Skip to content

SRTP Audio Back Channel support #805

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
venki5685 wants to merge 4 commits into
base: development
Choose a base branch
from
Open

SRTP Audio Back Channel support #805

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d12cb5f
SecureStreamingProtocolAlgorithm optional parameter is added to Audio…
venki5685 Jul 10, 2026
273510c
dockbook quick fix
Aug 7, 2026
1a675b9
reverting wron committed file
Aug 7, 2026
f1a8d8c
SRTP Audio Back Channel - RTSPS SDP and SETUP Request example added
venki5685 Aug 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 49 additions & 4 deletions doc/Streaming.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,14 @@
</author>
<revremark>Add support for SRTP.</revremark>
</revision>
<revision>
<revnumber>26.12</revnumber>
<date>Dec-2026</date>
<author>
<personname>Venki Aravapalli</personname>
</author>
<revremark>Add support for SRTP Audio Back Channel.</revremark>
</revision>
</revhistory>
</info>
<chapter>
Expand Down Expand Up @@ -2189,7 +2197,7 @@ Sec-WebSocket-Protocol: rtsp.onvif.org
<title>Cryptographic algorithm negotiation</title>
<para>This mechanism allows the client to choose the encryption algorithm used by the device for SRTP.</para>
<para>
The device shall list supported SRTP cryptographic algorithms via the SecureStreamingProtocolAlgorithms structure included in the Media2 service video encoder, audio encoder and metadata configuration elements as listed below: (ONVIF specification)
The device shall list supported SRTP cryptographic algorithms via the SecureStreamingProtocolAlgorithms structure included in the Media2 service video encoder, audio encoder, audio decoder and metadata configuration elements as listed below: (ONVIF specification)
<itemizedlist>
<listitem>
<para>AudioEncoder2ConfigurationOptions</para>
Expand Down Expand Up @@ -2238,6 +2246,9 @@ Sec-WebSocket-Protocol: rtsp.onvif.org
<listitem>
<para>SetMetadataConfiguration</para>
</listitem>
<listitem>
<para>SetAudioDecoderConfiguration</para>
</listitem>
</itemizedlist>
</para>
</section>
Expand Down Expand Up @@ -2339,7 +2350,7 @@ Sec-WebSocket-Protocol: rtsp.onvif.org
<para>
When the device is providing the key, the SDP is required to have a media of
type RTP/SAVP and a MIKEY message, unless the device stream has been configured with the NONE SrtpSecurityAlgorithm.
The MIKEY message shall contain the key information for the algorithm that was configured with SetAudioEncoderConfiguration, SetMetadataConfiguration and
The MIKEY message shall contain the key information for the algorithm that was configured with SetAudioEncoderConfiguration, SetMetadataConfiguration, SetAudioDecoderConfiguration and
SetVideoEncoderConfiguration.
If the device stream has been configured with the NONE algorithm, the media shall be of type RTP/AVP and it shall not contain a MIKEY message. (ONVIF specification)
<programlisting><![CDATA[v=0
Expand All @@ -2360,12 +2371,12 @@ a=control:rtsp://movie.example.com/action/srtp_video
When the client is providing the key, it will add a KeyMgmt header
containing the MIKEY with transport type RTP/SAVP in the SETUP. (RFC 4567)
The client may request a different encryption algorithm than what is configured with
SetAudioEncoderConfiguration, SetMetadataConfiguration and
SetAudioEncoderConfiguration, SetMetadataConfiguration, SetAudioDecoderConfiguration and
SetVideoEncoderConfiguration for legacy reasons. Newer clients should respect the
encryption algorithm set in the configuration and avoid overriding it in the SETUP
request. The client shall not change the encryption algorithm after the stream has
been started. (ONVIF specification)
<programlisting><![CDATA[SETUP rtsp://<RTSP_URI> RTSP/1.0
<programlisting><![CDATA[SETUP rtsps://<RTSP_URI> RTSP/1.0
CSeq: 2
User-Agent: OmnicastRTSPClient/1.0
Transport: RTP/SAVP/UDP;unicast
Expand All @@ -2376,6 +2387,40 @@ AIBAQMBFAcBAQgBAQoBAQsBCgAAACcAIQAe30C59UrClE0e27UP5h/Wty9UL8+dfzg+2ttmmo3kBAAAA
during the RTSP session setup. The SSRC shall be provided in the transport header
of the RTSP SETUP response. (RFC 2326 Section 12.39)
</para>
<para>
For an audio back channel, the device includes the MIKEY key in the SDP media
description of the back channel track. The client shall use this key to encrypt
the audio back channel packets it sends to the device, and the device shall use
the same key to decrypt them.
<programlisting><![CDATA[m=audio 0 RTP/SAVP 0
c=IN IP4 0.0.0.0
b=AS:8
a=key-mgmt:mikey AQAFAEsJfAUBAABSMfATAAAAAA...
a=rtpmap:0 PCMU/8000
a=sendonly
a=control:audio_back
]]>
</programlisting>
</para>
<para>
Alternatively, the client can supply its own key for the audio back channel by
including a KeyMgmt header with a MIKEY message in the SETUP request for the
audio back channel track, overriding the key provided by the device in the SDP.
The device shall then use this new key to decrypt the audio back channel
packets.
<programlisting><![CDATA[SETUP rtsps://192.168.0.1/live1s1.sdp/audio_back RTSP/1.0
CSeq: 2
Authorization: Digest username="admin", realm="LIVE555 Streaming Media",
nonce="4c1dc8a68ea51fec57dd24b892c6ac38",
uri="rtsps://192.168.0.1/live1s1.sdp", response="a0c646fe00936602851eb8e83eb68502"
User-Agent: LIVE555 Streaming Media v2026.03.23
Transport: RTP/SAVP;unicast;client_port=63460-63461
KeyMgmt: prot=mikey; uri="rtsps://192.168.0.1/live1s1.sdp/audio_back";
data="AQAFAD5+Fz0BAAAfpSX4AAAAAAsA7gShYz//NqwKEFwq5F31sCoL0v1+4tC1swgBAAAAGwABBgEBEAIBA
AQBDAUBAAcBAQgBAQoBABQBEAAAACUAMQAcfkrX2Cu71pIds6levaylStUuUhjbHs7Arv9KgQSbFrGKAA=="
]]>
</programlisting>
</para>
</section>
<section>
<title>Client Re-Keying with MIKEY</title>
Expand Down
5 changes: 5 additions & 0 deletions wsdl/ver10/schema/onvif.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2070,6 +2070,11 @@ decoding .A decoder shall decode every data it receives (according to its capabi
<xs:sequence>
<xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/> <!-- first Vendor then ONVIF -->
</xs:sequence>
<xs:attribute name="SecureStreamingProtocolAlgorithm" type="xs:string" use="optional">
<xs:annotation>
<xs:documentation>Defines the cryptographic algorithm to use as defined by tt:SrtpSecurityAlgorithms.This parameter is applicable only to the ONVIF Media2 Service.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:anyAttribute processContents="lax"/>
</xs:extension>
</xs:complexContent>
Expand Down