Secure RTP

Defined in IETF RFC 3711, Secure Real-Time Transport Protocol (SRTP) provides for encryption of the RTP protocol used by VoIP. Without SRTP, VoIP conversations can be easily captured and listened to with a simple packet-capture device or software program. SRTP encrypts the VoIP conversations so that they are protected from unauthorized eavesdropping.

One of the main benefits of the SRTP encryption scheme is that only the RTP payload is encrypted. Therefore, secure tunnels for the media do not have to be created, and the voice traffic can be routed normally. In addition, QoS settings in the IP header are not affected, and CRTP can still be used for bandwidth reduction over WANs.

With the increasing usage of SRTP for VoIP, the logical next step is securing modulated data communications that use passthrough and relay over the IP network, too. Much of the emphasis in securing modulated communications over IP has to do with fax traffic. With the appropriate software, extracting fax pages from a packet capture is just as easy as listening to a VoIP conversation.

Unfortunately, some of the transport methods for passthrough and relay do not use an RTP header, which is an obvious requirement for SRTP. Table 7-11 highlights the various passthrough and relay transport methods and their compatibility with SRTP.

Table 7-11 Passthrough and Relay SRTP Support

Passthrough/Relay Transport Method	SRTP Support
Passthrough (including NSE-based modem	Supported. (The G.711 codec is used for all
passthrough and protocol-based fax pass-	forms of passthrough, and it includes an RTP
through)	header.)
T.38 fax relay	Not supported. (The T.38 fax relay protocol in
	Cisco voice gateways uses a UDPTL header.
	More recent versions of the T.38 specification
	provide for an RTP header rather than UDP
	transport layer [UDPTL], but this has yet to be
	implemented on Cisco voice gateways.)
Cisco fax relay	Supported.
Cisco modem relay	Not supported. (Instead of an RTP header, a
	Simple Packet Relay Transport [SPRT] header
	is used.)
Cisco text relay	Supported.

All the supported transport methods in Table 7-11 include an RTP header. Therefore, if securing a fax call with SRTP is your objective, T.38 fax relay is not an option on a Cisco voice gateway. You must use either passthrough or Cisco fax relay. Of course, SRTP is not the only option for securing passthrough and relay traffic. Other options involving secure virtual private network (VPN) tunnels are available if SRTP does not meet your needs.

If you decide to implement SRTP for a passthrough or relay call, take into consideration that a small amount of additional bandwidth is needed for the extra 4 bytes of the SRTP authentication tag. For passthrough calls, this extra bandwidth is negligible, typically an additional 2 percent of overhead. For Cisco fax relay, budget an additional 6 percent of bandwidth per call when SRTP is used.

Continue reading here: Error Correction Mode

Was this article helpful?

0 0