Add support for SRTP

6 files changed, 1103 insertions, 66 deletions

diff --git a/plugins/rtp/CMakeLists.txt b/plugins/rtp/CMakeLists.txt
index 2b66f6ff..ef2f7698 100644
--- a/plugins/rtp/CMakeLists.txt
+++ b/plugins/rtp/CMakeLists.txt
@@ -18,18 +18,20 @@ SOURCES
     src/video_widget.vala
     src/register_plugin.vala
 CUSTOM_VAPIS
+    ${CMAKE_BINARY_DIR}/exports/crypto-vala.vapi
     ${CMAKE_BINARY_DIR}/exports/xmpp-vala.vapi
     ${CMAKE_BINARY_DIR}/exports/dino.vapi
     ${CMAKE_BINARY_DIR}/exports/qlite.vapi
+    ${CMAKE_CURRENT_SOURCE_DIR}/src/srtp.vapi
 PACKAGES
     ${RTP_PACKAGES}
 OPTIONS
     --vapidir=${CMAKE_CURRENT_SOURCE_DIR}/vapi
 )
 
-add_definitions(${VALA_CFLAGS} -DG_LOG_DOMAIN="rtp")
-add_library(rtp SHARED ${RTP_VALA_C})
-target_link_libraries(rtp libdino ${RTP_PACKAGES})
+add_definitions(${VALA_CFLAGS} -DG_LOG_DOMAIN="rtp" -I${CMAKE_CURRENT_SOURCE_DIR}/src)
+add_library(rtp SHARED ${RTP_VALA_C} src/srtp.c)
+target_link_libraries(rtp libdino crypto-vala ${RTP_PACKAGES})
 set_target_properties(rtp PROPERTIES PREFIX "")
 set_target_properties(rtp PROPERTIES LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/plugins/)
 
diff --git a/plugins/rtp/src/module.vala b/plugins/rtp/src/module.vala
index 577e9f53..ecf7b658 100644
--- a/plugins/rtp/src/module.vala
+++ b/plugins/rtp/src/module.vala
@@ -200,65 +200,23 @@ public class Dino.Plugins.Rtp.Module : JingleRtp.Module {
         plugin.close_stream(rtp_stream);
     }
 
-//    public uint32 get_session_id(string id) {
-//        return (uint32) id.split("-")[0].to_int();
-//    }
-//
-//    public string create_feed(string media, bool incoming) {
-//        init();
-//        string id = random_uuid();
-//        if (media == "audio") {
-//            id = "0-" + id;
-//        } else {
-//            id = "1-" + id;
-//        }
-//        MediaDevice? device = plugin.get_preferred_device(media, incoming);
-//        Feed feed;
-//        if (incoming) {
-//            if (media == "audio") {
-//                feed = new IncomingAudioFeed(id, this, device);
-//            } else if (media == "video") {
-//                feed = new IncomingVideoFeed(id, this, device);
-//            } else {
-//                critical("Incoming feed of media '%s' not supported", media);
-//                return id;
-//            }
-//        } else {
-//            if (media == "audio") {
-//                string? matching_incoming_feed_id = null;
-//                foreach (Feed match in plugin.feeds.values) {
-//                    if (match is IncomingAudioFeed) {
-//                        matching_incoming_feed_id = match.id;
-//                    }
-//                }
-//                feed = new OutgoingAudioFeed(id, this, device);
-//            } else if (media == "video") {
-//                feed = new OutgoingVideoFeed(id, this, device);
-//            } else {
-//                critical("Outgoing feed of media '%s' not supported", media);
-//                return id;
-//            }
-//        }
-//        plugin.add_feed(id, feed);
-//        return id;
-//    }
-//
-//    public void connect_feed(string id, JingleRtp.PayloadType payload, Jingle.DatagramConnection connection) {
-//        if (!plugin.feeds.has_key(id)) {
-//            critical("Tried to connect feed with id %s, but no such feed found", id);
-//            return;
-//        }
-//        Feed feed = plugin.feeds[id];
-//        feed.connect(payload, connection);
-//    }
-//
-//    public void destroy_feed(string id) {
-//        if (!plugin.feeds.has_key(id)) {
-//            critical("Tried to destroy feed with id %s, but no such feed found", id);
-//            return;
-//        }
-//        Feed feed = plugin.feeds[id];
-//        feed.destroy();
-//        plugin.feeds.remove(id);
-//    }
+    public override JingleRtp.Crypto? generate_local_crypto() {
+        uint8[] keyAndSalt = new uint8[30];
+        Crypto.randomize(keyAndSalt);
+        return JingleRtp.Crypto.create(JingleRtp.Crypto.AES_CM_128_HMAC_SHA1_80, keyAndSalt);
+    }
+
+    public override JingleRtp.Crypto? pick_remote_crypto(Gee.List<JingleRtp.Crypto> cryptos) {
+        foreach (JingleRtp.Crypto crypto in cryptos) {
+            if (crypto.is_valid) return crypto;
+        }
+        return null;
+    }
+
+    public override JingleRtp.Crypto? pick_local_crypto(JingleRtp.Crypto? remote) {
+        if (remote == null || !remote.is_valid) return null;
+        uint8[] keyAndSalt = new uint8[30];
+        Crypto.randomize(keyAndSalt);
+        return remote.rekey(keyAndSalt);
+    }
 }
\ No newline at end of file
diff --git a/plugins/rtp/src/srtp.c b/plugins/rtp/src/srtp.c
new file mode 100644
index 00000000..708244d9
--- /dev/null
+++ b/plugins/rtp/src/srtp.c
@@ -0,0 +1,836 @@
+/*
+ * Secure RTP with libgcrypt
+ * Copyright (C) 2007  Rémi Denis-Courmont
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/* TODO:
+ * Useless stuff (because nothing depends on it):
+ * - non-nul key derivation rate
+ * - MKI payload
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdint.h>
+#include <stddef.h>
+
+#include "srtp.h"
+
+#include <stdbool.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <errno.h>
+
+#include <gcrypt.h>
+
+#ifdef _WIN32
+# include <winsock2.h>
+#else
+# include <netinet/in.h>
+#endif
+
+#define debug( ... ) (void)0
+
+typedef struct srtp_proto_t
+{
+    gcry_cipher_hd_t cipher;
+    gcry_md_hd_t     mac;
+    uint64_t         window;
+    uint32_t         salt[4];
+} srtp_proto_t;
+
+struct srtp_session_t
+{
+    srtp_proto_t rtp;
+    srtp_proto_t rtcp;
+    unsigned flags;
+    unsigned kdr;
+    uint32_t rtcp_index;
+    uint32_t rtp_roc;
+    uint16_t rtp_seq;
+    uint16_t rtp_rcc;
+    uint8_t  tag_len;
+};
+
+enum
+{
+    SRTP_CRYPT,
+    SRTP_AUTH,
+    SRTP_SALT,
+    SRTCP_CRYPT,
+    SRTCP_AUTH,
+    SRTCP_SALT
+};
+
+
+static inline unsigned rcc_mode (const srtp_session_t *s)
+{
+    return (s->flags >> 4) & 3;
+}
+
+
+static void proto_destroy (srtp_proto_t *p)
+{
+    gcry_md_close (p->mac);
+    gcry_cipher_close (p->cipher);
+}
+
+
+/**
+ * Releases all resources associated with a Secure RTP session.
