Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[docs] Fixed wrong description concerning passphrase #1701

Merged
merged 3 commits into from
Dec 14, 2020
Merged

[docs] Fixed wrong description concerning passphrase #1701

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
377b692
[docs] Fixed wrong description concerning passphrase
Dec 9, 2020
0360909
Removed SEK from description
Dec 9, 2020
63580ea
Post-review fixes
ethouris Dec 9, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions docs/APISocketOptions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -867,20 +867,24 @@ For details, see [Packet Filtering & FEC](packet-filtering-and-fec.md).
| `SRTO_PASSPHRASE` | 0.0.0 | pre | `string` | | "" |[10..79]| W | GSD |

Sets the passphrase for encryption. This enables encryption on this party (or
disables it, if an empty passphrase is passed).
disables it, if an empty passphrase is passed). The password must be minimum
10 and maximum 79 characters long. If an empty password is specified (default),
the encryption is disabled.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sentence "If an empty password is specified (default),
the encryption is disabled." is redundant (see line 870)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right. How I overlooked it. Will be removed.


The passphrase is the shared secret between the sender and the receiver. It is
used to generate the Key Encrypting Key using [PBKDF2](http://en.wikipedia.org/wiki/PBKDF2)
(Password-Based Key Derivation Function 2). It is used on the receiver only if
the received data is encrypted.
(Password-Based Key Derivation Function 2).

When a socket with configured passphrase is being connected, the peer must
have the same password set, or otherwise the connection is rejected. This
behavior can be changed by [`SRTO_ENFORCEDENCRYPTION`](#SRTO_ENFORCEDENCRYPTION).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When a socket with configured passphrase is being connected, the peer must
have the same password set, or the connection is rejected. This
behavior can be changed by SRTO_ENFORCEDENCRYPTION.


Note that since the introduction of bidirectional support, there's only one
initial SEK to encrypt the stream (new keys after refreshing will be updated
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not part of the PR changes but I have been surprise by this 'SEK' popping here. I don't see it defined around while the KEK is written in full word two paragraphs before. Is there a lexicon we can link to.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We may link to the Encryption section of the RFC.
This information about SEK is maybe extra in this document: too detailed. I mean, "there's only one
initial SEK to encrypt...".

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd simply replace it with "encryption key".

independently), and there's no distinction between "service party that defines
the password" and "client party that is required to set matching password" - both
parties are equivalent, and in order to have a working encrypted connection, they
have to simply set the same passphrase. Otherwise the connection is rejected by
default (see also [`SRTO_ENFORCEDENCRYPTION`](#SRTO_ENFORCEDENCRYPTION)).
have to simply set the same passphrase.

[Return to list](#list-of-options)

Expand Down Expand Up @@ -911,7 +915,7 @@ For File mode: Default value is 0 and it's recommended not to be changed.
| -------------------- | ----- | ------- | ---------- | ------- | -------- | ------ | --- | ------ |
| `SRTO_PBKEYLEN` | 0.0.0 | pre | `int32_t` | bytes | 0 | * | RW | GSD |

Sender encryption key length.
Encryption key length.

Possible values:

Expand Down
4 changes: 2 additions & 2 deletions srtcore/srt.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,8 +206,8 @@ typedef enum SRT_SOCKOPT {
SRTO_LATENCY = 23, // NOT RECOMMENDED. SET: to both SRTO_RCVLATENCY and SRTO_PEERLATENCY. GET: same as SRTO_RCVLATENCY.
SRTO_INPUTBW = 24, // Estimated input stream rate.
SRTO_OHEADBW, // MaxBW ceiling based on % over input stream rate. Applies when UDT_MAXBW=0 (auto).
SRTO_PASSPHRASE = 26, // Crypto PBKDF2 Passphrase size[0,10..64] 0:disable crypto
SRTO_PBKEYLEN, // Crypto key len in bytes {16,24,32} Default: 16 (128-bit)
SRTO_PASSPHRASE = 26, // Crypto PBKDF2 Passphrase (must be 10..79 characters, or empty to disable encryption)
SRTO_PBKEYLEN, // Crypto key len in bytes {16,24,32} Default: 16 (AES-128)
SRTO_KMSTATE, // Key Material exchange status (UDT_SRTKmState)
SRTO_IPTTL = 29, // IP Time To Live (passthru for system sockopt IPPROTO_IP/IP_TTL)
SRTO_IPTOS, // IP Type of Service (passthru for system sockopt IPPROTO_IP/IP_TOS)
Expand Down