<?xml version="1.0" encoding="UTF-8"?>
  <?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
  <!-- generated by https://github.com/cabo/kramdown-rfc version 1.7.25 (Ruby 3.1.2) -->


<!DOCTYPE rfc  [
  <!ENTITY nbsp    "&#160;">
  <!ENTITY zwsp   "&#8203;">
  <!ENTITY nbhy   "&#8209;">
  <!ENTITY wj     "&#8288;">

]>


<rfc ipr="trust200902" docName="draft-sprang-avtcore-corruption-detection-01" category="info" consensus="true" submissionType="IETF" tocInclude="true" sortRefs="true" symRefs="true">
  <front>
    <title abbrev="Video Corruption Detection">RTP Header Extension for Automatic Detection of Video Corruptions</title>

    <author fullname="Erik Språng">
      <organization>Google</organization>
      <address>
        <email>sprang@google.com</email>
      </address>
    </author>

    <date year="2025" month="September" day="12"/>

    <area>AREA</area>
    <workgroup>avtcore WG</workgroup>
    <keyword>RTP</keyword> <keyword>Header Extension</keyword> <keyword>Video</keyword> <keyword>Corruption</keyword>

    <abstract>


<?line 62?>

<t>This document describes an RTP header extensions that can be use to carry select filtered samples from a video frame together with metrics relating to the expected distortions caused by lossy compression of said frame. This data allows a receiver to validate that the output from a decoder matches the frame the went into the encoder on the remote - i.e. validating that the video pipeline is in a correct state free of any video corruptions.</t>



    </abstract>

    <note title="About This Document" removeInRFC="true">
      <t>
        The latest revision of this draft can be found at <eref target="https://github.com/sprangerik/corruption-detection/blob/main/draft-sprang-avtcore-corruption-detection.md"/>.
        Status information for this document may be found at <eref target="https://datatracker.ietf.org/doc/draft-sprang-avtcore-corruption-detection/"/>.
      </t>
      <t>
        Discussion of this document takes place on the
        avtcore WG Working Group mailing list (<eref target="mailto:avt@ietf.org"/>),
        which is archived at <eref target="https://datatracker.ietf.org/wg/avtcore"/>.
        Subscribe at <eref target="https://www.ietf.org/mailman/listinfo/avt/"/>.
      </t>
      <t>Source for this draft and an issue tracker can be found at
        <eref target="https://github.com/sprangerik/corruption-detection"/>.</t>
    </note>


  </front>

  <middle>


<?line 66?>

<section anchor="introduction"><name>Introduction</name>

<t>The Corruption Detection (sometimes referred to as automatic corruption detection or ACD) extension is intended to be a part of a system that allows estimating a likelihood that a video transmission is in a valid state. That is, the input to the video encoder on the send side corresponds to the output of the video decoder on the receive side with the only difference being the expected distortions from lossy compression.</t>

<t>The goal is to be able to detect outright coding errors caused by things such as bugs in encoder/decoders, malformed packetization data, incorrect relay decisions in SFU-type servers, incorrect handling of packet loss/reordering, and so forth. This should be accomplished with a high signal-to-noise ratio while consuming a minimum of resources in terms of bandwidth and/or computation. It should be noted that it is not a goal to be able to e.g. gauge general video quality using this method.</t>

<t>This is accomplished in two steps. On the sender side:</t>

<t><list style="symbols">
  <t>Pseudo randomly (using a Halton Sequence) sampling a small set of locations within the input to the encoder.</t>
  <t>Applying a gaussian low-pass filter in order to supress encoding distortions.</t>
  <t>Determining an "allowed error" threshold, below which samples are not determined as erroneus.</t>
</list></t>

<t>Then, on the receiver side:</t>

<t><list style="symbols">
  <t>Sampling the same locations as the sender, but in the output image from the decoder.</t>
  <t>Applying the same low-pass filter as the sender</t>
  <t>Comparing the values in the samples provided in the header extension with those sample from the output image,
subtracting the allowed error from each sample pair.</t>
</list></t>

</section>
<section anchor="conventions-and-definitions"><name>Conventions and Definitions</name>

<t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they
appear in all capitals, as shown here.</t>

<?line -18?>

</section>
<section anchor="applicability"><name>Applicability</name>

<t>The Corruption Detection extension can be used to validate the correctness of any video pipeline in an end-to-end manner, as long as there is no termination of the bitstream in the process. It is designed to be codec agnostic.</t>

<t>In terms of <xref target="RFC7667"/>, any Point-to-Point or Transport Translator topologies can be used. The header extension just needs to be propagated together with the media packet until the decode stage. If however a Media Translator is used, the header extension needs to be extracted at the time of decoding there (e.g during transcoding). If corruption detection is desired to the end user, then a new Corruption Detection header extension needs to be created as part of the middlebox encoding step and thet can then be carried forward.</t>

</section>
<section anchor="corruption-detection"><name>Corruption Detection</name>

<t><em>Name:</em>  "Corruption Detection"; "Extension for Automatic Detection of Video Corruptions"</t>

<t><em>Formal name:</em> http://www.webrtc.org/experiments/rtp-hdrext/corruption-detection</t>

<t><em>Status:</em> This extension is defined here to allow for experimentation. Experience with the experiment has shown that it is useful; this draft therefore presents it to the IETF for consideration of whether to standardize it or leave it as a proprietary extension.</t>

<section anchor="rtp-header-extension-format"><name>RTP header extension format</name>

<section anchor="data-layout-overview"><name>Data layout overview</name>

<t>Data layout of a corruption-detection header extension, using a One-Byte header (see <xref target="RFC5285"/>) section 4.2:</t>

<figure><artwork><![CDATA[
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  ID   | len=7 |B|  seq index  |    std dev    | Y err | UV err|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    sample 0   |    sample 1   |    ... up to sample <= 12     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork></figure>

