You can configure the media security policy at a global, cluster, or service profile level. The service profile level is used to configure the media security policy for a single endpoint or a group of endpoints.
Modifying the media security policy does not require a Device Adapter snap-in restart.
The 2004 phase 0 and phase 1 UNIStim phones do not support Media Security. Hence, registration is rejected if Media security is set to Always for these phones.
The following are the supported protocols for each media security policy type:
-
Off: SRTP is disabled for endpoints.
-
Best-effort: SRTP is preferred.
-
Always: Only SRTP is possible. RTP is disabled.
The Secured number of packets (NKEY) and Session key validity time (TKEY) attributes define near-end SRTP key lifetime.
The lifetime is presented in SIP SDP offer/answer and expressed in 2^x packets.
For example,
a=crypto:1 AES_CM_128_HMAC_SHA1_80
inline:PS1uQCVeeCFCanVmcjkpPywjNWhcYD0mXXtxaVBR|2^20|1:32
In the preceding example, the key length is 2^20 == 1 048 576 packets
The Session key validity time (TKEY) attribute is used to calculate the number of packets (2^x) by using the maximum length of time and a negotiated codec. You can configure the maximum length of time (TKEY attribute) between 8 to 168 hours. The default is 24 hours.
The Secured number of packets (NKEY) attribute is used as top margin. It is expressed in 2^x, where x is 16 to 31. The default is 31. If the lifetime calculated by using the Session key validity time (TKEY) attribute is greater than NKEY, then the NKEY value is set as the lifetime.
For example,
TKEY = 24 hours
NKEY = 20 (power of 2)
codec = G729A, 30ms
Lifetime based on TKEY and G729/30ms codec is 2 937 600 packets == 2 ^ 21.
NKEY(20) is less than 21, thus the resulting lifetime is 2^20.
When the SRTP key is about to expire during a call, UNIStim phone/VGW channel notifies Device Adapter. Device Adapter sends a new SDP offer with a newly generated master key. The feature is automatic and does not require any provisioning.
