Skip to main content

Secure streaming

This page describes how the Axis SRTP/RTSPS implementation works. For an overview of what SRTP and RTSPS are and when to use them, see Secure streaming with SRTP and RTSPS. For a step-by-step setup guide, see Set up an encrypted SRTP stream.

Typical secure RTSP session workflow​

You start a secure RTSP session in a similar way as a non-secure session. The basic steps are:

  1. The client establishes a TCP/TLS connection to an RTSP server listening on the device.
  2. The client sends RTSP DESCRIBE over the TLS-protected RTSP connection. The server returns an SDP that indicates the use of SRTP and provides master keys (for example, via a=crypto combined with MIKEY/SDES, or other keying methods).
  3. The client sends RTSP SETUP to negotiate transport parameters with the server (unicast or multicast and ports).
  4. The client starts the session by sending RTSP PLAY. The media is then delivered as an SRTP stream via the negotiated transport protocol, while RTSP control remains encrypted over TLS. The server encrypts media and RTCP SR data, while the client encrypts RTCP RR data using the keys provided in the SDP.

Axis-specific differences​

Axis devices differ from the standard SRTP/RTSPS model in several important ways.

Client-managed master key: The client selects the SRTP master key. The client and the device share this key and use it in both directions. This simplifies key management but requires client implementations to support this behavior. The client provides the SRTP master key as part of the RTSP SETUP request. The key is embedded in a Base-64 encoded MIKEY (Multimedia Internet KEYing) message.

In-session re-keying: Axis devices also support updating cryptographic material during an active session. The client achieves this by sending an RTSP SET_PARAMETER request with a new SRTP master key. To enable this, the implementation uses the Master Key Index (MKI) mechanism to identify which key is currently active.

See also​