<t>Data layout of a corruption-detection header extension, using a Two-Byte header (see <xref target="RFC5285"/>) section 4.3:</t>

<figure><artwork><![CDATA[
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      ID       |     L=0       |  ID   | len=7 |B|  seq index  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    std dev    | Y err | UV err|    sample 0   |    sample 1   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   ...   up to sample <= 255                   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork></figure>

</section>
<section anchor="data-layout-details"><name>Data layout details</name>

<section anchor="b-1-bit"><name>B (1 bit)</name>

<t>Whether the sequence number should be interpreted as the MSB or LSB of the full size 14 bit sequence index described in the next point.</t>

</section>
<section anchor="seq-index-7-bits"><name>seq index (7 bits)</name>

<t>The index into the Halton sequence (used to locate where the samples should be drawn from).</t>

<t>If B is set: the 7 most significant bits of the true index. The 7 least significant bits of the true index shall be interpreted as 0.
This is because this is the point where we can guarantee that the sender and receiver has the same full index. B <bcp14>MUST</bcp14> be set on keyframes.
On droppable frames B <bcp14>MUST NOT</bcp14> be set.
If B is not set: The 7 LSB of the true index. The 7 most significant bits should be inferred based on the most recent message.</t>

</section>
<section anchor="std-dev-8-bits"><name>std dev (8 bits)</name>

<t>The standard deviation of the Gaussian filter used to weigh the samples. The value is scaled using a linear map:
0 = 0.0 to 255 = 40.0. A std dev of 0 is interpreted as directly using just the sample value at the desired coordinate, without any weighting.</t>

</section>
<section anchor="y-err-4-bits"><name>Y err (4 bits)</name>

<t>The allowed error for the luma channel.</t>

</section>
<section anchor="uv-err-4-bits"><name>UV err (4 bits)</name>

<t>The allowed error for the chroma channels.</t>

</section>
<section anchor="sample-n-8-bits"><name>Sample N (8 bits)</name>

<t>The N:th filtered sample from the input image. Each sample represents a new point in one of the image planes, the plane and coordinates being determined by index into the Halton sequence (starting at seq# index and is incremented by one for each sample).
Each sample has gone through a Gaussian filter with the std dev specified above. The samples have been floored to the nearest integer.</t>

</section>
</section>
<section anchor="synchronization-message"><name>Synchronization Message</name>

<t>A special case is the so-called "synchronization" message. Such a message only contains the first byte. They are used to keep the sender and receiver in sync even if no "full" message has been received for a while. Such messages <bcp14>MUST NOT</bcp14> be sent on droppable frames.</t>

</section>
</section>
<section anchor="details-of-operation"><name>Details of Operation</name>

<section anchor="halton-sequence-handling"><name>Halton Sequence Handling</name>

<t>The sender and receiver need to find the same set of pseudo random sampling locations for an instrumented frame. Sending explicit coordinates for each sample would however use a significant amount of bandwidth, in fact potentially several times the size of the sample values themselves.</t>

<t>To avoid this overhead, we instead define that a 2D Halton Sequence is used to generate the sample coordinates - meaning that the clients only need to keep track of the index into that sequence in order to generate the desired sequence of sampling coordinates.</t>

<t>The bases used are 2 for the row and 3 for the column.</t>

</section>
<section anchor="halton-sequence-algorithm"><name>Halton Sequence Algorithm</name>

<t>In pseudo code, the Halton sequence can implemented as follows:</t>

<t>Inputs: index i, base b
Where b is 2 when calculating the row (y-axis) and 3 when calculating the column (x-axis)</t>

<figure><artwork><![CDATA[
f = 1;
r = 0;
while i > 0 do {
  f = f / b;
  r = r + f * (i mod b);
  i = floor(i / b);
}
return r;  // Coordinate component.
]]></artwork></figure>

<section anchor="sequence-index-counter"><name>Sequence Index Counter</name>

<t>The sequence index into the Halton sequence is a 14 bit unsigned integer, which wraps around to zero on overflow. Only half of those bits are transmitted with any given message.</t>

<t>If B = 1 then the 7 most significant bits are transmitted and the 7 least significant bits are implicitly set to 0. If B = 1 then the 7 least significant bits are transmitted and the most significant bits are inferred for the current state.</t>

<t>For keyframes, the sender <bcp14>MUST</bcp14> set the value of B to 1.</t>

<t>For droppable frames (e.g. non-baselayer frames when using temporal layers), the sender <bcp14>MUST</bcp14> set B to 0 to prevent sender and receiver from out of sync should that frame be lost.</t>

</section>
<section anchor="sequence-index-stepping"><name>Sequence Index Stepping</name>

<t>A sequence index <bcp14>MUST</bcp14> be present on all keyframes of an instrumented video stream, however there are no requirements around which sequence index to start at; the sender may choose that arbitrarily. This means we always start with a known index.</t>

<t>For each sample within the corruption detection header extension, the sequence index is assumed to be incremented by one. This allows a variable amount of samples to be present in an extension, if so desired.</t>

<t>When droppable frames are used (e.g. when using temporal layering), a middle box may drop some frames resulting in a gap between the last sequence of the previous extension and sequence index indicated by the header of the next extension. If this happens and the new frame has B = 0, then the receiver is intended to just increment the sequence number index until the 7 least significant bits in the index matches the value in the extension header (possibly including an increment of the more significant bits).</t>

<t>This means that the sender <bcp14>MUST NOT</bcp14> add &gt;= 127 consecutive samples to droppable frames, otherwise the most significant bits may come out of sync.</t>

<t>If needed, a "sync message" can be added to guarantee sequence index alignment even if no samples are available. This is done by sending a truncated message containing just B and the sequence index.</t>