+ */
+void srtp_destroy (srtp_session_t *s)
+{
+    assert (s != NULL);
+
+    proto_destroy (&s->rtcp);
+    proto_destroy (&s->rtp);
+    free (s);
+}
+
+
+static int proto_create (srtp_proto_t *p, int gcipher, int gmd)
+{
+    if (gcry_cipher_open (&p->cipher, gcipher, GCRY_CIPHER_MODE_CTR, 0) == 0)
+    {
+        if (gcry_md_open (&p->mac, gmd, GCRY_MD_FLAG_HMAC) == 0)
+            return 0;
+        gcry_cipher_close (p->cipher);
+    }
+    return -1;
+}
+
+
+/**
+ * Allocates a Secure RTP one-way session.
+ * The same session cannot be used both ways because this would confuse
+ * internal cryptographic counters; it is however of course feasible to open
+ * multiple simultaneous sessions with the same master key.
+ *
+ * @param encr encryption algorithm number
+ * @param auth authentication algortihm number
+ * @param tag_len authentication tag byte length (NOT including RCC)
+ * @param flags OR'ed optional flags.
+ *
+ * @return NULL in case of error
+ */
+srtp_session_t *
+srtp_create (int encr, int auth, unsigned tag_len, int prf, unsigned flags)
+{
+    if ((flags & ~SRTP_FLAGS_MASK))
+        return NULL;
+
+    int cipher, md;
+    switch (encr)
+    {
+        case SRTP_ENCR_NULL:
+            cipher = GCRY_CIPHER_NONE;
+            break;
+
+        case SRTP_ENCR_AES_CM:
+            cipher = GCRY_CIPHER_AES;
+            break;
+
+        default:
+            return NULL;
+    }
+
+    switch (auth)
+    {
+        case SRTP_AUTH_NULL:
+            md = GCRY_MD_NONE;
+            break;
+
+        case SRTP_AUTH_HMAC_SHA1:
+            md = GCRY_MD_SHA1;
+            break;
+
+        default:
+            return NULL;
+    }
+
+    if (tag_len > gcry_md_get_algo_dlen (md))
+        return NULL;
+
+    if (prf != SRTP_PRF_AES_CM)
+        return NULL;
+
+    srtp_session_t *s = malloc (sizeof (*s));
+    if (s == NULL)
+        return NULL;
+
+    memset (s, 0, sizeof (*s));
+    s->flags = flags;
+    s->tag_len = tag_len;
+    s->rtp_rcc = 1; /* Default RCC rate */
+    if (rcc_mode (s))
+    {
+        if (tag_len < 4)
+            goto error;
+    }
+
+    if (proto_create (&s->rtp, cipher, md) == 0)
+    {
+        if (proto_create (&s->rtcp, cipher, md) == 0)
+            return s;
+        proto_destroy (&s->rtp);
+    }
+
+    error:
+    free (s);
+    return NULL;
+}
+
+
+/**
+ * Counter Mode encryption/decryption (ctr length = 16 bytes)
+ * with non-padded (truncated) text
+ */
+static int
+do_ctr_crypt (gcry_cipher_hd_t hd, const void *ctr, uint8_t *data, size_t len)
+{
+    const size_t ctrlen = 16;
+    div_t d = div (len, ctrlen);
+
+    if (gcry_cipher_setctr (hd, ctr, ctrlen)
+        || gcry_cipher_encrypt (hd, data, d.quot * ctrlen, NULL, 0))
+        return -1;
+
+    if (d.rem)
+    {
+        /* Truncated last block */
+        uint8_t dummy[ctrlen];
+        data += d.quot * ctrlen;
+        memcpy (dummy, data, d.rem);
+        memset (dummy + d.rem, 0, ctrlen - d.rem);
+
+        if (gcry_cipher_encrypt (hd, dummy, ctrlen, data, ctrlen))
+            return -1;
+        memcpy (data, dummy, d.rem);
+    }
+
+    return 0;
+}
+
+
+/**
+ * AES-CM key derivation (saltlen = 14 bytes)
+ */
+static int
+do_derive (gcry_cipher_hd_t prf, const void *salt,
+           const uint8_t *r, size_t rlen, uint8_t label,
+           void *out, size_t outlen)
+{
+    uint8_t iv[16];
+
+    memcpy (iv, salt, 14);
+    iv[14] = iv[15] = 0;
+
+    assert (rlen < 14);
+    iv[13 - rlen] ^= label;
+    for (size_t i = 0; i < rlen; i++)
+        iv[sizeof (iv) - rlen + i] ^= r[i];
+
+    memset (out, 0, outlen);
+    return do_ctr_crypt (prf, iv, out, outlen);
+}
+
+
+/**
+ * Sets (or resets) the master key and master salt for a SRTP session.
