This feature lets rtpproxy act as an srtp endpoint, allowing it to encrypt outgoing rtp streams and decrypt incoming media streams. This should increase overall security of media proxying.

Management

  • DTLS encryption is available starting from Sippy 2023 version.
  • Enabling/disabling of encryption is performed per-connection by setting "DTLS.local" as "Outbound Proxy" and force Media Relay to be always enabled.

This way the call with non-encrypted RTP would be received from the Caller, then encryption of media would be agreed with Vendor that has Outbound Proxy = DTLS.local configured on Connection. As a result the media between Caller and Sippy would be sent without encryption (RTP) but between Sippy and Vendor with encryption (SRTP).


Example of the setup of Vendor-Connection:



Example of the setup for Linphone registered on Vendor’s side to receive the calls with encryption:



Troubleshooting:

Media encryption could be seen as indication on UA, or via tcpdump in SDP:


FAQ:


1. Do trunk Connections support SIP/TLS (with an SSL certificate, CA list and TLS method) and DTLS.local as an outbound proxy for SRTP? 


Trunk Connections currently support SIP/UDP and SIP/TCP only. They do not provide SIP/TLS certificate, CA list, TLS method, or DTLS.local outbound proxy settings.


2. What is the recommended way to deliver DID calls to the customer through their Account/Trunk configured with SIP/TLS and DTLS.local? 


To deliver DID calls securely to your PBX, we recommend using a Vendor Connection configured with SIP/TLS, the required certificate and TLS options, Outbound Proxy = DTLS.local, and Use Media Relay = Always. The DID can remain assigned to your Account, with unconditional Follow Me forwarding through a Routing Group that selects this connection. This provides TLS signaling and DTLS-SRTP media on the connection between Sippy and your PBX. 


3. Does the current version support SRTP with SDES key exchange (a=crypto), or only DTLS-SRTP? Is SDES planned? 


The current implementation supports DTLS-SRTP key exchange. SDES (a=crypto) is not supported for media encryption/decryption by the switch. Sippy Softswitch does not have a confirmed SDES implementation.


4. The DTLS-SRTP gateway offers these protection profiles:

  • SRTP_AES128_CM_SHA1_80
  • SRTP_AES128_CM_SHA1_32
  • SRTP_AEAD_AES_128_GCM
  • SRTP_AEAD_AES_256_GCM

 The profile used for a call is negotiated with your PBX based on the profiles both sides   support.