</section>
</section>
<section anchor="spatial-layer-considerations"><name>Spatial Layer Considerations</name>

<t>When multiple spatial layers are present within a single SSRC, the sender <bcp14>MUST</bcp14> produce a separate and independent stream of corruption detection headers for each spatial layer. This ensures that a receiver can decode and verify the highest spatial layer that is part of the stream they are receiving, and any layers culled by a middlebox does not affect the integrity of e.g. the sequence index series for that layer.</t>

<t>When using a scalability mode where a higher spatial layer uses inter-layer prediction (prediction between frames belonging to the same temporal unit, e.g. the "SxTx" modes in the W3C <xref target="SVC"/> spec), then the frame should be treated as a key-frame if any frame in the dependency chain within that temporal layer is a key-frame.</t>

</section>
<section anchor="sample-filtering"><name>Sample Filtering</name>

<t>The std dev field of the extension indicates the standard deviation of a 2D Gaussian blur kernel that should be applied taking samples - both to the raw input frame before encoding at the sender and to the raw output frame from the decoder at the receiver.</t>

<t>Further, in order to reduce the number of samples the algorithm needs to average - it is optionally allowed to ignore parts of the image where weight from the Gaussian becomes small. In practice, weights below 0.2 have shown to be small enough that they have negligible effect on the end result.</t>

<t>Any samples outside the plane are considered to have weight 0.</t>

<t>Note that this processing is done on a per-image-plane basis.</t>

<t>In pseudo-code, that means we get the following:</t>

<figure><artwork><![CDATA[
// Translate 8bit header value to floating point.
stddev = header.std_dev * (40.0 / 255);
// Max number of samples away from the center.
max_d = ceil(sqrt(-2.0 * ln(0.2) * stddev^2) - 1;
sample_sum = 0;
weight_sum = 0;
for (y = max(0, row - max_d) to min(plane_height, row + max_d) {
  for (x = max(0, col - max_d) to min(plane_width, col + max_d) {
    weight = e^(-1 * ((y - row)^2 + (x - col)^2) / (2 * stddev^2));
    sample_sum += SampleAt(x, y) * weight;
    weight_sum += weight;
  }
}
filtered_sample = sample_sum / weight_sum;
]]></artwork></figure>

</section>
<section anchor="handling-of-image-planes"><name>Handling of Image Planes</name>

<t>For now this header extension is only defined for 4:2:0 chroma subsampling.
// TODO: Discuss supporting other formats.</t>

<t>In order to translate the row/column calculated from the Halton sequence into a coordinate within a given image plane, visualize the U/V (chroma) planes as being attached to the Y (luma) planes as follows:</t>

<figure><artwork><![CDATA[
+------+---+
|      | U |
+  Y   +---+
|      | V |
+------+---+
]]></artwork></figure>

<t>In pseudo code:</t>

<figure><artwork><![CDATA[
row = GetHaltonSequence(seq_index, /*base=*/2) * image_height;
col = GetHaltonSequence(seq_index, /*base=*/3) * image_width * 1.5;

if (col < image_width) {
  HandleSample(Y_PLANE, row, col);
} else if (row < image_height / 2) {
  HandleSample(U_PLANE, row, col - image_width);
} else {
  HandleSample(V_PLANE, row - (image_height / 2), col - image_width);
}
]]></artwork></figure>

</section>
<section anchor="allowed-error-thresholds"><name>Allowed Error Thresholds</name>

<t>The header extension contains two fields for an "allowed error"; one for the luma channel and one for the chrome channels. The two values allow for accommodating different spatial resolutions and thus different error magnitudes for the respective image planes.</t>

<t>When calculating the difference between two samples in a receiving client (i.e. one locally filtered sample and the corresponding remote sample from the header extension) the absolute magnitude of the error should be reduced  by the specified amount.</t>

</section>
<section anchor="determining-filter-size-and-error-thresholds"><name>Determining Filter Size and Error Thresholds</name>

<t>The filter size (std dev of the blur kernel) and the allowed error thresholds <bcp14>SHOULD</bcp14> be set such that 99.5% of filtered samples end up with a delta &lt;= the error threshold for that plane, based on a representative set of test clips and bandwidth constraints.</t>

<t>This text does not put restrictions on how exactly an implementation should determine appropriate thresholds, but a straightforward way is to look at the QP and codec type as this translates roughly the expected compression distortion. Individual implementations may exhibit better or worse performance than an "average" encoder implementation for a given codec type - so a sender is encouraged to compensate for this if the implementation is far outside the expected bounds based on averages.</t>

</section>
<section anchor="calculating-a-corruption-score"><name>Calculating A Corruption Score</name>

<t>This text does not put exact requirements on how the differences calculated should be translated into an output. While it is tempting to try and use the 99.5% percentile aspect and use a simple statistical method to estimate the probability of this magnitude of error with a given confidence interval - in practice that has proven tricky due to the number outliers that don't quite follow a normal distribution.</t>

<t>In practice, it has been found that just taking the sum of all differences squared and dividing by two yields a reasonably good result.</t>

<t>Further improvements in this area should be possible without having to make changes to the message format itself.</t>

</section>
</section>
</section>
<section anchor="security-considerations"><name>Security Considerations</name>

<t>The de facto way of encrypting RTP packets is using SRTP as defined in <xref target="RFC3711"/>.
Unfortunately, SRTP does not provide encryption for header extensions as they are not seen as part of the payload. That poses a serious security risk, as the corruption detection samples are in essence a very sparse encoding of the source image - so given a sufficient number of samples and a static scene an eavesdropper could rather trivially reconstruct the scene from just header extensions.</t>

<t>While technically not required, the sender <bcp14>SHOULD</bcp14> negotiate some form of encryption that covers this header extension. The most straightforward methods is to use either <xref target="RFC6904"/> or <xref target="RFC9335"/>, both of which are specifically designed to allow selective encryption of sensitive RTP header extensions.</t>

