits, since
the SRTP MAC provides only group authentication and serves only as
protection against external DoS.
The default values for the security parameters are listed in the
following table.
Parameter Mandatory-to-support Default
--------- -------------------- -------
TESLA PRF HMAC-SHA1 HMAC-SHA1
BIT-OUTPUT LENGTH n_p 160 160
BIT-OUTPUT LENGTH n_f 160 160
TESLA MAC HMAC-SHA1 HMAC-SHA1
(TRUNCATED) BIT-OUTPUT LENGTH n_m 80 80
As shown above, TESLA implementations MUST support HMAC-SHA1
[RFC2104] for the TESLA MAC and the TESLA PRF. The TESLA keychain
generator is recursively defined as follows [RFC4082].
K_i=HMAC_SHA1(K_{i+1},0), i=0..N-1
where N-1=n_c from the cryptographic context.
The TESLA MAC key generator is defined as follows [RFC4082].
K’_i=HMAC_SHA1(K_i,1)
The TESLA MAC uses a truncated output of ten bytes [RFC2104] and is
defined as follows.
HMAC_SHA1(K’_i, M’)
where M’ is as specified in Section 4.6.
7. Security Considerations
Denial of Service (DoS) attacks on delayed authentication are
discussed in [PCST]. TESLA requires receiver buffering before
authentication; therefore, the receiver can suffer a denial of
service attack due to a flood of bogus packets. To address this
problem, the external SRTP MAC, based on the group key, MAY be used
in addition to the TESLA MAC. The short size of the SRTP MAC
(default 32 bits) is motivated because that MAC is purely for DoS
prevention from attackers external to the group. The shorter output
tag means that an attacker has a better chance of getting a forged
packet accepted, which is about 2^31 attempts on average. As a first
line of defense against a denial of service attack, a short tag is
probably adequate; a victim will likely have ample evidence that it
is under attack before accepting a forged packet, which will
subsequently fail the TESLA check. [RFC4082] describes other
mechanisms that can be used to prevent DoS, in place of the external
group-key MAC. If used, they need to be added as processing steps
(following the guidelines of [RFC4082]).
The use of TESLA in SRTP defined in this specification is subject to
the security considerations discussed in the SRTP specification
[RFC3711] and in the TESLA specification [RFC4082]. In particular,
the TESLA security is dependent on the computation of the "safety
condition" as defined in Section 3.5 of [RFC4082].
SRTP TESLA depends on the effective security of the systems that
perform bootstrapping (time synchronization) and key management.
These systems are external to SRTP and are not considered in this
specification.
The length of the TESLA MAC is by default 80 bits. RFC 2104 requires
the MAC length to be at least 80 bits and at least half the output
size of the underlying hash function. The SHA-1 output size is 160
bits, so both of these requirements are met with the 80-bit MAC
specified in this document. Note that IPsec implementations tend to
use 96 bits for their MAC values to align the header with a 64-bit
boundary. Both MAC sizes are well beyond the reach of current
cryptanalytic techniques.
8. Acknowledgements
The authors would like to thank Ran Canetti, Karl Norrman, Mats
Naslund, Fredrik Lindholm, David McGrew, and Bob Briscoe for their
valuable help.
9. References
9.1. Normative References
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104, February
1997.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K.
Norrman, "The Secure Real-time Transport Protocol (SRTP)",
RFC 3711, March 2004.
[RFC4082] Perrig, A., Song, D., Canetti, R., Tygar, J., and B.
Briscoe, "Timed Efficient Stream Loss-Tolerant
Authentication (TESLA): Multicast Source Authentication
Transform Introduction", RFC 4082, June 2005.
9.2. Informative References
[PCST] Perrig, A., Canetti, R., Song, D., Tygar, D., "Efficient
and Secure Source Authentication for Multicast", in Proc.
of Network and Distributed System Security Symposium NDSS
2001, pp. 35-46, 2001.
[RFC3547] Baugher, M., Weis, B., Hardjono, T., and H. Harney, "The
Group Domain of Interpretation", RFC 3547, July 2003.
[RFC3830] Arkko, J., Carrara, E., Lindholm, F., Naslund, M., and K.
Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830,
August 2004.
[RFC4046] Baugher, M., Canetti, R., Dondeti, L., and F. Lindholm,
"Multicast Security (MSEC) Group Key Management
Architecture", RFC 4046, April 2005.
Authors’ Addresses
Questions and comments should be directed to the authors and
msec@ietf.org.
Mark Baugher
Cisco Systems, Inc.
5510 SW Orchid Street
Portland, OR 97219 USA
Phone: +1 408-853-4418
EMail: mbaugher@cisco.com
Elisabetta Carrara
Royal Institute of Technology
Stockholm
Sweden
EMail: carrara@kth.se
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).