<?xml version="1.0" encoding="UTF-8"?>
  <?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
  <!-- generated by https://github.com/cabo/kramdown-rfc version 1.7.25 (Ruby 3.1.2) -->


<!DOCTYPE rfc  [
  <!ENTITY nbsp    "&#160;">
  <!ENTITY zwsp   "&#8203;">
  <!ENTITY nbhy   "&#8209;">
  <!ENTITY wj     "&#8288;">

]>


<rfc ipr="trust200902" docName="draft-sprang-avtcore-corruption-detection-00" category="info" consensus="true" submissionType="IETF" tocInclude="true" sortRefs="true" symRefs="true">
  <front>
    <title abbrev="Video Corruption Detection">RTP Header Extension for Automatic Detection of Video Corruptions</title>

    <author fullname="Erik Språng">
      <organization>Google</organization>
      <address>
        <email>sprang@google.com</email>
      </address>
    </author>

    <date year="2025" month="March" day="16"/>

    <area>AREA</area>
    <workgroup>avtcore WG</workgroup>
    <keyword>RTP</keyword> <keyword>Header Extension</keyword> <keyword>Video</keyword> <keyword>Corruption</keyword>

    <abstract>


<?line 62?>

<t>This document describes an RTP header extensions that can be use to carry select filtered samples from a video frame together with metrics relating to the expected distortions caused by lossy compression of said frame. This data allows a receiver to validate that the output from a decoder matches the frame the went into the encoder on the remote - i.e. validating that the video pipeline is in a correct state free of any video corruptions.</t>



    </abstract>

    <note title="About This Document" removeInRFC="true">
      <t>
        The latest revision of this draft can be found at <eref target="https://github.com/sprangerik/corruption-detection/blob/main/draft-sprang-avtcore-corruption-detection.md"/>.
        Status information for this document may be found at <eref target="https://datatracker.ietf.org/doc/draft-sprang-avtcore-corruption-detection/"/>.
      </t>
      <t>
        Discussion of this document takes place on the
        avtcore WG Working Group mailing list (<eref target="mailto:avt@ietf.org"/>),
        which is archived at <eref target="https://datatracker.ietf.org/wg/avtcore"/>.
        Subscribe at <eref target="https://www.ietf.org/mailman/listinfo/avt/"/>.
      </t>
      <t>Source for this draft and an issue tracker can be found at
        <eref target="https://github.com/sprangerik/corruption-detection"/>.</t>
    </note>


  </front>

  <middle>


<?line 66?>

<section anchor="introduction"><name>Introduction</name>

<t>The Corruption Detection (sometimes referred to as automatic corruption detection or ACD) extension is intended to be a part of a system that allows estimating a likelihood that a video transmission is in a valid state. That is, the input to the video encoder on the send side corresponds to the output of the video decoder on the receive side with the only difference being the expected distortions from lossy compression.</t>

<t>The goal is to be able to detect outright coding errors caused by things such as bugs in encoder/decoders, malformed packetization data, incorrect relay decisions in SFU-type servers, incorrect handling of packet loss/reordering, and so forth. This should be accomplished with a high signal-to-noise ratio while consuming a minimum of resources in terms of bandwidth and/or computation. It should be noted that it is not a goal to be able to e.g. gauge general video quality using this method.</t>

<t>This is accomplished in two steps. On the sender side:</t>

<t><list style="symbols">
  <t>Pseudo randomly (using a Halton Sequence) sampling a small set of locations within the input to the encoder.</t>
  <t>Applying a gaussian low-pass filter in order to supress encoding distortions.</t>
  <t>Determining an "allowed error" threshold, below which samples are not determined as erroneus.</t>
</list></t>

<t>Then, on the receiver side:</t>

<t><list style="symbols">
  <t>Sampling the same locations as the sender, but in the output image from the decoder.</t>
  <t>Applying the same low-pass filter as the sender</t>
  <t>Comparing the values in the samples provided in the header extension with those sample from the output image,
subtracting the allowed error from each sample pair.</t>
</list></t>

</section>
<section anchor="conventions-and-definitions"><name>Conventions and Definitions</name>

<t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they
appear in all capitals, as shown here.</t>

<?line -18?>

</section>
<section anchor="applicability"><name>Applicability</name>

<t>The Corruption Detection extension can be used to validate the correctness of any video pipeline in an end-to-end manner, as long as there is no termination of the bitstream in the process. It is designed to be codec agnostic.</t>

<t>In terms of <xref target="RFC7667"/>, any Point-to-Point or Transport Translator topologies can be used. The header extension just needs to be propagated together with the media packet until the decode stage. If however a Media Translator is used, the header extension needs to be extracted at the time of decoding there (e.g during transcoding). If corruption detection is desired to the end user, then a new Corruption Detection header extension needs to be created as part of the middlebox encoding step and thet can then be carried forward.</t>

</section>
<section anchor="corruption-detection"><name>Corruption Detection</name>

<t><em>Name:</em>  "Corruption Detection"; "Extension for Automatic Detection of Video Corruptions"</t>

<t><em>Formal name:</em> http://www.webrtc.org/experiments/rtp-hdrext/corruption-detection</t>

<t><em>Status:</em> This extension is defined here to allow for experimentation. Experience with the experiment has shown that it is useful; this draft therefore presents it to the IETF for consideration of whether to standardize it or leave it as a proprietary extension.</t>

<section anchor="rtp-header-extension-format"><name>RTP header extension format</name>

<section anchor="data-layout-overview"><name>Data layout overview</name>

<t>Data layout of a corruption-detection header extension, using a One-Byte header (see <xref target="RFC5285"/>) section 4.2:</t>

<figure><artwork><![CDATA[
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  ID   | len=7 |B|  seq index  |    std dev    | Y err | UV err|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    sample 0   |    sample 1   |    ... up to sample <= 12     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork></figure>