</section>
<section anchor="iana-considerations"><name>IANA Considerations</name>

<t>If the WG decides that this extension should be registered as a standardized extension, IANA is requested to perform the appropriate registration.</t>

<t>If the WG decides that this is a private extension, the URL http://www.webrtc.org/experiments/rtp-hdrext/corruption-detection is used to identify the extension.</t>

</section>


  </middle>

  <back>


<references title='References' anchor="sec-combined-references">

    <references title='Normative References' anchor="sec-normative-references">



<reference anchor="RFC2119">
  <front>
    <title>Key words for use in RFCs to Indicate Requirement Levels</title>
    <author fullname="S. Bradner" initials="S." surname="Bradner"/>
    <date month="March" year="1997"/>
    <abstract>
      <t>In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
    </abstract>
  </front>
  <seriesInfo name="BCP" value="14"/>
  <seriesInfo name="RFC" value="2119"/>
  <seriesInfo name="DOI" value="10.17487/RFC2119"/>
</reference>

<reference anchor="RFC8174">
  <front>
    <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
    <author fullname="B. Leiba" initials="B." surname="Leiba"/>
    <date month="May" year="2017"/>
    <abstract>
      <t>RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t>
    </abstract>
  </front>
  <seriesInfo name="BCP" value="14"/>
  <seriesInfo name="RFC" value="8174"/>
  <seriesInfo name="DOI" value="10.17487/RFC8174"/>
</reference>

<reference anchor="RFC5285">
  <front>
    <title>A General Mechanism for RTP Header Extensions</title>
    <author fullname="D. Singer" initials="D." surname="Singer"/>
    <author fullname="H. Desineni" initials="H." surname="Desineni"/>
    <date month="July" year="2008"/>
    <abstract>
      <t>This document provides a general mechanism to use the header extension feature of RTP (the Real-Time Transport Protocol). It provides the option to use a small number of small extensions in each RTP packet, where the universe of possible extensions is large and registration is de-centralized. The actual extensions in use in a session are signaled in the setup information for that session. [STANDARDS-TRACK]</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="5285"/>
  <seriesInfo name="DOI" value="10.17487/RFC5285"/>
</reference>




    </references>

    <references title='Informative References' anchor="sec-informative-references">

<reference anchor="SVC" target="https://www.w3.org/TR/webrtc-svc">
  <front>
    <title>Scalable Video Coding (SVC) Extension for WebRTC</title>
    <author >
      <organization>W3C</organization>
    </author>
    <date year="n.d."/>
  </front>
</reference>


<reference anchor="RFC7667">
  <front>
    <title>RTP Topologies</title>
    <author fullname="M. Westerlund" initials="M." surname="Westerlund"/>
    <author fullname="S. Wenger" initials="S." surname="Wenger"/>
    <date month="November" year="2015"/>
    <abstract>
      <t>This document discusses point-to-point and multi-endpoint topologies used in environments based on the Real-time Transport Protocol (RTP). In particular, centralized topologies commonly employed in the video conferencing industry are mapped to the RTP terminology.</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="7667"/>
  <seriesInfo name="DOI" value="10.17487/RFC7667"/>
</reference>

<reference anchor="RFC3711">
  <front>
    <title>The Secure Real-time Transport Protocol (SRTP)</title>
    <author fullname="M. Baugher" initials="M." surname="Baugher"/>
    <author fullname="D. McGrew" initials="D." surname="McGrew"/>
    <author fullname="M. Naslund" initials="M." surname="Naslund"/>
    <author fullname="E. Carrara" initials="E." surname="Carrara"/>
    <author fullname="K. Norrman" initials="K." surname="Norrman"/>
    <date month="March" year="2004"/>
    <abstract>
      <t>This document describes the Secure Real-time Transport Protocol (SRTP), a profile of the Real-time Transport Protocol (RTP), which can provide confidentiality, message authentication, and replay protection to the RTP traffic and to the control traffic for RTP, the Real-time Transport Control Protocol (RTCP). [STANDARDS-TRACK]</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="3711"/>
  <seriesInfo name="DOI" value="10.17487/RFC3711"/>
</reference>

<reference anchor="RFC6904">
  <front>
    <title>Encryption of Header Extensions in the Secure Real-time Transport Protocol (SRTP)</title>
    <author fullname="J. Lennox" initials="J." surname="Lennox"/>
    <date month="April" year="2013"/>
    <abstract>
      <t>The Secure Real-time Transport Protocol (SRTP) provides authentication, but not encryption, of the headers of Real-time Transport Protocol (RTP) packets. However, RTP header extensions may carry sensitive information for which participants in multimedia sessions want confidentiality. This document provides a mechanism, extending the mechanisms of SRTP, to selectively encrypt RTP header extensions in SRTP.</t>
      <t>This document updates RFC 3711, the Secure Real-time Transport Protocol specification, to require that all future SRTP encryption transforms specify how RTP header extensions are to be encrypted.</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="6904"/>
  <seriesInfo name="DOI" value="10.17487/RFC6904"/>
</reference>

<reference anchor="RFC9335">
  <front>
    <title>Completely Encrypting RTP Header Extensions and Contributing Sources</title>
    <author fullname="J. Uberti" initials="J." surname="Uberti"/>
    <author fullname="C. Jennings" initials="C." surname="Jennings"/>
    <author fullname="S. Murillo" initials="S." surname="Murillo"/>
    <date month="January" year="2023"/>
    <abstract>
      <t>While the Secure Real-time Transport Protocol (SRTP) provides confidentiality for the contents of a media packet, a significant amount of metadata is left unprotected, including RTP header extensions and contributing sources (CSRCs). However, this data can be moderately sensitive in many applications. While there have been previous attempts to protect this data, they have had limited deployment, due to complexity as well as technical limitations.</t>
      <t>This document updates RFC 3711, the SRTP specification, and defines Cryptex as a new mechanism that completely encrypts header extensions and CSRCs and uses simpler Session Description Protocol (SDP) signaling with the goal of facilitating deployment.</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="9335"/>
  <seriesInfo name="DOI" value="10.17487/RFC9335"/>
</reference>




