Secure Voice Data Examples - Dialogic DMG1000 User Manual

request secure audio and will reject all requests for non-secure audio. If SRTP_Preferred is
specified, the gateway will request both secure audio and non-secure audio, with a preference
for secure audio, and the gateway will accept requests for both secure and non-secure audio. If
RTP_Only is specified, the gateway will only request non-secure audio and will only accept
requests for non-secure audio.
Note: SRTP_Preferred is not supported in Version 5.1 SU2 Software.
• Master Key Index (MKI) on Transmit Stream - With SRTP, audio data for a conversation is
encrypted using a key that is called the session key. Each session key is derived from a master
key communicated through SIP SDP. Multiple master keys may be used to add security. When
multiple master keys are used, the master key index is used to identify a master key. When an
audio data packet arrives, the master key index is specified in the packet so the packet receiver
knows which key to use to decrypt the packet. Not all the devices support this feature.
Key Derivation Enable - Key derivation refers to the process used to generate a session key
•
from a master key. If the session key is generated once for each conversation, Key Derivation
Enabled is set to false. Otherwise, if a session key is generated more than once from a master
key, Key Derivation Enabled is set to true. Enabling Key Derivation provides more security,
but not all devices support this feature.
• Key Derivation Rate (KDR) - This parameter is only usable if Key Derivation Enabled is set to
Yes. KDR takes values of 16 to 24. When 0 is specified, the session key is only derived once,
which is the same as when Key derivation Enabled set to No. However, if key derivation rate is
to a value greater than 0, a new session key from the same master key is derived whenever the
audio data packet index reaches the multiple of 2
The session key will be derived whenever a packet index reaches 65536, 2*65536, 3*65536,
etc...
Cipher Mode - Cipher is the algorithm used to encrypt/decrypt a packet. The Media Gateway
•
supports plain text or AES counter mode. When plain text is specified, no
encryption/decryption is performed on the audio data and Authentication is skipped. By
default, the Media Gateway supports the AES counter mode.
Note: Plain_Text is not supported in Version 5.1 SU2 Software.
• Authentication Type - The Media Gateway supports no authentication or SHA1. It is
recommended that you use authentication whenever the cipher is non-null as it provides more
security.
• Authentication tag length. When SHA1 is used, the tag can be 32 bits or 80 bits. By default,
the Media Gateway supports SHA1 80 bits.
7.4.2

Secure Voice Data Examples

The following examples show how the Media Gateway should be configured for SRTP.
Example1:
In this example, the Media Gateway is talking to an IP phone that requires security and supports the
following:
Cipher: AES Counter Mode
•
• Authentication: SHA1 32 bits or 80 bits
®
Dialogic 1000 and 2000 Media Gateway Series User's Guide — September 2007
Dialogic Corporation
KDR
. For example, if KDR is 16, 2
Data Security
16
= 65536.
177