rtc_srtp/lib.rs
1#![warn(rust_2018_idioms)]
2#![warn(missing_docs)]
3#![allow(dead_code)]
4
5//! SRTP and SRTCP for the Sans-I/O WebRTC stack.
6//!
7//! The Secure Real-time Transport Protocol ([RFC 3711]) as WebRTC keys it: protection
8//! profiles negotiated through DTLS-SRTP ([RFC 5764]), with keying material exported from
9//! the DTLS handshake rather than signalled.
10//!
11//! # Structure
12//!
13//! * [`context`] — [`Context`](context::Context), the encrypt/decrypt state for one
14//! direction: `encrypt_rtp`/`decrypt_rtp` and the RTCP equivalents, plus the replay
15//! protection and rollover-counter tracking the RFC requires.
16//! * [`protection_profile`] — the negotiable profiles (AES-128-CM-SHA1-80,
17//! AEAD-AES-128-GCM, and friends) and their key/salt lengths.
18//! * [`config`], [`option`] — how a context is built, including replay-window sizing.
19//!
20//! # Example
21//!
22//! A profile is negotiated through DTLS-SRTP, and it fixes the key, salt and tag sizes the
23//! context will use:
24//!
25//! ```
26//! use rtc_srtp::protection_profile::ProtectionProfile;
27//!
28//! let profile = ProtectionProfile::Aes128CmHmacSha1_80;
29//! assert_eq!(profile.key_len(), 16); // AES-128
30//! assert_eq!(profile.salt_len(), 14);
31//! assert_eq!(profile.rtp_auth_tag_len(), 10); // 80-bit tag
32//!
33//! // The AEAD profiles authenticate inside the cipher, so they carry no HMAC key.
34//! assert_eq!(ProtectionProfile::AeadAes128Gcm.auth_key_len(), 0);
35//! ```
36//!
37//! Most applications do not depend on this crate directly — the
38//! [`rtc`](https://docs.rs/rtc) crate creates the contexts from the DTLS handshake and
39//! applies them to media as one layer of the peer-connection pipeline.
40//!
41//! [RFC 3711]: https://datatracker.ietf.org/doc/html/rfc3711
42//! [RFC 5764]: https://datatracker.ietf.org/doc/html/rfc5764
43
44mod cipher;
45/// Session configuration: keys, protection profile, and replay-protection options.
46pub mod config;
47/// The encrypt/decrypt state for one SRTP/SRTCP session.
48pub mod context;
49mod key_derivation;
50/// Per-context options, currently the replay-detector factory.
51pub mod option;
52/// The DTLS-SRTP protection profiles and their key, salt and tag lengths.
53pub mod protection_profile;
54
55#[cfg(all(feature = "aws-lc-rs", feature = "ring"))]
56compile_error!("At most one of the features \"aws-lc-rs\" and \"ring\" can be enabled.");
57#[cfg(not(any(feature = "aws-lc-rs", feature = "ring")))]
58compile_error!("At least one of the features \"aws-lc-rs\" and \"ring\" must be enabled.");
59#[cfg(feature = "aws-lc-rs")]
60extern crate aws_lc_rs as ring;