    </references>

</references>


<?line 333?>

<section numbered="false" anchor="acknowledgments"><name>Acknowledgments</name>

<t>Fanny Linderborg and Emil Vardar for their contributions in implementing and evaluating the corruption detection mechanism.</t>

</section>


  </back>

<!-- ##markdown-source:
H4sIAAAAAAAAA91c25IbR3J9x1eUh+EwhgIwF5KiNCS1OxxSEiN4M4ekrHB4
GQV0AdOeRjfU1T0YiOJ+i1/8I/aP+ZzMqr5gQK7s1ZMpRRBodFVlZeXl5KU4
Ho8Ht27dGtwyz/LKlbmrxk9KO6/MC1teJsU6N2/dcpXZyg340huX26Uz1UXq
zTzNnJmXxdIkHDGuiqQYb4q65CvjVVlUxazIJsvEVIVZuMr4ypaVSyaYR9eQ
ueZFubSVwYR7Os/DOMd344frorxclEW9wmd5hOn2JkLK90Vp0jytUpsZ76p6
NTIYaIo825jcOVnVJWkFYrFIWvrKTLNidmmKOb66LPEk5BVf36vSKnN7Msxz
3NSZ2YXNFy55YBKXucqZPTudlu5qz6RzrlMaGUOy/UVRVpzrNN+YAquVZlaA
mXllZjbnXCTDJSMzrSuZ2pZuXmcmLyouluZVWST1DO+VZVEKWecFOSNUmnWa
ZRyGTRpbVwW4lc5sBrqTukzzhe6edGHtjcHkps4D+cqqJ0X+T+BwPsvqBDsZ
Hx7uGXBvb8xz9RX2lAcuZXK+pOC5nbrMN7/gkMzvOJ4woxLhcQjTDebiDFVR
ZMJb7B0cwgc+ndVlSUZdudKnRf4AewGBSTHjbHtc1rhrCwF0upO3FLwqSCRX
8OaytEsK6ricz07MRVWt/MnBwSKtLurpZFYsD2Z2Whx038I8P0NSeDilw0wz
J7SAjrRUJoRDNisl1pokneMDKVVxJYfOhMUN40Aozpy74ObwzuyiYR3kezi5
XmayoX958XxkXDWbTCb73BS0T2TpxOy9efva/OhsgjWfNrNxzGk8d/MEwjir
+Bxy/D5NXGHOirKsV3zm9wYqpphr+7d25N5gBu4tinJzgvOdF4NBYPhJOGK/
KrG1sb2qZkXpxrNmjnES5xgfHg18PV2mnjRWmxUGP3v69vtBXi+nrjwZJFji
xBwfHt8bH347PjoeQCc8dlT7E1OVtRuAxjsDyIk9Madvnp4OGlk6MWFh89MP
g0u3wQ/JycCMDbjDv7YZxGeyWX5o9zu4cnntMNDcnNUYpfgnrEkN+oFv4OnS
ppm8+OfUVfNJUS7w0Jazi1awsC9blXZ26cpJfOlgvTgIs3M5Eb0To1x0ZXp5
sIuDeFOVZafQ/o3BBzBl0wOQmx/87iOD6RwMYEBgrshOrG8MzFCmJ/8US5nz
Vfnf/5kv5Cfsy+bpr5ZDT8wPRbHInPzglEu64p8X8gNpHgxyEfX0ClwfULCa
b8acvz87kdHwAfAF7Z7X6/VkfUe4+PbNwdpNy2o29lczfVn14hzmzk6hYlGm
Ex7aEHPub+nJT2765u2ZjG12Kn/G3A8O/M7ZYDAej42dep5iNRiISYEC1Euq
d+L8rEynsCuwDlTHC5W2Rrlhfi5sY9lhgajtsOjlBrYrA6dpDOBJYfu8GC6v
PtKaKyF+XooDLcAEeoo1jtwsXVWmMw9rBIng1oJ1dNcrTIiZktRXcDKy/MwG
w2qywvsNfM0SZkrUkCbB2zTRRSZqLSmwBu6iWGNPWGLmcCRigK9sllJNdUdc
sKirFXxUIDhxs4J7F1vmvFozJR+f1mQXfFcgNdd3C/UXpVsWmHhs0gnoCAvJ
zuJSyo1VunJZmosfhauxhoJLJgIrVFwN7gCbsvCsOqAVbPhJOcllmiSQTEUw
4khFu3Cubqf1M0MP51qlS+fVF5WKFaxvvWtnGZO0Bhd2+OzJfsfQC9X4kugU
EAhrVgA5QrPxGw9XpVsOBwB1T5fKCWuy9BKbvyiKJLwT9gjBzH2wrA1jhIfK
Fh6sIKaRcDLNeWbhHHSGrdOA3cVQ/KLs9asiV5zTOfNi3hkfT745TREanUIk
VgYSOkXHCB86dXrAn5FbEaobIjvRg1oUQHFpxF6i61URWE8Ky3RxAaVTxVeY
1FEEwNF8ASBWw+XiGKf1QpgWuHAQdgN2LW1Gq4RRK1rwKpg30ZERAVKQPiri
hlxIVeUx2fn378Z0GmBmeSWTta8DCCQZKQMTdWLZ6EHp4LocMdoIIowjKGik
qougmQCOdZbIhmdkSZb6C5AmDLbmAlsGxxe5zQCtx3mRwtaUpNesL4g36FDr