<t>Data layout of a corruption-detection header extension, using a Two-Byte header (see <xref target="RFC5285"/>) section 4.3:</t>

<figure><artwork><![CDATA[
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      ID       |     L=0       |  ID   | len=7 |B|  seq index  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    std dev    | Y err | UV err|    sample 0   |    sample 1   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   ...   up to sample <= 255                   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork></figure>

</section>
<section anchor="data-layout-details"><name>Data layout details</name>

<section anchor="b-1-bit"><name>B (1 bit)</name>

<t>Whether the sequence number should be interpreted as the MSB or LSB of the full size 14 bit sequence index described in the next point.</t>

</section>
<section anchor="seq-index-7-bits"><name>seq index (7 bits)</name>

<t>The index into the Halton sequence (used to locate where the samples should be drawn from).</t>

<t>If B is set: the 7 most significant bits of the true index. The 7 least significant bits of the true index shall be interpreted as 0.
This is because this is the point where we can guarantee that the sender and receiver has the same full index. B <bcp14>MUST</bcp14> be set on keyframes.
On droppable frames B <bcp14>MUST NOT</bcp14> be set.
If B is not set: The 7 LSB of the true index. The 7 most significant bits should be inferred based on the most recent message.</t>

</section>
<section anchor="std-dev-8-bits"><name>std dev (8 bits)</name>

<t>The standard deviation of the Gaussian filter used to weigh the samples. The value is scaled using a linear map:
0 = 0.0 to 255 = 40.0. A std dev of 0 is interpreted as directly using just the sample value at the desired coordinate, without any weighting.</t>

</section>
<section anchor="y-err-4-bits"><name>Y err (4 bits)</name>

<t>The allowed error for the luma channel.</t>

</section>
<section anchor="uv-err-4-bits"><name>UV err (4 bits)</name>

<t>The allowed error for the chroma channels.</t>

</section>
<section anchor="sample-n-8-bits"><name>Sample N (8 bits)</name>

<t>The N:th filtered sample from the input image. Each sample represents a new point in one of the image planes, the plane and coordinates being determined by index into the Halton sequence (starting at seq# index and is incremented by one for each sample).
Each sample has gone through a Gaussian filter with the std dev specified above. The samples have been floored to the nearest integer.</t>

</section>
</section>
<section anchor="synchronization-message"><name>Synchronization Message</name>

<t>A special case is the so-called "synchronization" message. Such a message only contains the first byte. They are used to keep the sender and receiver in sync even if no "full" message has been received for a while. Such messages <bcp14>MUST NOT</bcp14> be sent on droppable frames.</t>

</section>
</section>
<section anchor="details-of-operation"><name>Details of Operation</name>

<section anchor="halton-sequence-handling"><name>Halton Sequence Handling</name>

<t>The sender and receiver need to find the same set of pseudo random sampling locations for an instrumented frame. Sending explicit coordinates for each sample would however use a significant amount of bandwidth, in fact potentially several times the size of the sample values themselves.</t>

<t>To avoid this overhead, we instead define that a 2D Halton Sequence is used to generate the sample coordinates - meaning that the clients only need to keep track of the index into that sequence in order to generate the desired sequence of sampling coordinates.</t>

<t>The bases used are 2 for the row and 3 for the column.</t>

</section>
<section anchor="halton-sequence-algorithm"><name>Halton Sequence Algorithm</name>

<t>In pseudo code, the Halton sequence can implemented as follows:</t>

<t>Inputs: index i, base b
Where b is 2 when calculating the row (y-axis) and 3 when calculating the column (x-axis)</t>

<figure><artwork><![CDATA[
f = 1;
r = 0;
while i > 0 do {
  f = f / b;
  r = r + f * (i mod b);
  i = floor(i / b);
}
return r;  // Coordinate component.
]]></artwork></figure>

<section anchor="sequence-index-counter"><name>Sequence Index Counter</name>

<t>The sequence index into the Halton sequence is a 14 bit unsigned integer, which wraps around to zero on overflow. Only half of those bits are transmitted with any given message.</t>

<t>If B = 1 then the 7 most significant bits are transmitted and the 7 least significant bits are implicitly set to 0. If B = 1 then the 7 least significant bits are transmitted and the most significant bits are inferred for the current state.</t>

<t>For keyframes, the sender <bcp14>MUST</bcp14> set the value of B to 1.</t>

<t>For droppable frames (e.g. non-baselayer frames when using temporal layers), the sender <bcp14>MUST</bcp14> set B to 0 to prevent sender and receiver from out of sync should that frame be lost.</t>

</section>
<section anchor="sequence-index-stepping"><name>Sequence Index Stepping</name>

<t>A sequence index <bcp14>MUST</bcp14> be present on all keyframes of an instrumented video stream, however there are no requirements around which sequence index to start at; the sender may choose that arbitrarily. This means we always start with a known index.</t>

<t>For each sample within the corruption detection header extension, the sequence index is assumed to be incremented by one. This allows a variable amount of samples to be present in an extension, if so desired.</t>

<t>When droppable frames are used (e.g. when using temporal layering), a middle box may drop some frames resulting in a gap between the last sequence of the previous extension and sequence index indicated by the header of the next extension. If this happens and the new frame has B = 0, then the receiver is intended to just increment the sequence number index until the 7 least significant bits in the index matches the value in the extension header (possibly including an increment of the more significant bits).</t>

<t>This means that the sender <bcp14>MUST NOT</bcp14> add &gt;= 127 consecutive samples to droppable frames, otherwise the most significant bits may come out of sync.</t>

<t>If needed, a "sync message" can be added to guarantee sequence index alignment even if no samples are available. This is done by sending a truncated message containing just B and the sequence index.</t>