+ * This must be done at least once before using srtp_send(), srtp_recv(),
+ * srtcp_send() or srtcp_recv(). Also, rekeying is required every
+ * 2^48 RTP packets or 2^31 RTCP packets (whichever comes first),
+ * otherwise the protocol security might be broken.
+ *
+ * @return 0 on success, in case of error:
+ *  EINVAL  invalid or unsupported key/salt sizes combination
+ */
+int
+srtp_setkey (srtp_session_t *s, const void *key, size_t keylen,
+             const void *salt, size_t saltlen)
+{
+    /* SRTP/SRTCP cipher/salt/MAC keys derivation */
+    gcry_cipher_hd_t prf;
+    uint8_t r[6], keybuf[20];
+
+    if (saltlen != 14)
+        return EINVAL;
+
+    if (gcry_cipher_open (&prf, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CTR, 0)
+        || gcry_cipher_setkey (prf, key, keylen))
+        return EINVAL;
+
+    /* SRTP key derivation */
+#if 0
+    if (s->kdr != 0)
+    {
+        uint64_t index = (((uint64_t)s->rtp_roc) << 16) | s->rtp_seq;
+        index /= s->kdr;
+
+        for (int i = sizeof (r) - 1; i >= 0; i--)
+        {
+            r[i] = index & 0xff;
+            index = index >> 8;
+        }
+    }
+    else
+#endif
+    memset (r, 0, sizeof (r));
+    if (do_derive (prf, salt, r, 6, SRTP_CRYPT, keybuf, 16)
+        || gcry_cipher_setkey (s->rtp.cipher, keybuf, 16)
+        || do_derive (prf, salt, r, 6, SRTP_AUTH, keybuf, 20)
+        || gcry_md_setkey (s->rtp.mac, keybuf, 20)
+        || do_derive (prf, salt, r, 6, SRTP_SALT, s->rtp.salt, 14))
+        return -1;
+
+    /* SRTCP key derivation */
+    memcpy (r, &(uint32_t){ htonl (s->rtcp_index) }, 4);
+    if (do_derive (prf, salt, r, 4, SRTCP_CRYPT, keybuf, 16)
+        || gcry_cipher_setkey (s->rtcp.cipher, keybuf, 16)
+        || do_derive (prf, salt, r, 4, SRTCP_AUTH, keybuf, 20)
+        || gcry_md_setkey (s->rtcp.mac, keybuf, 20)
+        || do_derive (prf, salt, r, 4, SRTCP_SALT, s->rtcp.salt, 14))
+        return -1;
+
+    (void)gcry_cipher_close (prf);
+    return 0;
+}
+
+static int hexdigit (char c)
+{
+    if ((c >= '0') && (c <= '9'))
+        return c - '0';
+    if ((c >= 'A') && (c <= 'F'))
+        return c - 'A' + 0xA;
+    if ((c >= 'a') && (c <= 'f'))
+        return c - 'a' + 0xa;
+    return -1;
+}
+
+static ssize_t hexstring (const char *in, uint8_t *out, size_t outlen)
+{
+    size_t inlen = strlen (in);
+
+    if ((inlen > (2 * outlen)) || (inlen & 1))
+        return -1;
+
+    for (size_t i = 0; i < inlen; i += 2)
+    {
+        int a = hexdigit (in[i]), b = hexdigit (in[i + 1]);
+        if ((a == -1) || (b == -1))
+            return -1;
+        out[i / 2] = (a << 4) | b;
+    }
+    return inlen / 2;
+}
+
+/**
+ * Sets (or resets) the master key and master salt for a SRTP session
+ * from hexadecimal strings. See also srtp_setkey().
+ *
+ * @return 0 on success, in case of error:
+ *  EINVAL  invalid or unsupported key/salt sizes combination
+ */
+int
+srtp_setkeystring (srtp_session_t *s, const char *key, const char *salt)
+{
+    uint8_t bkey[16]; /* TODO/NOTE: hard-coded for AES */
+    uint8_t bsalt[14]; /* TODO/NOTE: hard-coded for the PRF-AES-CM */
+    ssize_t bkeylen = hexstring (key, bkey, sizeof (bkey));
+    ssize_t bsaltlen = hexstring (salt, bsalt, sizeof (bsalt));
+
+    if ((bkeylen == -1) || (bsaltlen == -1))
+        return EINVAL;
+    return srtp_setkey (s, bkey, bkeylen, bsalt, bsaltlen) ? EINVAL : 0;
+}
+
+/**
+ * Sets Roll-over-Counter Carry (RCC) rate for the SRTP session. If not
+ * specified (through this function), the default rate of ONE is assumed
+ * (i.e. every RTP packets will carry the RoC). RCC rate is ignored if none
+ * of the RCC mode has been selected.
+ *
+ * The RCC mode is selected through one of these flags for srtp_create():
+ *  SRTP_RCC_MODE1: integrity protection only for RoC carrying packets
+ *  SRTP_RCC_MODE2: integrity protection for all packets
+ *  SRTP_RCC_MODE3: no integrity protection
+ *
+ * RCC mode 3 is insecure. Compared to plain RTP, it provides confidentiality
+ * (through encryption) but is much more prone to DoS. It can only be used if
+ * anti-spoofing protection is provided by lower network layers (e.g. IPsec,
+ * or trusted routers and proper source address filtering).