pYoS/kqX9ZIEgLEAaDOn2M2VS8+nU6y/ThPOnCcHRSlnUFey/Yl5VnWIASx1
QSJTweXEqVaPqH8+brKYmIWtgYIWLnclXlD5+aWGtFYbmEcVCUwClbsokkmw
t/i/t2eSui4g3m7lJwDljdhCCCl1cCi3zWvv6gQAEjsolpC9oU5vzY82q3CK
5+6XmpK4r5ZXf/M4cwkQyAXgf6vSSCYHbNvTnyAzEyx3ulplG50Ee4S0wuRD
iccr630w8qRbjpjDfS1CrVNwXEf6OR8tUMmD4pQ5AgqaBOxdxHkPq2P0RZEx
TnD4hacMeY5OhIiaB5GEWTAQos6xuau9qlE+2tLYDvPOI0uEszTiLTOs7/Bb
w5TAm2AcYLMWIdbj06BQPSZ1pu2zqDc5Rpzh1G0Zh8Cs1a4JM+JmETxSkJL4
fNsJRyNU+DimJa5L8ogYVfx8XK/HdB3kbMNmaG+KbdGZnBX5FSMC4Q9094mb
S7SJ72qygEwNoSni1hfvzt/ujfRv8/KVfH7z9J/fPXvz9Ak/n/94+vx582EQ
3jj/8dW750/aT+3Is1cvXjx9+UQH46npPRrsvTj9eU8tyt6r12+fvXp5+jzE
cF0oQ4lRfaWPKiGclQjNIGIcYe/js9f/9R9Hd83Hj//w5vuz46Ojbz99Cl++
Obp/F1/WIlhcTSy+fmWoObCrlbOiBNSxmV2llc1gGa3YtnWOcysRuA1u/ys5
828n5uF0tjq6+114wA33Hkae9R4Kz24+uTFYmbjj0Y5lGm72nm9xuk/v6c+9
75HvnYcP/yRIZnz0zZ++G4gMUTkQqk9TGsMvIJJWrltYmWwhNBehUU4b08NE
LYjKaVigaHQY9PlLm+fUaBxIVtDsiC6WTq26UUtiYzTJRaZpBWDs7DKqHlQR
vsSLj6B0ObqkBu7QDsyMXeQFgM0MR/2s43M+fvwTpOj+11/f//RpJPS+LiCK
JE4+EFC9JdZZwUrqJ+DfgsZ0VWTFInW+yxB6zR2m4N9rX/UyN6B4ZRdWnFgP
ZnM78P2pjU66hn5nHYtGeLUAvHo2NxBfdyWh/wsZ0aEOXCA5o92WqUsJntL2
UOsU9BJ1kjOyXDBJOI0hHGlM5gj401/3hZKdUDScRICu6rgSklUKWQSMuVvv
lrYvkjzD2auZaICssE1A9rS4br0bfbVYBfyu8ZAsrPmtMsUcwDprW9Ln39pJ
CQzDS8aet43Z25mneGD2/q9pkMHt7xl+ZpJjxAoMN2O0KTGmRJwEqmVKawmw
Vq3GF0kJtuwO1we3zwGXao/JBML0ooCE3gFbluNkMEE3E9JXcYmAtZ7KA0HM
jVS2LwFLRuPZQWA4WETqD4KBl9ypSM6c+QyiDu6A7wZhYCZGVidGBHPKRsdh
vUUhiFcqnB7OJ/3VcSjezpy9ks+MhUSPQCgC9k27WR7mrZ2BcUh08fdb5gmD
TmDogpEF9OgqdevBoPd0HqK9bUbfmHhkIs57lbvx403VaN2Q2UL1VfeOv7n3
6ROQX5jk7uQYsEdC/0Nz88/RjmfHO57diVMc4ec75q65Z74298035tv/zTOZ
5Kvx3/mfzPKbMc+eyN+Zyx/dN789xhPvfoG5Tty1/I7vFUIvd6Xv/0ysg7/f
veeH3/5YWkwETodb34/i98lkYuqVyJv+8vCROVJW/1G0/P2C9XZd/H7BuvP/
VbD4R4Sr/f780WH7/cuC94cL1heE+G8J3h/Pl94fyrS5IdXH9+7tePePE/Jt
uwrBtmnm5Ydb5rEZHhG97Q8GP0UbL2GXxsRG8/KdML8fFMjLL84f0w0851/q
95kfRgwJD4EQAbO38+mx90IJDsihXWZFdDcJhLUyMrwv8HJfkbA+axKIIYZv
5h9GDCxhqqPjKl0vSGy3Ao8If8lgbp8QdA5mML3CNDMH3DdLwFPJpaRz4HF4
WdIR98hqhFKjCPM+/eDveh8kWK3NbTHzcNKkOaZO8lTqulPls/An7GjtBDst
agvgV7lOMjakPwixmnD+IkbTUjnl4QTCHxuJqEKZEIxEeCq5Wj8ZvAJyhC9f
SdpGH8b3GfLomEnDN2YZhHfKjI403OTUbsZ2hSwkWKeWxxmyEzKKe8IAEOMJ
uqO0BK0fftOVlQhV+FPai1d+iJmZkG2IUrN2TJ91xEUplnSDCMfMZi5pHADD
J8tM9+pkcGge4QAPOQtV+pG5i28Tc9rQhqUPY+q3c+hJyvAsi1kviUtaAsLS
4WwjeJ8VBQAYQjA3EjRIvWagJOQzaRH5ogZweDdwxQhbtpIZhap8Vi+tlK9z
l8Xhajfb8V8YPruAHjUT+DjDue7i5dbJvDwBhN2qeLS5GE2tSSoGwLeTZyld
g1o1UlGVYDotd/FsNeu0yixCXo225LNoRMs4HxLPncTYdPM3rYv0IsjZi027
