Subject: [AVT] SRTP Replay protection and index wrapping

From: "Sylvain Latulippe" <[email-masked]>
Date: Mon, 6 Sep 2004 16:44:30 -0400

Hi,

I have a question regarding the SRTP replay protection. 

As stated in RFC3711, section 3.3.2: the replay list uses the RTP and RTCP indexes (48 bits index: ROC||SEQ for RTP and the 31 bits index for RTCP) and a minimum of 64 entries sliding windows. Any packets with an index ahead of the window shall be discarded. 

How do we handle index wrapping?

Here is an example:
For simplicity, let's say that RTP indexes range is from 0 to 999 (1000 wraps to 0) and the sliding window is 64. If the last received index is 500 and the next received packet has the index 0. Do we process this packet as a replayed one since it is ahead the window (500-64) or do we handle it as new packet and update the last received packet with index 0?

Regards,

Sylvain

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Mats Näslund <[email-masked]>
Date: Tue, 07 Sep 2004 10:19:47 +0200

Hi Sylvain,

What you need is a definition of "a is ahead of b" when a,b are
modular quantities. While no bullet proof def exists, a "good
enough" can be found in RFC1982 (and it can also be deduced from
the Appendix of RFC3711): a is ahead of b, where a, b are considered
mod M (e.g. M = 2^m) iff:

   (a < b and b - a > M/2) or (a > b and a - b < M/2).

(The example you give, M = 1000, a-b = 500 = M/2, you have a problem,
it is still undefined if a > b or not, so you need a "policy" for the
case | a - b | = M/2...)

Finally, you write: "Any packets with an index ahead of the window shall 
be discarded." This is not correct. Please refer to the SRTP RFC.

Rgds

/Mats

Sylvain Latulippe wrote:

> As stated in RFC3711, section 3.3.2: the replay list uses the RTP and 
> RTCP indexes (48 bits index: ROC||SEQ for RTP and the 31 bits index for 
> RTCP) and a minimum of 64 entries sliding windows. Any packets with an 
> index ahead of the window shall be discarded.
> 
> For simplicity, let's say that RTP indexes range is from 0 to 999 (1000 
> wraps to 0) and the sliding window is 64. If the last received index is 
> 500 and the next received packet has the index 0. Do we process this 
> packet as a replayed one since it is ahead the window (500-64) or do we 
> handle it as new packet and update the last received packet with index 0?
> 
> Regards,
> 
> Sylvain
>