+ *
+ * If RCC rate is 1, RCC mode 1 and 2 are functionally identical.
+ *
+ * @param rate RoC Carry rate (MUST NOT be zero)
+ */
+void srtp_setrcc_rate (srtp_session_t *s, uint16_t rate)
+{
+    assert (rate != 0);
+    s->rtp_rcc = rate;
+}
+
+
+/** AES-CM for RTP (salt = 14 bytes + 2 nul bytes) */
+static int
+rtp_crypt (gcry_cipher_hd_t hd, uint32_t ssrc, uint32_t roc, uint16_t seq,
+           const uint32_t *salt, uint8_t *data, size_t len)
+{
+    /* Determines cryptographic counter (IV) */
+    uint32_t counter[4];
+    counter[0] = salt[0];
+    counter[1] = salt[1] ^ ssrc;
+    counter[2] = salt[2] ^ htonl (roc);
+    counter[3] = salt[3] ^ htonl (seq << 16);
+
+    /* Encryption */
+    return do_ctr_crypt (hd, counter, data, len);
+}
+
+
+/** Determines SRTP Roll-Over-Counter (in host-byte order) */
+static uint32_t
+srtp_compute_roc (const srtp_session_t *s, uint16_t seq)
+{
+    uint32_t roc = s->rtp_roc;
+
+    if (((seq - s->rtp_seq) & 0xffff) < 0x8000)
+    {
+        /* Sequence is ahead, good */
+        if (seq < s->rtp_seq)
+            roc++; /* Sequence number wrap */
+    }
+    else
+    {
+        /* Sequence is late, bad */
+        if (seq > s->rtp_seq)
+            roc--; /* Wrap back */
+    }
+    return roc;
+}
+
+
+/** Returns RTP sequence (in host-byte order) */
+static inline uint16_t rtp_seq (const uint8_t *buf)
+{
+    return (buf[2] << 8) | buf[3];
+}
+
+
+/** Message Authentication and Integrity for RTP */
+static const uint8_t *
+rtp_digest (gcry_md_hd_t md, const uint8_t *data, size_t len,
+            uint32_t roc)
+{
+    gcry_md_reset (md);
+    gcry_md_write (md, data, len);
+    gcry_md_write (md, &(uint32_t){ htonl (roc) }, 4);
+    return gcry_md_read (md, 0);
+}
+
+
+/**
+ * Encrypts/decrypts a RTP packet and updates SRTP context
+ * (CTR block cypher mode of operation has identical encryption and
+ * decryption function).
+ *
+ * @param buf RTP packet to be en-/decrypted
+ * @param len RTP packet length
+ *
+ * @return 0 on success, in case of error:
+ *  EINVAL  malformatted RTP packet
+ *  EACCES  replayed packet or out-of-window or sync lost
+ */
+static int srtp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
+{
+    assert (s != NULL);
+    assert (len >= 12u);
+
+    if ((buf[0] >> 6) != 2)
+        return EINVAL;
+
+    /* Computes encryption offset */
+    uint16_t offset = 12;
+    offset += (buf[0] & 0xf) * 4; // skips CSRC
+
+    if (buf[0] & 0x10)
+    {
+        uint16_t extlen;
+
+        offset += 4;
+        if (len < offset)
+            return EINVAL;
+
+        memcpy (&extlen, buf + offset - 2, 2);
+        offset += htons (extlen); // skips RTP extension header
+    }
+
+    if (len < offset)
+        return EINVAL;
+
+    /* Determines RTP 48-bits counter and SSRC */
+    uint16_t seq = rtp_seq (buf);
+    uint32_t roc = srtp_compute_roc (s, seq), ssrc;
+    memcpy (&ssrc, buf + 8, 4);
+
+    /* Updates ROC and sequence (it's safe now) */
+    int16_t diff = seq - s->rtp_seq;
+    if (diff > 0)
+    {
+        /* Sequence in the future, good */
+        s->rtp.window = s->rtp.window << diff;
+        s->rtp.window |= UINT64_C(1);
+        s->rtp_seq = seq, s->rtp_roc = roc;
+    }
+    else
+    {
+        /* Sequence in the past/present, bad */
+        diff = -diff;
+        if ((diff >= 64) || ((s->rtp.window >> diff) & 1))
+            return EACCES; /* Replay attack */
+        s->rtp.window |= UINT64_C(1) << diff;
+    }
+
+    /* Encrypt/Decrypt */
+    if (s->flags & SRTP_UNENCRYPTED)
+        return 0;
+
+    if (rtp_crypt (s->rtp.cipher, ssrc, roc, seq, s->rtp.salt,
+                   buf + offset, len - offset))
+        return EINVAL;
+
+    return 0;
+}
+
+
+/**
+ * Turns a RTP packet into a SRTP packet: encrypt it, then computes
+ * the authentication tag and appends it.
+ * Note that you can encrypt packet in disorder.