FQZwajlZxEGE4zoZaRIs3+4Ahqa7H+rlgq9V4F69YP52WzIbsB/FyK/cDGpD
4ZkCI6uARuN2QSQ+dQio5hm22sZ5lFNW2Cl8C+bgxC+cb3KeW6zXIWgVrRoM
TnUZy/SMd9EA+WLMDgLMuuf7I/cahTTnkk6P3zX5w8YGm+a+21Sx0YpEbD0I
CnjpEB5+zozhnLmuQYids9aeF2aP1qxZXRgq2w9jJJoENZL6DrSFd/2WKcvF
/m1bPA1cnqjPpIS9WoWwSDm4lUPGd83pBwO0YxOxyQSRX9Ia5ZBpXnVz1W0+
us25ynaw+dzDqgZRC2W7cywmdY5rpo/SqifsW3Jo1mJqY7qCnsb2DLJdFnVe
9UoALF2YuZ3RUbNNJZVmEs8JmOKXypjsh34/6GLXiMmvS++yK2HrW4S7V0Wa
qItjtEcUPaJn4+7wOYTHscp1/OQGt0NORTuFWEmour6+x4Axzt3mvVriLEvF
lPR6f1QAWalv7EnXJtgelmmz+L3lo5lu3pQCazjLDlGhikUnFzZCVThubGpZ
rEV27rRWtoCZzie7Ze80WxQlzMVS8mlBlJigGu00ZsQPKfkUxMhSSqTeeMIJ
YIL9Sdz8SIg0U4JEkDgl548lp4tpslkdC9CB6OFmbK9Tvx+o3/mebsUMr/VV
DY7m8JtHD+RjSX+qH7VwlZrv4ECxpY+hOM+X5+bATB+EBxxSmq/w8LYZpsAL
MMP78ceUb9Mo4peD5vknXctVdQmj8cCYgwNz1pyQlLtgn1tY2jD7mTDmjFri
yqjtPZD7WS/CKlYExnUeEqPBMI9C/WZd2hWrN5hfxPJXVxa0T9QT7GI90RY0
AMm5yilrGoKiJH+vpeCqauqCAAeLlGazBU4C3MBuTcB9CfFuTxnSd5+HvBxA
0aIZEhshKaZDSUzeWPMLc+xa9PMkNqix0ZbQJqbl78GAvX8NwB113Yy4AiGz
QXsFSQXVR2HgDSw8lDpmXuRj6gaiK1fGn0TgQxXTQYJoIOUFv797WVlJsCMA
zpXQvMN1CEAKyQpxhAExi1nSFospK2n+c+J6XrnVSrzT6ba0xjggACzKGoOU
hl1aO+g7Hq0jaOJ/1DgTTU5r4RG0/1KnCooacQ4Vyv76mlksYeirB10WLS3g
w0VR+OgHSpx3acs024R6OO26p9uw2dpufJgmlMMvc+ZENfjQc+x5wbacuzNf
fjP1U+3Qc1ZCfb1sqhs3YWCgtGmnuQL9Ikqtm40ILhYj9BRCaaZdH6jHF9HB
TCRo3xGmNYhKZfSz4shqwUj6AJinN0zUk9+cz3jpJdX5QE2dieWWppKFXYHI
au2CDmeiwB1npxUgBF1F3c14SzPDtpFM0pmtYkNGk0oLk0heoM0i034IXLhg
DTGUWPW9dVAAIkCamMNRa2NaANlvvJFYqzmtnYkPpbKt+HzWXDVdAXy/2/oU
Ysc8ZOwjL2LKcFUA7k+zTeizDVX+lqhYSWHKfnvR/dgXoSqwnQJo8K1NEvMd
86f3JbPvZnUlfTmtyG1L0Eg7ktepd18wuqKbFJOOTZoY8SyEUyx2WQ0VotvZ
i5U5kBRwW5PB2JIMm2E5YUEH7nfbGuwVMDlpDtolRWzAxelGGKAROoxVrvIV
Q4QQizSx9uNGiPoExBBpZaVX/LnY97NuYcQH9VtSN2hOfHhXTb0QGRU5WBqC
7HyBV8/P35zddAWr0NGN19zKCp6U0BJvrPia+DIpsxafqfCpWHXxfpemwCn2
05bOR2DdqAfPJpQ0uSwepfOgleniguFjb7ZQauqX/AJ9VQzsdPKml4lAJLAH
aDBTvbedQmFSuNA6NJ+zSUqVCtioZGcQFhGLtsMMe5bHfPD9oEs3HI4oJmy8
tIRKYZ3wMOYHtW2Kec7e/qRRXNI1Y32A04S50nbAzudoC4O1ZB9Ovug0ZEqE
11jeOk+rUbuNvfPrt9d7Qk1jRX66c2Y+fjx/f/bpkwTi+x1jpmauzZVVbenV
0l2P9YVUS/3hSx7iEpWiGV0qdKD1fzQcPc+gILWZjlrdSed8L7mJNswNqQm5
eRAFoVPoDDY+hIc7k3IS3jW5j2lWE6mVuctCzNX2vLE5gqbDSgt2NAhjOC8m
SpThpV2HJFJERVLybIrQN1OlnYFNN6skS7eal+LQqDMEFXVJWznqxYMQjjpc
EAiepOvjJYsWgrW2jm4ZSS+k/VXUqhDllig75tx472ORS/kWOuf7Ka+YGZam
x4bwlqmOttpraxtcKUJEaXGaMYkog3xoITucHGsmKVSUBZJoR5zLJU8VXc1G
38vdAtY6pf9wqrYhZesEvhI8gFG86BJZACZLW2gnPVe6pu6sO5Wpw3YOMf5l
0TYdpz62mAgqCaafGMOsoK7CkLFODHSe+kknJh7HmNhWLXhcBPCvITAmDeU6
