OLD | NEW |
1 /* | 1 /* |
2 * ekt.h | 2 * ekt.h |
3 * | 3 * |
4 * interface to Encrypted Key Transport for SRTP | 4 * interface to Encrypted Key Transport for SRTP |
5 * | 5 * |
6 * David McGrew | 6 * David McGrew |
7 * Cisco Systems, Inc. | 7 * Cisco Systems, Inc. |
8 */ | 8 */ |
9 /* | 9 /* |
10 * | 10 * |
(...skipping 44 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
55 * question: will we want to allow key-sharing templates in addition | 55 * question: will we want to allow key-sharing templates in addition |
56 * to EKT templates? could define a new ssrc_type_t that's associated | 56 * to EKT templates? could define a new ssrc_type_t that's associated |
57 * with an EKT, e.g. ssrc_any_ekt. | 57 * with an EKT, e.g. ssrc_any_ekt. |
58 * | 58 * |
59 * | 59 * |
60 */ | 60 */ |
61 | 61 |
62 #ifndef EKT_H | 62 #ifndef EKT_H |
63 #define EKT_H | 63 #define EKT_H |
64 | 64 |
| 65 #include "srtp_priv.h" |
| 66 |
65 #ifdef __cplusplus | 67 #ifdef __cplusplus |
66 extern "C" { | 68 extern "C" { |
67 #endif | 69 #endif |
68 | 70 |
69 #include "srtp_priv.h" | 71 #define SRTP_EKT_CIPHER_DEFAULT 1 |
| 72 #define SRTP_EKT_CIPHER_AES_128_ECB 1 |
| 73 #define SRTP_EKT_CIPHER_AES_192_KEY_WRAP 2 |
| 74 #define SRTP_EKT_CIPHER_AES_256_KEY_WRAP 3 |
70 | 75 |
71 #define EKT_CIPHER_DEFAULT 1 | 76 typedef uint16_t srtp_ekt_spi_t; |
72 #define EKT_CIPHER_AES_128_ECB 1 | |
73 #define EKT_CIPHER_AES_192_KEY_WRAP 2 | |
74 #define EKT_CIPHER_AES_256_KEY_WRAP 3 | |
75 | |
76 typedef uint16_t ekt_spi_t; | |
77 | 77 |
78 | 78 |
79 unsigned | 79 unsigned srtp_ekt_octets_after_base_tag(srtp_ekt_stream_t ekt); |
80 ekt_octets_after_base_tag(ekt_stream_t ekt); | |
81 | 80 |
82 /* | 81 /* |
83 * an srtp_policy_t structure can contain a pointer to an | 82 * an srtp_policy_t structure can contain a pointer to an |
84 * ekt_policy_t structure | 83 * srtp_ekt_policy_t structure |
85 * | 84 * |
86 * this structure holds all of the high level EKT information, and it | 85 * this structure holds all of the high level EKT information, and it |
87 * is passed into libsrtp to indicate what policy should be in effect | 86 * is passed into libsrtp to indicate what policy should be in effect |
88 */ | 87 */ |
89 | 88 |
90 typedef struct ekt_policy_ctx_t { | 89 typedef struct srtp_ekt_policy_ctx_t { |
91 ekt_spi_t spi; /* security parameter index */ | 90 srtp_ekt_spi_t spi; /* security parameter index */ |
92 uint8_t ekt_cipher_type; | 91 uint8_t ekt_cipher_type; |
93 uint8_t *ekt_key; | 92 uint8_t *ekt_key; |
94 struct ekt_policy_ctx_t *next_ekt_policy; | 93 struct srtp_ekt_policy_ctx_t *next_ekt_policy; |
95 } ekt_policy_ctx_t; | 94 } srtp_ekt_policy_ctx_t; |
96 | 95 |
97 | 96 |
98 /* | 97 /* |
99 * an ekt_data_t structure holds the data corresponding to an ekt key, | 98 * an srtp_ekt_data_t structure holds the data corresponding to an ekt key, |
100 * spi, and so on | 99 * spi, and so on |
101 */ | 100 */ |
102 | 101 |
103 typedef struct ekt_data_t { | 102 typedef struct srtp_ekt_data_t { |
104 ekt_spi_t spi; | 103 srtp_ekt_spi_t spi; |
105 uint8_t ekt_cipher_type; | 104 uint8_t ekt_cipher_type; |
106 aes_expanded_key_t ekt_enc_key; | 105 srtp_aes_expanded_key_t ekt_enc_key; |
107 aes_expanded_key_t ekt_dec_key; | 106 srtp_aes_expanded_key_t ekt_dec_key; |
108 struct ekt_data_t *next_ekt_data; | 107 struct ekt_data_t *next_ekt_data; |
109 } ekt_data_t; | 108 } srtp_ekt_data_t; |
110 | 109 |
111 /* | 110 /* |
112 * an srtp_stream_ctx_t can contain an ekt_stream_ctx_t | 111 * an srtp_stream_ctx_t can contain an srtp_ekt_stream_ctx_t |
113 * | 112 * |
114 * an ekt_stream_ctx_t structure holds all of the EKT information for | 113 * an srtp_ekt_stream_ctx_t structure holds all of the EKT information for |
115 * a specific SRTP stream | 114 * a specific SRTP stream |
116 */ | 115 */ |
117 | 116 |
118 typedef struct ekt_stream_ctx_t { | 117 typedef struct srtp_ekt_stream_ctx_t { |
119 ekt_data_t *data; | 118 srtp_ekt_data_t *data; |
120 uint16_t isn; /* initial sequence number */ | 119 uint16_t» isn; /* initial sequence number */ |
121 uint8_t encrypted_master_key[SRTP_MAX_KEY_LEN]; | 120 uint8_t» encrypted_master_key[SRTP_MAX_KEY_LEN]; |
122 } ekt_stream_ctx_t; | 121 } srtp_ekt_stream_ctx_t; |
123 | 122 |
124 | 123 |
125 | 124 |