</section>
</section>
<section anchor="spatial-layer-considerations"><name>Spatial Layer Considerations</name>

<t>When multiple spatial layers are present within a single SSRC, the sender <bcp14>MUST</bcp14> produce a separate and independent stream of corruption detection headers for each spatial layer. This ensures that a receiver can decode and verify the highest spatial layer that is part of the stream they are receiving, and any layers culled by a middlebox does not affect the integrity of e.g. the sequence index series for that layer.</t>

<t>When using a scalability mode where a higher spatial layer uses inter-layer prediction (prediction between frames belonging to the same temporal unit, e.g. the "SxTx" modes in the W3C <xref target="SVC"/> spec), then the frame should be treated as a key-frame if any frame in the dependency chain within that temporal layer is a key-frame.</t>

</section>
<section anchor="sample-filtering"><name>Sample Filtering</name>

<t>The std dev field of the extension indicates the standard deviation of a 2D Gaussian blur kernel that should be applied taking samples - both to the raw input frame before encoding at the sender and to the raw output frame from the decoder at the receiver.</t>

<t>Further, in order to reduce the number of samples the algorithm needs to average - it is optionally allowed to ignore parts of the image where weight from the Gaussian becomes small. In practice, weights below 0.2 have shown to be small enough that they have negligible effect on the end result.</t>

<t>Any samples outside the plane are considered to have weight 0.</t>

<t>Note that this processing is done on a per-image-plane basis.</t>

<t>In pseudo-code, that means we get the following:</t>

<figure><artwork><![CDATA[
// Translate 8bit header value to floating point.
stddev = header.std_dev * (40.0 / 255);
// Max number of samples away from the center.
max_d = ceil(sqrt(-2.0 * ln(0.2) * stddev^2) - 1;
sample_sum = 0;
weight_sum = 0;
for (y = max(0, row - max_d) to min(plane_height, row + max_d) {
  for (x = max(0, col - max_d) to min(plane_width, col + max_d) {
    weight = e^(-1 * ((y - row)^2 + (x - col)^2) / (2 * stddev^2));
    sample_sum += SampleAt(x, y) * weight;
    weight_sum += weight;
  }
}
filtered_sample = sample_sum / weight_sum;
]]></artwork></figure>

</section>
<section anchor="handling-of-image-planes"><name>Handling of Image Planes</name>

<t>For now this header extension is only defined for 4:2:0 chroma subsampling.
// TODO: Discuss supporting other formats.</t>

<t>In order to translate the row/column calculated from the Halton sequence into a coordinate within a given image plane, visualize the U/V (chroma) planes as being attached to the Y (luma) planes as follows:</t>

<figure><artwork><![CDATA[
+------+---+
|      | U |
+  Y   +---+
|      | V |
+------+---+
]]></artwork></figure>

<t>In pseudo code:</t>

<figure><artwork><![CDATA[
row = GetHaltonSequence(seq_index, /*base=*/2) * image_height;
col = GetHaltonSequence(seq_index, /*base=*/3) * image_width * 1.5;

if (col < image_width) {
  HandleSample(Y_PLANE, row, col);
} else if (row < image_height / 2) {
  HandleSample(U_PLANE, row, col - image_width);
} else {
  HandleSample(V_PLANE, row - (image_height / 2), col - image_width);
}
]]></artwork></figure>

</section>
<section anchor="allowed-error-thresholds"><name>Allowed Error Thresholds</name>

<t>The header extension contains two fields for an "allowed error"; one for the luma channel and one for the chrome channels. The two values allow for accommodating different spatial resolutions and thus different error magnitudes for the respective image planes.</t>

<t>When calculating the difference between two samples in a receiving client (i.e. one locally filtered sample and the corresponding remote sample from the header extension) the absolute magnitude of the error should be reduced  by the specified amount.</t>

</section>
<section anchor="determining-filter-size-and-error-thresholds"><name>Determining Filter Size and Error Thresholds</name>

<t>The filter size (std dev of the blur kernel) and the allowed error thresholds <bcp14>SHOULD</bcp14> be set such that 99.5% of filtered samples end up with a delta &lt;= the error threshold for that plane, based on a representative set of test clips and bandwidth constraints.</t>

<t>This text does not put restrictions on how exactly an implementation should determine appropriate thresholds, but a straightforward way is to look at the QP and codec type as this translates roughly the expected compression distortion. Individual implementations may exhibit better or worse performance than an "average" encoder implementation for a given codec type - so a sender is encouraged to compensate for this if the implementation is far outside the expected bounds based on averages.</t>

</section>
<section anchor="calculating-a-corruption-score"><name>Calculating A Corruption Score</name>

<t>This text does not put exact requirements on how the differences calculated should be translated into an output. While it is tempting to try and use the 99.5% percentile aspect and use a simple statistical method to estimate the probability of this magnitude of error with a given confidence interval - in practice that has proven tricky due to the number outliers that don't quite follow a normal distribution.</t>

<t>In practice, it has been found that just taking the sum of all differences squared and dividing by two yields a reasonably good result.</t>

<t>Further improvements in this area should be possible without having to make changes to the message format itself.</t>

</section>
</section>
</section>
<section anchor="security-considerations"><name>Security Considerations</name>

<t>The de facto way of encrypting RTP packets is using SRTP as defined in <xref target="RFC3711"/>.
Unfortunately, SRTP does not provide encryption for header extensions as they are not seen as part of the payload. That poses a serious security risk, as the corruption detection samples are in essence a very sparse encoding of the source image - so given a sufficient number of samples and a static scene an eavesdropper could rather trivially reconstruct the scene from just header extensions.</t>

<t>While technically not required, the sender <bcp14>SHOULD</bcp14> negotiate some form of encryption that covers this header extension. The most straightforward methods is to use either <xref target="RFC6904"/> or <xref target="RFC9335"/>, both of which are specifically designed to allow selective encryption of sensitive RTP header extensions.</t>

