make MKI a stream level setting #690
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Move "use_mki" from a per packet parameter to a stream wide value. When using MKI all master keys need to have a valid MKI id. Merge the MKI protect & unprotect functions. The MKI index is currently still passed per packet, this could also be moved up to stream level with a srtp_set_mki(ssrc) api as this is not likely to change per packet.
|
This started as an attempt to merge the protect & unprotect api's but became a more fundamental change to have MKI as a mode rather than a per packet thing. The test vector was generated from the 2.5 branch. |
paulej
reviewed
Feb 5, 2024
RFC 3711 section-3.2.1 states that the use of MKI and the size of the MKI id must be fixed for the life time of stream. By moving the mki_size value along with mki_use value to the stream level allows this to be enforced for all keys. Added a unit test to verify it can not be changed via an update.
pabuhler
force-pushed
the
use_mki-move-to-stream
branch
from
3fccb8b
to
d1afbb0
Compare
paulej
approved these changes
Feb 9, 2024
| { | ||
| srtp_err_status_t status = srtp_err_status_ok; | ||
| if (p->key != NULL) { | ||
| if (p->use_mki) { |
There was a problem hiding this comment.
Would a single key be a reason to not use MKI? Perhaps pointless, but illegal?
There was a problem hiding this comment.
I think we will end up removing the single key option in the policy, it was only left there for ABI compatibility when MKI was first added.
It is "illegal" today as the single key option does not contain a mki id.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Move "use_mki" from a per packet parameter to a stream wide value. When using MKI all master keys need to have a valid MKI id.
Merge the MKI protect & unprotect functions. The MKI index is currently still passed per packet, this could also be moved up to stream level with a srtp_set_mki(ssrc) api as this is not likely to change per packet.