+ *
+ * @param buf RTP packet to be encrypted/digested
+ * @param lenp pointer to the RTP packet length on entry,
+ *             set to the SRTP length on exit (undefined on non-ENOSPC error)
+ * @param bufsize size (bytes) of the packet buffer
+ *
+ * @return 0 on success, in case of error:
+ *  EINVAL  malformatted RTP packet or internal error
+ *  ENOSPC  bufsize is too small to add authentication tag
+ *          (<lenp> will hold the required byte size)
+ *  EACCES  packet would trigger a replay error on receiver
+ */
+int
+srtp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t bufsize)
+{
+    size_t len = *lenp;
+    size_t tag_len;
+    size_t roc_len = 0;
+
+    /* Compute required buffer size */
+    if (len < 12u)
+        return EINVAL;
+
+    if (!(s->flags & SRTP_UNAUTHENTICATED))
+    {
+        tag_len = s->tag_len;
+
+        if (rcc_mode (s))
+        {
+            assert (tag_len >= 4);
+            assert (s->rtp_rcc != 0);
+            if ((rtp_seq (buf) % s->rtp_rcc) == 0)
+            {
+                roc_len = 4;
+                if (rcc_mode (s) == 3)
+                    tag_len = 0; /* RCC mode 3 -> no auth*/
+                else
+                    tag_len -= 4; /* RCC mode 1 or 2 -> auth*/
+            }
+            else
+            {
+                if (rcc_mode (s) & 1)
+                    tag_len = 0; /* RCC mode 1 or 3 -> no auth */
+            }
+        }
+
+        *lenp = len + roc_len + tag_len;
+    }
+    else
+        tag_len = 0;
+
+    if (bufsize < *lenp)
+        return ENOSPC;
+
+    /* Encrypt payload */
+    int val = srtp_crypt (s, buf, len);
+    if (val)
+        return val;
+
+    /* Authenticate payload */
+    if (!(s->flags & SRTP_UNAUTHENTICATED))
+    {
+        uint32_t roc = srtp_compute_roc (s, rtp_seq (buf));
+        const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, roc);
+
+        if (roc_len)
+        {
+            memcpy (buf + len, &(uint32_t){ htonl (s->rtp_roc) }, 4);
+            len += 4;
+        }
+        memcpy (buf + len, tag, tag_len);
+#if 0
+        printf ("Sent    : 0x");
+        for (unsigned i = 0; i < tag_len; i++)
+            printf ("%02x", tag[i]);
+        puts ("");
+#endif
+    }
+
+    return 0;
+}
+
+
+/**
+ * Turns a SRTP packet into a RTP packet: authenticates the packet,
+ * then decrypts it.
+ *
+ * @param buf RTP packet to be digested/decrypted
+ * @param lenp pointer to the SRTP packet length on entry,
+ *             set to the RTP length on exit (undefined in case of error)
+ *
+ * @return 0 on success, in case of error:
+ *  EINVAL  malformatted SRTP packet
+ *  EACCES  authentication failed (spoofed packet or out-of-sync)
+ */
+int
+srtp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp)
+{
+    size_t len = *lenp;
+    if (len < 12u)
+        return EINVAL;
+
+    if (!(s->flags & SRTP_UNAUTHENTICATED))
+    {
+        size_t tag_len = s->tag_len, roc_len = 0;
+        if (rcc_mode (s))
+        {
+            if ((rtp_seq (buf) % s->rtp_rcc) == 0)
+            {
+                roc_len = 4;
+                if (rcc_mode (s) == 3)
+                    tag_len = 0;
+                else
+                    tag_len -= 4;
+            }
+            else
+            {
+                if (rcc_mode (s) & 1)
+                    tag_len = 0; // RCC mode 1 or 3: no auth
+            }
+        }
+
+        if (len < (12u + roc_len + tag_len))
+            return EINVAL;
+        len -= roc_len + tag_len;
+
+        uint32_t roc = srtp_compute_roc (s, rtp_seq (buf)), rcc;
+        if (roc_len)
+        {
+            assert (roc_len == 4);
+            memcpy (&rcc, buf + len, 4);
+            rcc = ntohl (rcc);
+        }
+        else
+            rcc = roc;
+
+        const uint8_t *tag = rtp_digest (s->rtp.mac, buf, len, rcc);
+#if 0
+        printf ("Computed: 0x");
+        for (unsigned i = 0; i < tag_len; i++)
+            printf ("%02x", tag[i]);
+        printf ("\nReceived: 0x");
+        for (unsigned i = 0; i < tag_len; i++)
+            printf ("%02x", buf[len + roc_len + i]);
+        puts ("");
+#endif
+        if (memcmp (buf + len + roc_len, tag, tag_len))
+            return EACCES;
+
+        if (roc_len)
+        {
+            /* Authenticated packet carried a Roll-Over-Counter */
+            s->rtp_roc += rcc - roc;
+            assert (srtp_compute_roc (s, rtp_seq (buf)) == rcc);
+        }
+        *lenp = len;
+    }
+
+    return srtp_crypt (s, buf, len);
+}
+
+
+/** AES-CM for RTCP (salt = 14 bytes + 2 nul bytes) */
+static int
+rtcp_crypt (gcry_cipher_hd_t hd, uint32_t ssrc, uint32_t index,
+            const uint32_t *salt, uint8_t *data, size_t len)
+{
+    return rtp_crypt (hd, ssrc, index >> 16, index & 0xffff, salt, data, len);
+}
+
+
+/** Message Authentication and Integrity for RTCP */
+static const uint8_t *
+rtcp_digest (gcry_md_hd_t md, const void *data, size_t len)
+{
+    gcry_md_reset (md);
+    gcry_md_write (md, data, len);
+    return gcry_md_read (md, 0);
+}
+
+
+/**
+ * Encrypts/decrypts a RTCP packet and updates SRTCP context
+ * (CTR block cypher mode of operation has identical encryption and
+ * decryption function).
