SRTP, or Secure Real-time Transport Protocol, protects RTP media with encryption, integrity checking and replay protection. It is used for voice and video calls where eavesdropping or tampering is a risk. Defenders should ensure keys are negotiated safely and confirm that both signalling and media paths are protected.
How SRTP protects media traffic
SRTP secures RTP streams by adding confidentiality, integrity, and replay protection to voice and video media. That matters because the media path often carries the actual sensitive content of a call, even when signalling is protected separately.
The protection model is purpose-built for real-time media, so it aims to preserve low latency while still making passive interception and packet tampering harder. In practice, SRTP is most useful when the media path itself is exposed to untrusted networks or intermediaries.
Where SRTP fits in a calling architecture
SRTP protects the media plane, not the full calling stack. It is usually paired with a signalling protocol that negotiates keys and session parameters, so the security of call setup still matters to the overall trust model.
Because signalling and media have different jobs, organisations should treat them as related but distinct security problems. A secure call can still fail if signalling leaks session details, if media is left unencrypted, or if one leg of a call traverses a weaker path than the other.
Key negotiation and trust assumptions
SRTP depends on how keys are established, distributed, refreshed, and retired. If key negotiation is weak, the media protection can inherit the weakness even when the ciphering and integrity mechanisms themselves are sound.
That is why the practical security question is not just “is SRTP enabled?” but “how are the keys protected end to end?” Defenders should verify that key exchange is authenticated, that session setup cannot be silently downgraded, and that the trust boundary around signalling is understood.
Operational security considerations for voice and video
SRTP is often deployed to reduce eavesdropping, tampering, and replay risk in conferencing, telephony, and collaboration systems. The control is strongest when both endpoints and any intermediaries that affect media handling are configured consistently.
It also introduces operational dependencies: certificate handling, interoperability, and media relay behaviour can affect whether protection is actually present in production. Teams should confirm that the encrypted media path is the one truly carrying the call, rather than assuming that the presence of SRTP on one component protects the whole session.
Risk and Threat Considerations
SRTP reduces media interception risk, but it can still be undermined by weak negotiation, misrouted media, or a signalling path that exposes session setup to manipulation. In real deployments, the danger is often not the media algorithm itself, but the surrounding call-control logic and trust assumptions.
Failure mechanism: An attacker or misconfiguration weakens key establishment, redirects media to an unprotected path, or abuses a downgrade opportunity so that the session no longer has the intended confidentiality and integrity protections.
Impact: Call audio or video may be exposed, altered, or replayed, which can leak sensitive business, personal, or operational information and erode trust in the communications platform.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | SRTP relies on protected key and authenticator lifecycle. |
| SC-8 — Transmission Confidentiality and Integrity | SRTP directly protects media in transit with confidentiality and integrity. | |
| SC-23 — Session Authenticity | SRTP sessions depend on authentic, untampered real-time exchanges. | |
| Recommendation — Manage session keys and authenticators so media protection cannot be undermined by stale or exposed credentials. Encrypt and integrity-protect real-time media flows in transit. Validate session authenticity so media streams cannot be silently redirected or substituted. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Call-security monitoring depends on logs that show negotiation and media-path anomalies. |
| CIS-12 — Network Infrastructure Management | SRTP deployment depends on secure media-path handling across networks and relays. | |
| Recommendation — Log and review call setup and media-handling events to detect downgrade or routing anomalies. Harden and validate network components that transport or relay media sessions. | ||
Practitioner Guidance
Why practitioners should care: SRTP is only as strong as the session setup around it. In operational reviews, the common mistake is treating “SRTP enabled” as proof that the whole call is protected, when the signalling path and key negotiation still determine whether the media protection is trustworthy.
What to watch for: Look for inconsistent endpoint support, fallback behaviour, and media relays that terminate or re-originate sessions. Those conditions are where real-world protection gaps usually appear.