</section>
<section anchor="iana-considerations"><name>IANA Considerations</name>

<t>If the WG decides that this extension should be registered as a standardized extension, IANA is requested to perform the appropriate registration.</t>

<t>If the WG decides that this is a private extension, the URL http://www.webrtc.org/experiments/rtp-hdrext/corruption-detection is used to identify the extension.</t>

</section>


  </middle>

  <back>


<references title='References' anchor="sec-combined-references">

    <references title='Normative References' anchor="sec-normative-references">



<reference anchor="RFC2119">
  <front>
    <title>Key words for use in RFCs to Indicate Requirement Levels</title>
    <author fullname="S. Bradner" initials="S." surname="Bradner"/>
    <date month="March" year="1997"/>
    <abstract>
      <t>In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
    </abstract>
  </front>
  <seriesInfo name="BCP" value="14"/>
  <seriesInfo name="RFC" value="2119"/>
  <seriesInfo name="DOI" value="10.17487/RFC2119"/>
</reference>

<reference anchor="RFC8174">
  <front>
    <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
    <author fullname="B. Leiba" initials="B." surname="Leiba"/>
    <date month="May" year="2017"/>
    <abstract>
      <t>RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t>
    </abstract>
  </front>
  <seriesInfo name="BCP" value="14"/>
  <seriesInfo name="RFC" value="8174"/>
  <seriesInfo name="DOI" value="10.17487/RFC8174"/>
</reference>

<reference anchor="RFC5285">
  <front>
    <title>A General Mechanism for RTP Header Extensions</title>
    <author fullname="D. Singer" initials="D." surname="Singer"/>
    <author fullname="H. Desineni" initials="H." surname="Desineni"/>
    <date month="July" year="2008"/>
    <abstract>
      <t>This document provides a general mechanism to use the header extension feature of RTP (the Real-Time Transport Protocol). It provides the option to use a small number of small extensions in each RTP packet, where the universe of possible extensions is large and registration is de-centralized. The actual extensions in use in a session are signaled in the setup information for that session. [STANDARDS-TRACK]</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="5285"/>
  <seriesInfo name="DOI" value="10.17487/RFC5285"/>
</reference>




    </references>

    <references title='Informative References' anchor="sec-informative-references">

<reference anchor="SVC" target="https://www.w3.org/TR/webrtc-svc">
  <front>
    <title>Scalable Video Coding (SVC) Extension for WebRTC</title>
    <author >
      <organization>W3C</organization>
    </author>
    <date year="n.d."/>
  </front>
</reference>


<reference anchor="RFC7667">
  <front>
    <title>RTP Topologies</title>
    <author fullname="M. Westerlund" initials="M." surname="Westerlund"/>
    <author fullname="S. Wenger" initials="S." surname="Wenger"/>
    <date month="November" year="2015"/>
    <abstract>
      <t>This document discusses point-to-point and multi-endpoint topologies used in environments based on the Real-time Transport Protocol (RTP). In particular, centralized topologies commonly employed in the video conferencing industry are mapped to the RTP terminology.</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="7667"/>
  <seriesInfo name="DOI" value="10.17487/RFC7667"/>
</reference>

<reference anchor="RFC3711">
  <front>
    <title>The Secure Real-time Transport Protocol (SRTP)</title>
    <author fullname="M. Baugher" initials="M." surname="Baugher"/>
    <author fullname="D. McGrew" initials="D." surname="McGrew"/>
    <author fullname="M. Naslund" initials="M." surname="Naslund"/>
    <author fullname="E. Carrara" initials="E." surname="Carrara"/>
    <author fullname="K. Norrman" initials="K." surname="Norrman"/>
    <date month="March" year="2004"/>
    <abstract>
      <t>This document describes the Secure Real-time Transport Protocol (SRTP), a profile of the Real-time Transport Protocol (RTP), which can provide confidentiality, message authentication, and replay protection to the RTP traffic and to the control traffic for RTP, the Real-time Transport Control Protocol (RTCP). [STANDARDS-TRACK]</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="3711"/>
  <seriesInfo name="DOI" value="10.17487/RFC3711"/>
</reference>

<reference anchor="RFC6904">
  <front>
    <title>Encryption of Header Extensions in the Secure Real-time Transport Protocol (SRTP)</title>
    <author fullname="J. Lennox" initials="J." surname="Lennox"/>
    <date month="April" year="2013"/>
    <abstract>
      <t>The Secure Real-time Transport Protocol (SRTP) provides authentication, but not encryption, of the headers of Real-time Transport Protocol (RTP) packets. However, RTP header extensions may carry sensitive information for which participants in multimedia sessions want confidentiality. This document provides a mechanism, extending the mechanisms of SRTP, to selectively encrypt RTP header extensions in SRTP.</t>
      <t>This document updates RFC 3711, the Secure Real-time Transport Protocol specification, to require that all future SRTP encryption transforms specify how RTP header extensions are to be encrypted.</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="6904"/>
  <seriesInfo name="DOI" value="10.17487/RFC6904"/>
</reference>

<reference anchor="RFC9335">
  <front>
    <title>Completely Encrypting RTP Header Extensions and Contributing Sources</title>
    <author fullname="J. Uberti" initials="J." surname="Uberti"/>
    <author fullname="C. Jennings" initials="C." surname="Jennings"/>
    <author fullname="S. Murillo" initials="S." surname="Murillo"/>
    <date month="January" year="2023"/>
    <abstract>
      <t>While the Secure Real-time Transport Protocol (SRTP) provides confidentiality for the contents of a media packet, a significant amount of metadata is left unprotected, including RTP header extensions and contributing sources (CSRCs). However, this data can be moderately sensitive in many applications. While there have been previous attempts to protect this data, they have had limited deployment, due to complexity as well as technical limitations.</t>
      <t>This document updates RFC 3711, the SRTP specification, and defines Cryptex as a new mechanism that completely encrypts header extensions and CSRCs and uses simpler Session Description Protocol (SDP) signaling with the goal of facilitating deployment.</t>
    </abstract>
  </front>
  <seriesInfo name="RFC" value="9335"/>
  <seriesInfo name="DOI" value="10.17487/RFC9335"/>
</reference>