126 err_status_t | 125 srtp_err_status_t srtp_ekt_alloc(srtp_ekt_stream_t *stream_data, srtp_ekt_policy
_t policy); |
127 ekt_alloc(ekt_stream_t *stream_data, ekt_policy_t policy); | |
128 | 126 |
129 err_status_t | 127 srtp_err_status_t srtp_ekt_stream_init(srtp_ekt_stream_t e, srtp_ekt_spi_t spi,
void *ekt_key, unsigned ekt_cipher_type); |
130 ekt_stream_init(ekt_stream_t e, | |
131 » » ekt_spi_t spi, | |
132 » » void *ekt_key, | |
133 » » unsigned ekt_cipher_type); | |
134 | 128 |
135 err_status_t | 129 srtp_err_status_t srtp_ekt_stream_init_from_policy(srtp_ekt_stream_t e, srtp_ekt
_policy_t p); |
136 ekt_stream_init_from_policy(ekt_stream_t e, ekt_policy_t p); | |
137 | 130 |
138 | 131 |
139 | 132 |
140 err_status_t | 133 srtp_err_status_t srtp_stream_init_from_ekt(srtp_stream_t stream, const void *sr
tcp_hdr, unsigned pkt_octet_len); |
141 srtp_stream_init_from_ekt(srtp_stream_t stream,»» » | |
142 » » » const void *srtcp_hdr, | |
143 » » » unsigned pkt_octet_len); | |
144 | 134 |
145 | 135 |
146 void | 136 void srtp_ekt_write_data(srtp_ekt_stream_t ekt, uint8_t *base_tag, unsigned base
_tag_len, int *packet_len, srtp_xtd_seq_num_t pkt_index);» » |
147 ekt_write_data(ekt_stream_t ekt, | |
148 » uint8_t *base_tag, | |
149 » unsigned base_tag_len, | |
150 » int *packet_len, | |
151 » xtd_seq_num_t pkt_index);» » | |
152 | 137 |
153 /* | 138 /* |
154 * We handle EKT by performing some additional steps before | 139 * We handle EKT by performing some additional steps before |
155 * authentication (copying the auth tag into a temporary location, | 140 * authentication (copying the auth tag into a temporary location, |
156 * zeroizing the "base tag" field in the packet) | 141 * zeroizing the "base tag" field in the packet) |
157 * | 142 * |
158 * With EKT, the tag_len parameter is actually the base tag | 143 * With EKT, the tag_len parameter is actually the base tag |
159 * length | 144 * length |
160 */ | 145 */ |
| 146 srtp_err_status_t srtp_ekt_tag_verification_preproces(uint8_t *pkt_tag, uint8_t
*pkt_tag_copy, unsigned tag_len); |
161 | 147 |
162 err_status_t | 148 srtp_err_status_t srtp_ekt_tag_verification_postproces(uint8_t *pkt_tag, uint8_t
*pkt_tag_copy, unsigned tag_len); |
163 ekt_tag_verification_preproces(uint8_t *pkt_tag, | |
164 » » » uint8_t *pkt_tag_copy, | |
165 » » » unsigned tag_len); | |
166 | |
167 err_status_t | |
168 ekt_tag_verification_postproces(uint8_t *pkt_tag, | |
169 » » » » uint8_t *pkt_tag_copy, | |
170 » » » » unsigned tag_len); | |
171 | 149 |
172 | 150 |
173 /* | 151 /* |
174 * @brief EKT pre-processing for srtcp tag generation | 152 * @brief EKT pre-processing for srtcp tag generation |
175 * | 153 * |
176 * This function does the pre-processing of the SRTCP authentication | 154 * This function does the pre-processing of the SRTCP authentication |
177 * tag format. When EKT is used, it consists of writing the Encrypted | 155 * tag format. When EKT is used, it consists of writing the Encrypted |
178 * Master Key, the SRTP ROC, the Initial Sequence Number, and SPI | 156 * Master Key, the SRTP ROC, the Initial Sequence Number, and SPI |
179 * fields. The Base Authentication Tag field is set to the all-zero | 157 * fields. The Base Authentication Tag field is set to the all-zero |
180 * value | 158 * value |
181 * | 159 * |
182 * When EKT is not used, this function is a no-op. | 160 * When EKT is not used, this function is a no-op. |
183 * | 161 * |
184 */ | 162 */ |
185 | 163 srtp_err_status_t srtp_stream_srtcp_auth_tag_generation_preprocess(const srtp_st
ream_t *s, uint8_t *pkt_tag, unsigned pkt_octet_len); |
186 err_status_t | |
187 srtp_stream_srtcp_auth_tag_generation_preprocess(const srtp_stream_t *s, | |
188 » » » » » » uint8_t *pkt_tag, | |
189 » » » » » » unsigned pkt_octet_len); | |
190 | 164 |
191 /* it's not clear that a tag_generation_postprocess function is needed */ | 165 /* it's not clear that a tag_generation_postprocess function is needed */ |
192 | 166 srtp_err_status_t srtcp_auth_tag_generation_postprocess(void); |
193 err_status_t | |
194 srtcp_auth_tag_generation_postprocess(void); | |
195 | 167 |
196 | 168 |
197 #ifdef __cplusplus | 169 #ifdef __cplusplus |
198 } | 170 } |
199 #endif | 171 #endif |
200 | 172 |
201 #endif /* EKT_H */ | 173 #endif /* EKT_H */ |
OLD | NEW |