Configure sdes-profile

A Session Description Protocol Security Descriptions (SDES) profile specifies the parameter values offered or accepted during SDES negotiation.

In the following procedure, use the key and salt parameters to generate the synchronous key used to encrypt and decrypt SRTP/SRTCP traffic originated by theOracle® Enterprise Session Border Controller (E-SBC). The E-SBC passes these concatenated values to the remote SRTP peer. Upon reception, the remote peer inputs the key and salt values to the negotiated encryption algorithm (AES in the current implementation), and derives the key required to decrypt SRTP/SRTCP traffic received from the E-SBC. The key parameter provides the basic keying material, while the salt (a bit string) provides the randomsess/entropy required by the encryption algorithm.

1. Access the sdes-profile configuration element.

   ORACLE# configure terminal
   ORACLE(configure)# security
   ORACLE(security)# media-security
   ORACLE(media-security)# sdes-profile
   ORACLE(sdes-profile)# 

2. In sdes-profile, do the following:

   name	Type the unique name of this profile.
   crypto-suite	Add one or more cryptography suites to this profile. Default: AES_CM_128_HMAC_SHA1_80. Valid values: AES_CM_128_HMAC_SHA1_80 | AES_CM_128_HMAC_SHA1_32.
   srtp-auth	Enable authentication of RTP packets. Default: enable. Valid values: enable | disable.
   srtp-encrypt	Enable to reject an answer that contains an UNENCRYPTED_SRTP session parameter in the crypto attribute. Disable to not to offer RTP encryption and include an UNENCRYPTED_SRTP session parameter in the SDP crypto attribute and accept an answer that contains an UNENCRYPTED_SRTP session parameter. Default: enable. Valid values: enable | disable.
   srtcp-encrypt	Enable to offer RTCP encryption, and reject an answer that contains an UNENCRYPTED_SRTCP session parameter in the crypto attribute. Disable to not offer RTCP encryption and include an UNENCRYPTED_SRTCP session parameter in the SDP crypto attribute; accepting an answer that contains an UNENCRYPTED_SRTCP session parameter. Default: enable. Valid values: enable | disable.
   mki	Enable or disable the use of the master key identifier within the SDP crypto attribute that differentiates one key from another. Enable—The E-SBC sends an MKI field within the crypto attribute (16 bytes maximum). Express MKI as a pair of decimal numbers in the form: |mki:mki_length| where MKI is the MKI integer value and MKI length is the length of the MKI field in bytes. Disable—The E-SBC sends no MKI field. Default: disable. Valid values: enable | disable.
   egress-offer-format	Set the egress offer format for this profile to use when you also set the outbound mode in the associated media security policy to "any." If the media security policy requires either RTP or SRTP, ignore this parameter. same-as-ingress—The E-SBC does not change the profile of the media lines. simultaneous-best- effort—The E-SBC inspects the incoming offer SDP, and adds one of the following: an RTP/SAVP media line for any media profile that has only the RTP/AVP media profile an RTP/AVP media line for any media profile that has only the RTP/SAVP media profile Default: same as ingress. Valid values: same as ingress | simultaneous best effort.
   use-ingress-session-params	Add one or more allowable ingress session parameters. Default: none. Valid values: srtcp-encrypt | srtcp-auth | srtcp-encrypt.
   lifetime	Add the lifetime parameter value to a=crypto in the SDP offer. Default: 0 (Do not add lifetime to a=crypto.) Valid values: 0, 20-48. (Express as 2^<value>. For example, using the value 2^20: inline:zYALksQps3ntUw/KsbDdNuxChEQ81Z3BqvTJH|2^20)
   options	Add one or more optional features and parameters.
   key	Type the master key. (for testing purposes)
   salt	Type the master salt. (for testing purposes)
   srtp-rekey-on-re-invite	Enable to generate new outbound srtp keys on every re-invite. Default: disable. Valid values: enable | disable.

3. Type done to save the configuration.
4. 
   

• Repeat steps 1 through 8 to configure additional SDES profiles.