    </references>

</references>


<?line 333?>

<section numbered="false" anchor="acknowledgments"><name>Acknowledgments</name>

<t>Fanny Linderborg and Emil Vardar for their contributions in implementing and evaluating the corruption detection mechanism.</t>

</section>


  </back>

<!-- ##markdown-source:
H4sIAAAAAAAAA91c23Ibx3Z9x1d0qEoFlACQ1MWyKcnnUJRkq0q3iLrElcpx
NTANcMLBDDw9QxCWdb4lL/mR5Mey1t7dcwEhHSfHT5FdJWAw3b17976sfWmN
x+PBjRs3BjfM87xyZe6q8ZPSzivz0pYXSbHOzTu3XGW2cgO+9NbldulMdZ56
M08zZ+ZlsTQJR4yrIinGm6Iu+cp4VRZVMSuyyTIxVWEWrjK+smXlkgnm0TVk
rnlRLm1lMOGezvMwzvH9+OG6KC8WZVGv8FkeYbq9iZDyrChNmqdVajPjXVWv
RgYDTZFnG5M7J6u6JK1ALBZJS1+ZaVbMLkwxx1eXJZ6EvObre1VaZW5PhnmO
mzozO7f5wiUPTOIyVzmzZ6fT0l3umXTOdUojY0i2Py/KinOd5BtTYLXSzAow
M6/MzOaci2S4ZGSmdSVT29LN68zkRcXF0rwqi6Se4b2yLEoh66wgZ4RKs06z
jMOwSWPrqgC30pnNQHdSl2m+0N2TLqy9MZjc1HkgX1n1pMj/CRzOZ1mdYCfj
w8M9A+7tjXmuvsKe8sClTM6XFLywU5f55hcckvkdxxNmVCI8DmG6wVycoSqK
THiLvYND+MCns7osyahLV/q0yB9gLyAwKWacbY/LGndlIYBOd/KOglcFieQK
3lyUdklBHZfz2bE5r6qVPz44WKTVeT2dzIrlwcxOi4PuW5jnJ0gKD6d0mGnm
hBbQkZbKhHDIZqXEWpOkc3wgpSqu5NCpsLhhHAjFmXMX3BzemZ03rIN8DydX
y0w29C8vX4yMq2aTyWSfm4L2iSwdm723796YH51NsObTZjaOOYnnbp5AGGcV
n0OOP6SJK8xpUZb1is/83kDFFHNt/9aO3BvMwL1FUW6Ocb7zYjAIDD8OR+xX
JbY2tpfVrCjdeNbMMU7iHJChga+ny9STxmqzwuDnT989G+T1curK40GCJY4H
UASPbdT+2FRl7QYg7M4AwmGPzcnbpyeDRoCOTVjNfPxhcOE2+CE5HpixAUv4
1zZX+Ex2yA/tJgeXLq+xrjHXZzVGyfyINak2P/ANPF3aNJMX/5y6aj4pygUe
2nJ23koTNmOr0s4uXDmJLx2sFwdhdi4n8nZslHWuTC8OdrENb6qG7JTUvzH4
APZregBy84PffU6wl4MBrAZsFNmJ9Y2B7cn0uJ9iKXO2Kv/7P/OF/IR92Tz9
1XLosfmhKBaZkx+ccklX/PNCfiDNg0Eu8p1egusDSlPzzZizD6fHMhqGHw6g
3fN6vZ6s7wgX3709WLtpWc3G/nKmL6synMHG2Sn0KgpywkMbYs79LeX46KZv
353K2Gan8mfM/eDA75wOBuPx2Nip5ylWg4HYEUh9vaROJ87PynQKYwKTQB08
V2lrNBo259w25hxmhyoOM15uYLAycJoWAO4TBs+LtfLqGK25FOLnpXjNAkyg
e1jjyM3SVWU68zBBkAhuLZhEd7XChJgpSX0FzyLLz2ywpiYrvN/AwSxhm0T3
aAe8TRNdZKImkgJr4COKNfaEJWYORyJW99JmKXVTd8QFi7pawTEFghM3K7h3
MWDOqwlT8vFpTXbBYQVSc323UCdRumWBiccmnYCOsJDsLC6l3FilK5eluThP
+BdrKLhkIgBCxdXgA7ApC3eqA1rBhnOUk1ymSQLJVNgi3lO0C+fqdpo8M/Tw
qFW6dF4dUKkAwfrWpXaWMUlrZWF8T5/sd6y7UI0viU4BgbBmBWQjNBu/8fBP
uuVwAFD3dKmcsCZLL7D586JIwjthjxDM3Adz2jBGeKhs4cEKTBoJJ9OcZxbO
QWfYOg3YXQzFL8pevypyBTedMy/mnfHx5JvTFKHRKURiZSDxUvSGcJxTpwf8
BbkVobomshM9qEUB6JZGwCW6XhWB9aSwTBfnUDpVfMVGHUUABs0XQF81/CyO
cVovhGmBCwdhN2DX0ma0Shi1ogWvgnkTHRkRFQXpoyJuyIVUVR6TnT17P6bT
ADPLS5msfR3eP8lIGZioE8tGD0oH1+UIzEYQYRxBQSNVnQfNBFqss0Q2PCNL
stSfgzRhsDXn2DI4vshtBjw9zosUtqYkvWZ9TpBBh1ovVZTwV7qslyQAjAUq
