SRTP Multicast

[Nayggets]

Problem with SRTP UDP multicast Axis

Context

Hello, I'm a developer at ActiaTelecom.
We've developed an RTSPS/SRTP client, and we've finished the development and moved into a testing phase. Everything is working fine so far except for one thing: the Axis UDP multicast transmission.

Non-compliance with standards

If you didn't know, AXIS doesn't comply with the RFC 3830 and 4567 standards regarding key exchange. Normally, if a camera adheres to the standard, it should enforce this security information during the DESCRIBE part of the protocol and receive a client validation response in the SETUP, as other cameras we've tested with do, where multicast functions properly. However, with Axis, here's how it works (as described in the SRTP Integration Guide): the camera sends us a MIKEY message during the DESCRIBE, which we're supposed to ignore. Then, we need to generate one, send it during the SETUP and use it.

Problem

When we try to initiate a multicast communication, potentially involving multiple clients, who enforces this security information? The first client? The server? Apart from this, there's also an issue: the SSRC sent by the camera in multicast SRTP packets is different from the one sent in the MIKEY messages (the one ignored and the one we generate), whereas this wasn't the case in unicast, and it's expected to be the same SSRC.

Help

Can anyone tell me if the problem stems from the camera's configuration or from Axis, or if I don't understand something or miss un information.

Attached

Attached are Wireshark captures, RTSP exchange logs, and MIKEY message parses for you to verify the points I've raised yourself.
Where you can find a RTSPS/SRTP correct exchange in UDP Unicast and the bad exchange UDP multicast.
Attached.zip

[github-actions[bot]]

This automatically generated reply acts as a friendly reminder.

Answers to your questions will most often come from the community, from developers like yourself. You will, from time to time, find that Axis employees answers some of the questions, but this is not a guarantee. Think of the discussion forum as a complement to other support channels, not a replacement to any of them.

If your question remains unanswered for a period of time, please revisit it to see whether it can be improved by following the guidelines listed in Axis support guidelines.