xIOxicOZbxiyBc+tfp2JnKzQqDbUL0IVigrxKLw8wfcPfIC4lGlhBKDH9+6F
EBQrvLDXO8TEAs6258i0N+WNQ5b2+kOC2SGD2dD/UlbD8TFmvW2yfIjD28cn
peAv+DyOEbXO+wFQtRNaC3v7z2hChxt8xzJD4ChG9GNdc18uqaT5UFj74UJG
6xtfxTea8JzTXLfTIOD/zDQhvcQXbswSScQ87i/D8RFZCOLGXHP/L8cYgDXG
HLvPzR6Y4XF3903439v+V4+CJTuthtcjsyHDdJkHW8vG1/u/furkDmIW+0OI
KR51FzroTPMgZm3art9norevJVWt0QnClYBwt/sk0pCoij0jZO/dk+OTw5h6
9/U0JpkmA4rtqyevTsyT1M9gANhmyn4pWVjKfNp3ERSjsVtVI+shl3MQ8jQx
fSP5xiCSNxIbzHjYToarhT2afOik5keIHj37fX/Vpd4dvDdD3cl+SN5LU7ZT
e10By7TZ7J/NkOWK7ott6uqvf/3r4Kux/OFfXw1+i6Xod+a3wVcGo1lZ7f3y
nr90x3CSrSxaMAiU9UfmB1fp7mOEPQQXPggSGZmD28wIPLp9IJoomw6qogJE
Qf+9U9xpp9BG7NvmaHLvgdICJz/kZA+7b7S6I6LmVNKHP394/fz05VNRVtG1
mAEzLvOCF4bc2sMevTRUn5nv3fZ89FsdKnqz75zhfWcGDB7eWPgL06ounQa3
+FRKUW9jK3Rotb2hQm0ZYl3Ea5Ihob7VVv2gKd5sl8ZCR6vrF75cW/iSegwX
CEnvtqdLWteB89RbtHcDI+hkC35Wt73D1UXtO69pvQ2sAH6skwbqEosQI0pI
1619Rey7nXjt3b0IQfy6Da1EXRvUHpLkOBzeyOG+WYsgJNmu3sUoqr0rwuHh
Rs92hW/7aPYVE02FAa7dZAMmZe8tClR4lZiYNegUxSSjEoK3bu+8YlZzToND
WnfLTKi6SQ1j2KnccpEOKt1vttuvhjbd+N6ELuJQWpdLJoI4vv12cu8f9Tbx
1oUv6cVcxcxV4rLKskGk3X8zexvlBFva1MltWyO1GuRrYUmu1+IsVypa7b0O
Qi4YfZhuH7MJFZMuTRxGLMzSYanBDr0QU328YCtl624VQeF8OKamskrMLk2B
6lYih/TGgDWyPFQ+9H0aoh6905MVxWUE3P/8OhRw2TksN2qkp4EvRpfljRRR
s02IP8Jtou5Nt/ZuBQFwAhFPal4h6m1AExvu+iIl3IOOUCLA8HVRwpQBXorr
zAXe21yth0L3veYK1RZLtAqpTrCzhTGTeTbGIaleAqk5k7g6Ug79kCttcuDM
ckTE35uf9+pt2UPVzf6nTLr6jogoraFEb8465uG023B7LhdTPycScvz99G4Q
jL6N8V3k0I1aw6ElATXkIe6amJ+02iMhEIPS5mpjuRERqENOShUJx0FkzCFW
zGDzDnMtYnWY/k+93H4P94nkFpLeqQshSFlMY16gCDnGnhFSBQyqGc8xn6dJ
BD6uhL2nr2rDKtVQJiR5MYVmFjp0yfv3rinLB9BfVzCzZcjIJHLvHoytYjjC
bgftS6YAl+lUvESIaZogLq3a+vdcC0ecTjtKNFwWW6kXvhjNdY/J/1LbMtRZ
RDH4Ps0rfMNGfSWNi/UISZmvXPACYhPbhSCYcsm9qkDEuyW8rt05+5DydE3r
CgK9cMZLexn/DYXmpmFM3MV/8aHyLptLd/i5m9WSFtpOy72VgF2K1YXYE55g
Pis3KkzsQ9Zefq8lZD4851Pb9mSDeL2JcOf+0dGnT5PBO15Nrmri2mwz0vdb
ldCrR80qQedvXgPWTqxNczHL87S22uZXdoOYMgkXNsEuwghJcDGf7uOuy9Rf
jmIT3s5sYDddypuN3ou4Wqb2NsQdNGhNViRm8OQeYIASYqFU3hlhzOfpTPDA
jmiV2T3VtZnx0EknpQtYGy/ZZfn3LSgBOCVpMywhZIIkADbECdUh3aeDBSuI
7N5goiAbajz2eZGHf9WCzAzmKOllVoMjzt2iqMQFaWWD/zRFRyyKkAabscLq
d8dgiu00F77ltNSu+OC4aH5cKttUGfr620PeiSri92/v3LnH2y2StJL+epbE
eEwByYR/qaNzbUZxpF4Wp2PvEM5TIIXyfOftc1GXZ6cvT2+oyjM99J9+kHur
iWvKCL27Cl3ktYAJEtwiGcfOdYCkW6iSxVIvRwJTq3sIvlOBUwcU6KRK0+TL
NKV6xyC94ritwty7N8///hsb3aYSmvcq5sC7lxnkCvkUJkTua81YZcxcspAF
Bh9PVDtc8mhvbhH+7CFc+R7hwcY8Z3hXTkGSYtBlmpn34J5tGulS/Wdgoo0X
I9o4e60Ogc+MLbqtFDt0f+loR1O/BLn/AyGkE0CvRwAA

-->

</rfc>