mzkFbK5cej6dYv11mnDmPDkoSjmDupLtT8zzqkMMsKgLEpkKGCc4tXpE/fNx
k8XELGwN6LNwuSvxgsrPLzWktdrAPKpIYBKo3HmRTIK9xf+9PZPUdQHxdis/
ARJvxBZCSKmDQ7lp3nhXJ0CN2EGxhOwNdXprfrRZhVM8c7/UlMR9tbz6m8eZ
S1RALgD0W5VGMjkA2p7+BJmZYLmT1Srb6CTYI6QVJh9KPF5Z74ORJ91yxBzu
axFqnYLjOtLP+WiBSh4Up8wRRdAkYO8izntYHaPPi4zBgcMvPGXIc3QihNE8
iCTMgoEQdY7NXe1VjfLRlsZ2mHcWWSKcpRFvmWF9h98amwTeBOMAm7UIAR6f
BoXqMakzbZ9Fvckx4hSnbss4BGatdk1sETeLiJGClMTn2044GqHCxzEtcV2S
RwSm4ufjej2m6yBnGzZDe1Nsi87ktMgvGQYIf6C7T9xcQkx8V5MFZGoITRGs
vnx/9m5vpH+bV6/l89un//z++dunT/j57MeTFy+aD4PwxtmPr9+/eNJ+akee
vn758umrJzoYT03v0WDv5clPe2pR9l6/eff89auTFyFw60IZSozqK31UCeGs
RGgGEeMIex+fvvmv/zi6az59+oe3z05vHx199/lz+PLt0f27+LIWweJqYvH1
K+PLgV2tnBUloI7N7CqtbAbLaMW2rXOcW4lobXDzX8mZfzs2D6ez1dHd78MD
brj3MPKs91B4dv3JtcHKxB2PdizTcLP3fIvTfXpPfup9j3zvPHz4J0Ey46Nv
//T9QGSIyoH4fJrSGH4FkbRy3cLKZAuhuQiNctqYHiZqQVROwwJFo8Ogz1/a
PKdG40CygmZHdLF0atWNWhIbQ0guMk0rAGNnl1H1oIrwJV58BKXL0SU1cId2
YGbsIi8AbGY46ucdn/Pp058gRfe/+eb+588jofdNAVEkcfKBgOodsc4KVlI/
Af8WNKarIisWqfNdhtBr7jAF/177qpeuAcUru7DixHowm9uB709tdNI19Dvr
WDTCqwXg1fO5gfi6S4n3X8qIDnXgAskZ7bZMXUrwlLaHWqegl6iTnJHlgknC
aQzhSGMGR8Cf/rovlOyEouEkAnRVx5WQrFLIImDM3Xq3tH2V5BnOXs1EA2SF
bQKyp8VV693oq8Uq4HeNh2RhTWqVKeYA1lnbkj7/xk5KYBheMfa8aczezuTE
A7P3f819DG4+Y/iZSWIRKzDcjNGmxJgScRKolimtJcBatRqfJyXYsjtcH9w8
A1yqPSYTCNOLAhJ6B2xZjpPBBN1MyFnFJQLWeioPBDE3Utm+BCwZjWcHgeFg
Eak/CAZeEqYiOXPmM4g6uAO+G4SB6RdZnRgRzCkbHYf1FoUgXqlwejif9FfH
oXg7c/ZSPjMWEj0CoQjYN+1meZg3dgbGIbvF32+YJww6gaELRhbQo8vUrQeD
3tN5iPa2GX1t4pGJOO917saPN1WjdUOmCNVX3bv97b3Pn4H8wiR3J7cBeyT0
PzTX/xzteHZ7x7M7cYoj/HzH3DX3zDfmvvnWfPe/eSaT3Br/nf/JLL8Z8/yJ
/J25/NF989tjPPHuF5jrxF3J7/heIfRyl/r+T8Q6+Pv9B3747Y+lxUTgdLj1
/Sh+n0wmpl6JvOkvDx+ZI2X1H0XL3y9Y79bF7xesO/9fBYt/RLja7y8eHbbf
vy54f7hgfUWI/5bg/fF86f2hTJtrUn373r0d7/5xQr5tVyHYNs28/HDDPDbD
I6K3/cHgY7TxEnZpTGw0Gd8J8/tBgbz88uwx3cAL/qV+n/lhxJDwEAgRMHs7
nx57L5TggBzaZVZEd5NAWCsjw/sCL/cVCeuzJoEYYvhm/mHEwBKmOjqu0vWC
xHYr8Ijwlwzm9glB52AG0ytMM3PAfbMEPJVcSjoHHoeXJR1xj6xGKDWKMO/T
D/6u90GC1YLcFjMPJ02aY+okT6WuO1U+C3/CjtZOsNOitgB+leskY0P6gxCr
CefPYzQt5VIeTiD8sZGIKtQGwUiEp5Kr9ZPBayBH+PKVpG30YXyfIY+OmTR8
Y5ZBeKfM6EjDdU7tZmxXyEKCdWp5nCE7IaO4JwwAMZ6gO0pL0Prht11ZiVCF
P6W9eOWHmJkJ2YYoNWvH9FlHXJRiSTeIcMxs5pLGATB8ssx0r44Hh+YRDvCQ
s1ClH5m7+DYxJw1tWPowpn47h56kDM+ymPWSuKQlICwdzjaC91lRAIAhBHMj
QYPUawZKQj6TFpEvagCHdwNXjLBlK5lRqMpn9dJKzTp3WRyudrMd/5Xhs3Po
UTOBjzOc6S5ebZ3Mq2NA2K2KR5uL0dSapGIAfDt5ltI1qFUjFVUJptNyF89W
s06rzCLk1WhLPotGtIzzIfHcSYxNN3/TukgDgpy92LQbYQCnlpNFHEQ4rpOR