+ *
+ * @param buf RTCP packet to be en-/decrypted
+ * @param len RTCP packet length
+ *
+ * @return 0 on success, in case of error:
+ *  EINVAL  malformatted RTCP packet
+ */
+static int srtcp_crypt (srtp_session_t *s, uint8_t *buf, size_t len)
+{
+    assert (s != NULL);
+
+    /* 8-bytes unencrypted header, and 4-bytes unencrypted footer */
+    if ((len < 12) || ((buf[0] >> 6) != 2))
+        return EINVAL;
+
+    uint32_t index;
+    memcpy (&index, buf + len, 4);
+    index = ntohl (index);
+    if (((index >> 31) != 0) != ((s->flags & SRTCP_UNENCRYPTED) == 0))
+        return EINVAL; // E-bit mismatch
+
+    index &= ~(1 << 31); // clear E-bit for counter
+
+    /* Updates SRTCP index (safe here) */
+    int32_t diff = index - s->rtcp_index;
+    if (diff > 0)
+    {
+        /* Packet in the future, good */
+        s->rtcp.window = s->rtcp.window << diff;
+        s->rtcp.window |= UINT64_C(1);
+        s->rtcp_index = index;
+    }
+    else
+    {
+        /* Packet in the past/present, bad */
+        diff = -diff;
+        if ((diff >= 64) || ((s->rtcp.window >> diff) & 1))
+            return EACCES; // replay attack!
+        s->rtp.window |= UINT64_C(1) << diff;
+    }
+
+    /* Crypts SRTCP */
+    if (s->flags & SRTCP_UNENCRYPTED)
+        return 0;
+
+    uint32_t ssrc;
+    memcpy (&ssrc, buf + 4, 4);
+
+    if (rtcp_crypt (s->rtcp.cipher, ssrc, index, s->rtp.salt,
+                    buf + 8, len - 8))
+        return EINVAL;
+    return 0;
+}
+
+
+/**
+ * Turns a RTCP packet into a SRTCP packet: encrypt it, then computes
+ * the authentication tag and appends it.
+ *
+ * @param buf RTCP packet to be encrypted/digested
+ * @param lenp pointer to the RTCP packet length on entry,
+ *             set to the SRTCP length on exit (undefined in case of error)
+ * @param bufsize size (bytes) of the packet buffer
+ *
+ * @return 0 on success, in case of error:
+ *  EINVAL  malformatted RTCP packet or internal error
+ *  ENOSPC  bufsize is too small (to add index and authentication tag)
+ */
+int
+srtcp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t bufsize)
+{
+    size_t len = *lenp;
+    if (bufsize < (len + 4 + s->tag_len))
+        return ENOSPC;
+
+    uint32_t index = ++s->rtcp_index;
+    if (index >> 31)
+        s->rtcp_index = index = 0; /* 31-bit wrap */
+
+    if ((s->flags & SRTCP_UNENCRYPTED) == 0)
+        index |= 0x80000000; /* Set Encrypted bit */
+    memcpy (buf + len, &(uint32_t){ htonl (index) }, 4);
+
+    int val = srtcp_crypt (s, buf, len);
+    if (val)
+        return val;
+
+    len += 4; /* Digests SRTCP index too */
+
+    const uint8_t *tag = rtcp_digest (s->rtcp.mac, buf, len);
+    memcpy (buf + len, tag, s->tag_len);
+    *lenp = len + s->tag_len;
+    return 0;
+}
+
+
+/**
+ * Turns a SRTCP packet into a RTCP packet: authenticates the packet,
+ * then decrypts it.
+ *
+ * @param buf RTCP packet to be digested/decrypted
+ * @param lenp pointer to the SRTCP packet length on entry,
+ *             set to the RTCP length on exit (undefined in case of error)
+ *
+ * @return 0 on success, in case of error:
+ *  EINVAL  malformatted SRTCP packet
+ *  EACCES  authentication failed (spoofed packet or out-of-sync)
+ */
+int
+srtcp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp)
+{
+    size_t len = *lenp;
+
+    if (len < (4u + s->tag_len))
+        return EINVAL;
+    len -= s->tag_len;
+
+    const uint8_t *tag = rtcp_digest (s->rtcp.mac, buf, len);
+    if (memcmp (buf + len, tag, s->tag_len))
+        return EACCES;
+
+    len -= 4; /* Remove SRTCP index before decryption */
+    *lenp = len;
+    return srtcp_crypt (s, buf, len);
+}
\ No newline at end of file
diff --git a/plugins/rtp/src/srtp.h b/plugins/rtp/src/srtp.h
new file mode 100644
index 00000000..abca6988
--- /dev/null
+++ b/plugins/rtp/src/srtp.h
@@ -0,0 +1,82 @@
+/*
+ * Secure RTP with libgcrypt
+ * Copyright (C) 2007  Rémi Denis-Courmont
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1
+ * of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ ****************************************************************************/
+
+#ifndef LIBVLC_SRTP_H
+# define LIBVLC_SRTP_H 1
+#include <stdint.h>
+
+typedef struct srtp_session_t srtp_session_t;
+
+enum
+{
+    SRTP_UNENCRYPTED=0x1,   //< do not encrypt SRTP packets
+    SRTCP_UNENCRYPTED=0x2,  //< do not encrypt SRTCP packets
+    SRTP_UNAUTHENTICATED=0x4, //< authenticate only SRTCP packets
+
+    SRTP_RCC_MODE1=0x10,    //< use Roll-over-Counter Carry mode 1
+    SRTP_RCC_MODE2=0x20,    //< use Roll-over-Counter Carry mode 2
+    SRTP_RCC_MODE3=0x30,    //< use Roll-over-Counter Carry mode 3 (insecure)
+
+    SRTP_FLAGS_MASK=0x37    //< mask for valid flags
+};
+
+/** SRTP encryption algorithms (ciphers); same values as MIKEY */
+enum
+{
+    SRTP_ENCR_NULL=0,   //< no encryption
+    SRTP_ENCR_AES_CM=1, //< AES counter mode
