<div dir="ltr">I've started to get into the implementation but this will be the first time I touch GStreamer-related code so I would like to ask for some directions/suggestions.<div>I've found the 'GstDtlsSrtpCipher' in 'gstdtlsconnection.h' and added an AES256 field:<br><br></div>typedef enum {<br> GST_DTLS_SRTP_CIPHER_AES_128_ICM = 1,<br> GST_DTLS_SRTP_CIPHER_AEAD_AES_256_GCM = 8<br><div>} GstDtlsSrtpCipher; </div><div><br></div><div>I've chosen AEAD AES-256 GCM because that was the only supported AES-256 in openssl/srtp.h:<br>/* AEAD SRTP protection profiles from RFC 7714 */<br># define SRTP_AEAD_AES_128_GCM 0x0007<br># define SRTP_AEAD_AES_256_GCM 0x0008<br></div><div><br></div><div>I added a new field to '_GstDtlsAgentPrivate' in 'gstdtlsagent.c' as well that helps deciding about the AES type to use:</div><div><br></div><div>struct _GstDtlsAgentPrivate<br>{<br> SSL_CTX *ssl_context;<br> GstDtlsCertificate *certificate;<br> uint8_t type; // new field<br>};<br></div><div><br></div><div>I have several questions here:</div><div>- will this addition to _GstDtlsAgentPrivate cause any problems (aligning/padding/etc)?</div><div>- where should I add some enum or #define value so it is better than putting 0/1 into it?</div><div>- I found this:</div><div>enum<br>{<br> PROP_0,<br> PROP_CERTIFICATE,<br> NUM_PROPERTIES<br>};<br><br>static GParamSpec *properties[NUM_PROPERTIES];<br></div><div><br></div><div>and that it is used to set the value(?) of the Certificate part of _GstDtlsAgentPrivate. Should I add type into it and set an initial value and add it to gst_dtls_agent_set_property() so I can set the value of type from webrtcbin? Or am I completely off track and it's not used for that?</div><div><br></div><div>Also, as I see, the AEAD AES-256 GCM contains all the auth stuff but the AES-128 ICM doesn't. Will I need to do additional coding to make the AES-256 work or OpenSSL handles this part under the hood?</div><div><br></div><div>I'll be offline for two days but will continue investigating/working on the topic next week. </div><div><br></div><div>Thanks!</div><div>Laszlo Molnar</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Nov 13, 2023 at 10:13 AM Laszlo Molnar <<a href="mailto:laszlo.molnar@nixs.com">laszlo.molnar@nixs.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Olivier,<div><br></div><div>Thank you for your help! I'll get familiar with the code base and if I feel like I'm comfortable with changing it, I'll do the work. I may get back with more questions as well. By the way, there is an unfinished sentence in your answer. Is something missing or was it just a typo?</div><div><br></div><div>Laszlo</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Nov 10, 2023 at 8:37 PM Olivier Crête <<a href="mailto:olivier.crete@collabora.com" target="_blank">olivier.crete@collabora.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div><div>Hi,</div><div><br></div><div>To do this, you need to modify the dtls plugin to give the right profiles to OpenSSL, look at the call to SSL_CTX_set_tlsext_use_srtp(), then search for the enum that reads it out to the SRTP elements (which already support AES-256). You </div><div><br></div><div>And then we'd need to add an API to webrtcbin to select it.</div><div><br></div><div>Olivier</div><div><br></div><div>On Fri, 2023-11-10 at 18:11 +0100, Laszlo Molnar via gstreamer-devel wrote:</div><blockquote type="cite" style="margin:0px 0px 0px 0.8ex;border-left:2px solid rgb(114,159,207);padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>I want to achieve AES-256 encryption with webrtcbin (so webrtcbin uses AES-256-encoded SRTP packets). As I see from the source code (correct me if I'm wrong) webrtcbin uses DTLS and that only has AES-128. Is it possible to change this? To make a pipeline that uses an AES-256 encoder and disable webrtcbin's DTLS encoding? Any solution would work as long as it achieves AES-256.</div><div><br></div><div>Thanks!</div></div></blockquote><div><br></div><div><span><pre>-- <br></pre><pre>Olivier Crête <a href="mailto:olivier.crete@collabora.com" target="_blank">olivier.crete@collabora.com</a> Multimedia Lead </pre></span></div></div> </div></blockquote></div> </blockquote></div>