JsHy7Q5gaLr7oV4u+FoF7tUL5m+3JbMB+1GM/MrNoDYUnikwsgpoNG7nROJT
h4BqnmGrbZxHOWVZncK3YA5O/MLZJue5xXodglbRqsHgRJexTM94Fw2QL8Zs
G8Cse74/cq9RSHMm6fT4XZM/7Gawae67nRQbrUjEfoOggBcO4eGXzBjOmesa
hNg5C+x5YfZozZrVhaGy/TBGoklQI6nvQFt412+Zslzs37bF08DlifpMStjr
VQiLlINbOWR815x+MEA7NhE7SxD5Ja1RDpnmVTdX3eaj25yrbAebzz2sahC1
ULY7w2JS57hi+iitesK+JYdmLaY2pivoaWzPINtlUedVrwTA0oWZ2xkdNXtT
Uukg8ZyAKX6pjMl+6PeDLnaNmPy69C67FLa+Q7h7WaSJujhGe0TRI3o27g6f
Q3gcq1y3n1zjdsipaHsQKwlV19f3GDDGudu8V0ucZamYkl7DjwogK/WNPena
BNvDMm0Wv7d8NNPNm1JgDWfZISpUsejkwkaoCrcbm1oWa5GdO62VLWCm88lu
2TvJFkUJc7GUfFoQJSaoRjuNGfFDSj4FMbKUEqk3HnMCmGB/HDc/EiLNlCAR
JE7J+duS08U02ayOBehA9HAztlep3w/U73xPt2KGV/qqBkdz+M2jB/KxpD/V
j1q4Ss33cKDY0qdQnOfLc3Ngpg/CAw4pzS08vGmGKfACzPB+/DHl2zSK+OWg
ef5Z13JVXcJoPDDm4MCcNick5S7Y5xaWNsx+Low5pZa4Mmp7D+R+0YuwihWB
cZ2HxGgwzKNQv1mXdsXqDeYXsfzVlQXtE/UEu1hPtO8MQHKucsqahqAoyd9r
KbiqmrogwMEipdlsgZMAN7BbE3BfQ7zbU4b03ZchLwdQtGiGxEZIiulQEpPX
1vzKHLsW/TKJDWpstCX0hmn5ezBgw18DcEddNyOuQMhs0F5BUkH1URh4DQsP
pY6ZF/mYuoHoypXxJxH4UMV0kCAaSHnB7+9eVlYS7AiAcyk073AdApBCskIc
YUDMYpa0xWLKSpr/krieVW61Eu90si2tMQ4IAIuyxiClYZfWDvqOR+sImvgf
Nc5Ek9NaeATtv9SpgqJGnEOFsr++ZhZLGPrqQZdFSwv4cF4UPvqBEudd2jLN
NqEeTrvu6TZstrYbH6YJ5fCLnDlRDT70HHtesC3n7syXX0/9VDv0nJVQXy+b
6sZ1GBgobdppLkG/iFLrZiOCi8UIPYVQmmnXB+rxRXQwEwnad4RpDaJSGf2i
OLJaMJI+AObpDRP15DfnM14aSHU+UFNnYrmlqWRhVyCyWrugw5kocMfZaQUI
QVdRdzPe0sywbSSTdGar2JDRpNLCJJIXaLPItB8CF85ZQwwlVn1vHRSACJAm
5nDU2pgWQPYbbyTWak5rZ+JDqWwrPl80V01XAN/vtj6F2DEPGfvIi5gyXBWA
+9NsE5prQ5W/JSpWUpiy3150P/ZFqApspwAafGuTxHzP/Ol9yey7WV1JX04r
ctsSNNI25HXq3VeMrugmxaRjkyZGPAvhFItdVkOF6Hb2YmUOJAXc1mQwtiTD
ZlhOWNCB+922BnsJTE6ag3ZJERtwcboRBmiEDmOVq3zFECHEIk2s/bgRoj4B
MURaWWkQfyH2/bRbGPFB/ZbUDZoTH95VUy9ERkUOloYgO1/g1bOzt6fXXcEq
tHHjNbeygicltMQbK74mvkzKrMUXKnwqVl2836UpcIr9tKXzEVg36sGzCSVN
LotH6TxoZbo4Z/jYmy2Umvolv0BfFQM7nbzpZSIQCewBGsxU722nUJgULrQO
zedsklKlAjYq2RmERcSi7TDDnuUxH3w/6NINhyOKCRsvLaFSWCc8jPlBbZti
nrO3P+kOl3TNWB/gNGGutB2w8znawmAt2YeTLzoNmRLhNZa3ztNq1G5j7+zq
3dWeUNNYkY93Ts2nT2cfTj9/lkB8v2PM1My1ubKqLb1auuuxvpBqqT98yUNc
olI0o0uFDrT+j4aj5xkUpDbTUas76Zxnkptow9yQmpDrBlEQOoXOYONDeLgz
KSfhXZP7mGY1kVqZuyzEXG3PG5sjaDqstGBHgzCG82KiRBle2nVIIkVUJCXP
pgh9PVXaGdh0s0qydKt5KQ6NOkNQUZe0laNePAjhqMOtgOBJuj5esmghWGvr
6JaR9ELaX0WtClFuibJjzo2XPRa5lG+hc76f8oqZYWl6bAhvmepoq722tsGV
IkSUFqcZk4gyyIcWssPJbc0khYqyQBLtiHO55Kmiq9noe7lbwFqn9B9O1Tak
bJ3AV4IHMIq3WyILwGRpC+2k50rX1J11pzJ12M4hxr8q2qbj1McWE0ElwfQT
Y5gV1FUYMtaJgc5TP+nExOMYE9uqBY+LAP41BMakoVyHeDA2cTjzLUO24LnV