+    SRTP_ENCR_AES_F8=2, //< AES F8 mode (not implemented)
+};
+
+/** SRTP authenticaton algorithms; same values as MIKEY */
+enum
+{
+    SRTP_AUTH_NULL=0,      //< no authentication code
+    SRTP_AUTH_HMAC_SHA1=1, //< HMAC-SHA1
+};
+
+/** SRTP pseudo random function; same values as MIKEY */
+enum
+{
+    SRTP_PRF_AES_CM=0, //< AES counter mode
+};
+
+# ifdef __cplusplus
+extern "C" {
+# endif
+
+srtp_session_t *srtp_create (int encr, int auth, unsigned tag_len, int prf,
+                             unsigned flags);
+void srtp_destroy (srtp_session_t *s);
+
+int srtp_setkey (srtp_session_t *s, const void *key, size_t keylen,
+                 const void *salt, size_t saltlen);
+int srtp_setkeystring (srtp_session_t *s, const char *key, const char *salt);
+
+void srtp_setrcc_rate (srtp_session_t *s, uint16_t rate);
+
+int srtp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t maxsize);
+int srtp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp);
+int srtcp_send (srtp_session_t *s, uint8_t *buf, size_t *lenp, size_t maxsiz);
+int srtcp_recv (srtp_session_t *s, uint8_t *buf, size_t *lenp);
+
+# ifdef __cplusplus
+}
+# endif
+#endif
\ No newline at end of file
diff --git a/plugins/rtp/src/srtp.vapi b/plugins/rtp/src/srtp.vapi
new file mode 100644
index 00000000..c5ce7fec
--- /dev/null
+++ b/plugins/rtp/src/srtp.vapi
@@ -0,0 +1,103 @@
+[Compact]
+[CCode (cname = "srtp_session_t", free_function = "srtp_destroy", cheader_filename="srtp.h")]
+public class Dino.Plugins.Rtp.SrtpSession {
+    [CCode (cname = "srtp_create")]
+    public SrtpSession(SrtpEncryption encr, SrtpAuthentication auth, uint tag_len, SrtpPrf prf, SrtpFlags flags);
+    [CCode (cname = "srtp_setkey")]
+    public int setkey(uint8[] key, uint8[] salt);
+    [CCode (cname = "srtp_setkeystring")]
+    public int setkeystring(string key, string salt);
+    [CCode (cname = "srtp_setrcc_rate")]
+    public void setrcc_rate(uint16 rate);
+
+    [CCode (cname = "srtp_send")]
+    private int rtp_send([CCode (array_length = false)] uint8[] buf, ref size_t len, size_t maxsize);
+    [CCode (cname = "srtcp_send")]
+    private int rtcp_send([CCode (array_length = false)] uint8[] buf, ref size_t len, size_t maxsize);
+    [CCode (cname = "srtp_recv")]
+    private int rtp_recv([CCode (array_length = false)] uint8[] buf, ref size_t len);
+    [CCode (cname = "srtcp_recv")]
+    private int rtcp_recv([CCode (array_length = false)] uint8[] buf, ref size_t len);
+
+    public uint8[] encrypt_rtp(uint8[] input, uint tag_len = 10) throws GLib.Error {
+        uint8[] buf = new uint8[input.length+tag_len];
+        GLib.Memory.copy(buf, input, input.length);
+        size_t buf_use = input.length;
+        int res = rtp_send(buf, ref buf_use, buf.length);
+        if (res != 0) {
+            throw new GLib.Error(-1, res, "RTP encrypt failed");
+        }
+        uint8[] ret = new uint8[buf_use];
+        GLib.Memory.copy(ret, buf, buf_use);
+        return ret;
+    }
+
+    public uint8[] encrypt_rtcp(uint8[] input, uint tag_len = 10) throws GLib.Error {
+        uint8[] buf = new uint8[input.length+tag_len+4];
+        GLib.Memory.copy(buf, input, input.length);
+        size_t buf_use = input.length;
+        int res = rtcp_send(buf, ref buf_use, buf.length);
+        if (res != 0) {
+            throw new GLib.Error(-1, res, "RTCP encrypt failed");
+        }
+        uint8[] ret = new uint8[buf_use];
+        GLib.Memory.copy(ret, buf, buf_use);
+        return ret;
+    }
+
+    public uint8[] decrypt_rtp(uint8[] input) throws GLib.Error {
+        uint8[] buf = new uint8[input.length];
+        GLib.Memory.copy(buf, input, input.length);
+        size_t buf_use = input.length;
+        int res = rtp_recv(buf, ref buf_use);
+        if (res != 0) {
+            throw new GLib.Error(-1, res, "RTP decrypt failed");
+        }
+        uint8[] ret = new uint8[buf_use];
+        GLib.Memory.copy(ret, buf, buf_use);
+        return ret;
+    }
+
+    public uint8[] decrypt_rtcp(uint8[] input) throws GLib.Error {
+        uint8[] buf = new uint8[input.length];
+        GLib.Memory.copy(buf, input, input.length);
+        size_t buf_use = input.length;
+        int res = rtcp_recv(buf, ref buf_use);
+        if (res != 0) {
+            throw new GLib.Error(-1, res, "RTCP decrypt failed");
+        }
+        uint8[] ret = new uint8[buf_use];
+        GLib.Memory.copy(ret, buf, buf_use);
+        return ret;
+    }
+}
+
+[Flags]
+[CCode (cname = "unsigned", cprefix = "", cheader_filename="srtp.h", has_type_id = false)]
+public enum Dino.Plugins.Rtp.SrtpFlags {
+    SRTP_UNENCRYPTED,
+    SRTCP_UNENCRYPTED,
+    SRTP_UNAUTHENTICATED,
+
+    SRTP_RCC_MODE1,
+    SRTP_RCC_MODE2,
+    SRTP_RCC_MODE3
+}
+
+[CCode (cname = "int", cprefix = "SRTP_ENCR_", cheader_filename="srtp.h", has_type_id = false)]
+public enum Dino.Plugins.Rtp.SrtpEncryption {
+    NULL,
+    AES_CM,
+    AES_F8
+}
+
+[CCode (cname = "int", cprefix = "SRTP_AUTH_", cheader_filename="srtp.h", has_type_id = false)]
+public enum Dino.Plugins.Rtp.SrtpAuthentication {
+    NULL,
+    HMAC_SHA1
+}
+
+[CCode (cname = "int", cprefix = "SRTP_PRF_", cheader_filename="srtp.h", has_type_id = false)]
+public enum Dino.Plugins.Rtp.SrtpPrf {
+    AES_CM
+}
\ No newline at end of file
diff --git a/plugins/rtp/src/stream.vala b/plugins/rtp/src/stream.vala
index aea2fe85..362e2d16 100644
--- a/plugins/rtp/src/stream.vala
+++ b/plugins/rtp/src/stream.vala
@@ -53,6 +53,9 @@ public class Dino.Plugins.Rtp.Stream : Xmpp.Xep.JingleRtp.Stream {
     private Gst.Pad send_rtp_sink_pad;
     private Gst.Pad send_rtp_src_pad;
 
+    private SrtpSession? local_crypto_session;
+    private SrtpSession? remote_crypto_session;
+
     public Stream(Plugin plugin, Xmpp.Xep.Jingle.Content content) {
         base(content);
         this.plugin = plugin;
@@ -144,6 +147,20 @@ public class Dino.Plugins.Rtp.Stream : Xmpp.Xep.JingleRtp.Stream {
         plugin.unpause();
     }
 
+    private void prepare_local_crypto() {
+        if (local_crypto != null && local_crypto_session == null) {
+            local_crypto_session = new SrtpSession(
+                    local_crypto.crypto_suite == Xep.JingleRtp.Crypto.F8_128_HMAC_SHA1_80 ? SrtpEncryption.AES_F8 : SrtpEncryption.AES_CM,
+                    SrtpAuthentication.HMAC_SHA1,
+                    local_crypto.crypto_suite == Xep.JingleRtp.Crypto.AES_CM_128_HMAC_SHA1_32 ? 4 : 10,
+                    SrtpPrf.AES_CM,
+                    0
+            );
+            local_crypto_session.setkey(local_crypto.key, local_crypto.salt);
+            debug("Setting up encryption with key params %s", local_crypto.key_params);
+        }
+    }
+
     private Gst.FlowReturn on_new_sample(Gst.App.Sink sink) {
         if (sink == null) {
             debug("Sink is null");
@@ -153,9 +170,16 @@ public class Dino.Plugins.Rtp.Stream : Xmpp.Xep.JingleRtp.Stream {
         Gst.Buffer buffer = sample.get_buffer();
         uint8[] data;
         buffer.extract_dup(0, buffer.get_size(), out data);
+        prepare_local_crypto();
         if (sink == send_rtp) {
+            if (local_crypto_session != null) {
+                data = local_crypto_session.encrypt_rtp(data, local_crypto.crypto_suite == Xep.JingleRtp.Crypto.AES_CM_128_HMAC_SHA1_32 ? 4 : 10);
+            }
             on_send_rtp_data(new Bytes.take(data));
         } else if (sink == send_rtcp) {
+            if (local_crypto_session != null) {
+                data = local_crypto_session.encrypt_rtcp(data, local_crypto.crypto_suite == Xep.JingleRtp.Crypto.AES_CM_128_HMAC_SHA1_32 ? 4 : 10);
+            }
             on_send_rtcp_data(new Bytes.take(data));
         } else {
             warning("unknown sample");
@@ -258,15 +282,47 @@ public class Dino.Plugins.Rtp.Stream : Xmpp.Xep.JingleRtp.Stream {
         recv_rtp_src_pad = null;
     }
 
+    private void prepare_remote_crypto() {
+        if (remote_crypto != null && remote_crypto_session == null) {
+            remote_crypto_session = new SrtpSession(
+                    remote_crypto.crypto_suite == Xep.JingleRtp.Crypto.F8_128_HMAC_SHA1_80 ? SrtpEncryption.AES_F8 : SrtpEncryption.AES_CM,
+                    SrtpAuthentication.HMAC_SHA1,
+                    remote_crypto.crypto_suite == Xep.JingleRtp.Crypto.AES_CM_128_HMAC_SHA1_32 ? 4 : 10,
+                    SrtpPrf.AES_CM,
+                    0
+            );
+            remote_crypto_session.setkey(remote_crypto.key, remote_crypto.salt);
+            debug("Setting up decryption with key params %s", remote_crypto.key_params);
+        }
+    }
+
     public override void on_recv_rtp_data(Bytes bytes) {
+        prepare_remote_crypto();
+        uint8[] data = bytes.get_data();
+        if (remote_crypto_session != null) {
+            try {
+                data = remote_crypto_session.decrypt_rtp(data);
+            } catch (Error e) {
+                warning("%s (%d)", e.message, e.code);
+            }
+        }
         if (push_recv_data) {
-            recv_rtp.push_buffer(new Gst.Buffer.wrapped_bytes(bytes));
+            recv_rtp.push_buffer(new Gst.Buffer.wrapped((owned) data));
         }
     }
 
     public override void on_recv_rtcp_data(Bytes bytes) {
+        prepare_remote_crypto();
+        uint8[] data = bytes.get_data();
+        if (remote_crypto_session != null) {
+            try {
+                data = remote_crypto_session.decrypt_rtcp(data);
+            } catch (Error e) {
+                warning("%s (%d)", e.message, e.code);
+            }
+        }
         if (push_recv_data) {
-            recv_rtcp.push_buffer(new Gst.Buffer.wrapped_bytes(bytes));
+            recv_rtcp.push_buffer(new Gst.Buffer.wrapped((owned) data));
         }
     }