rzORkxUa1Yb6RahCUSEehZcn+P4zHyAuZVoYAejte/dCCIoVXtqrHWJiAWfb
c2Tam/LGIUt79XOC2SGD2dD/UlbD8W3MetNk+RCHt49PSsFf8HkcI2qd92dA
1U5oLeztP6MJHW7wHcsMgaMY0Y91zX25mZLmQ2Htz+cyWt+4Fd9ownNOc9VO
g4D/C9OE9BJfuDZLJBHzuL8Mx0dkIYgbc839v9zGAKwx5th9bvbADG93d9+E
/73t33oULNlJNbwamQ0Zpss82Fo2vt7/9XMndxCz2D+HmOJRd6GDzjQPYtam
7fp9Lnr7RlLVGp0gXAkId7tPIg2JqtgzQvbePb59fBhT776exiTTZECxff3k
9bF5kvoZDADbTNkvJQtLmU/7LoJiNHaramQ95HIOQp4mpm8k3xhE8lpigxkP
28lwtbBHkw+d1PwI0aNnv++vutT7gw9mqDvZD8l7acp2aq8rYJk2m/2TGbJc
0X2xTV399a9/Hdwayx/+dWvwWyxFvze/DW4ZjGZltffLB/7SHcNJtrJowSBQ
1h+ZH1ylu48R9hBc+FmQyMgc3GRG4NHNA9FE2XRQFRUgCvrvneJOO4U2Yt80
R5N7D5QWOPkhJ3vYfaPVHRE1p5I+/OnnNy9OXj0VZRVdixkw4zIveGHIrT3s
0UtD9YX53m/PR7/VoaI3+84ZPnRmwODhtYW/Mq3q0klwi0+lFPUutkKHVttr
KtSWIdZFvBsZEupbbdUPmuLNdmksdLS6fuHLtYUvqcdwgZD0bnu6pHUdOE+9
RXshMIJOtuBndds7XJ3XvvOa1tvACuDHOmmgLrEIMaKEdN3aV8S+24nX3t2L
EMSv29BK1LVB7SFJjsPhjRzum7UIQpLt6l2Motq7IhwebvRsV/i2j2ZfMdFU
GODaTTZgUvbeokCFV4mJWYNOUUwyKiF46/bOK2Y1ZzQ4pHW3zISqm9Qwhp3K
LRfpoNL9Zrv9amjTje9N6CIOpXW5ZCKI47vvJvf+Ua8Qb134kl7MVcxcJS6r
LBtE2v03s7dRTrClTZ3ctjVSq0G+FpbkTi3OcqWi1d7rIOSC0Yfp9jGbUDHp
0sRhxMIsHZYa7NALMdXHW7VStu5WERTOh2NqKqvE7NIUqG4lckhvDFgjy0Pl
Q9+nIerROz1ZUVxEwP3Pb0IBl53DcqNGehr4YnRZ3kgRNduE+CPcJuredGvv
VhAAJxDxpOYVot4GNLHhrs5Twj3oCCUCDF8XJUwZ4KW4zlzgvc3Veih032uu
UG2xRKuQ6gQ7WxgzmWdjHJLqJZCaM4mrI+XQD7nSJgfOLEdE/L35eZnelj1U
3ex/yqSr74iI0hpK9Oa0Yx5Oug23Z3Ix9UsiIcffT+8GwejbGN9FDt2oNRxa
ElBDHuKuifmo1R4JgRiUNlcby42IQB1yUqpIOA4iYw6xYgabd5hrEavD9H/q
5cp7uE8kt5D0Tl0IQcpiGvMCRcgx9oyQKmBQzXiO+TxNIvBxJew9fVUbVqmG
MiHJiyk0s9ChC166d01ZPoD+uoKZLUNGJpHL9mBsFcMRdjtoXzIFuEyn4iVC
TNMEcWnV1r/nWjjidNpRouGy2Eq98MVorntM/pfalqHOIorB92le4Rs26itp
XKxHSMp85YIXEJvYLgTBlEvuVQUi3i3hde3O2YeUp2taVxDohTNe2ov4Dyc0
Nw1j4i7+Mw+Vd9lcusPP3KyWtNB2Wu6dBOxSrC7EnvAE81m5UWFiH7L28nst
IfPhGZ/aticbxOtNhDv3j44+f54M3vNqclUT12abkb7fqoRePWpWCTp//Rqw
dmJtmotZnqe11Ta/shvElEm4sAl2EUZIgov5dB93Xab+YhSb8HZmA7vpUt5s
9F7E1TK1tyHuoEFrsiIxgyf3AAOUEAul8s4IYz5PZ4IHdkSrzO6prs2Mh046
KV3A2njJLss/akEJwClJm2EJIRMkAbAhTqgO6T4dLFhBZPcaEwXZUOOxz/M8
/FMWZGYwR0kvsxocce4WRSUuSCsb/PcoOmJRhDTYjBVWvzsGU2ynufAtp6V2
xQfHRfPjUtmmytA33x3yTlQRv39358493m6RpJX017MkxmMKSCb88xydazOK
I/WyOB17h3CeAimU5ztvn4u6PD95dXJNVZ7roX/8Qe6tJq4pI/TuKnSR1wIm
SHCLZBw71wGSbqFKFku9HAlMre4h+E4FTh1QoJMqTZOv05TqHYP0kuO2CnPv
3774+29sdJtKaN6rmAPvXmaQK+RTmBC5rzVjlTFzyUIWGHw6Vu1wyaO9uUX4
s4dw5RnCg415wfCunIIkxaDLNDMfwD3bNNKl+m+/RBsvRrRx9lodAp8ZW3Rb
KXbo/tLRjqZ+CXL/BwDGhLOkRwAA

-->

</rfc>

