SRTP, the Secure Real-time Transport Protocol defined in RFC 3711, is the encrypted version of RTP, the protocol that carries audio and video packets in calls. It encrypts each packet's payload, adds an authentication tag so tampering is detected and rejects replayed packets, while leaving the RTP header readable so media servers can route the stream.

What is the difference between RTP and SRTP?

RTP (RFC 3550) carries real-time media with sequence numbers and timestamps but no security, so anyone on the network path can listen to or alter the audio. SRTP adds encryption, integrity protection and replay protection on top of RTP with only a few bytes of overhead per packet. WebRTC forbids plain RTP and always uses SRTP.

DTLS-SRTP (RFC 5763 and RFC 5764) is the key exchange WebRTC uses for SRTP. The two endpoints run a DTLS handshake directly over the media path, check each other's certificates against fingerprints exchanged during signaling and derive the SRTP keys from the handshake. Keys never travel through the signaling server in the clear, unlike the older SDES method.

Is SRTP end-to-end encryption?

Not in group calls. SRTP protects each network hop, so when media passes through an SFU or another media server, that server decrypts and re-encrypts it and can access the content. True end-to-end encryption needs an extra layer such as SFrame. Ethora, like most compliance-oriented platforms, relies on SRTP plus a trusted server rather than a client-side end-to-end layer, so calls can run on infrastructure the customer controls.

Is SRTP required for HIPAA compliance?

HIPAA does not name protocols. The Security Rule treats encryption of electronic PHI in transit as an addressable safeguard, meaning a covered entity must use it where reasonable and appropriate or document why not. For voice and video, SRTP is the standard way to meet that expectation, and any WebRTC-based calling product already uses it.

Glossary

SRTP (Secure Real-time Transport Protocol)

The encrypted form of RTP. SRTP protects voice and video packets in transit with encryption, integrity checks and replay protection, and every WebRTC call uses it.

General definition

SRTP (Secure Real-time Transport Protocol) is defined in RFC 3711 as a security profile for RTP, the protocol that carries audio and video packets in VoIP and video calls. RTP itself sends media in the clear. SRTP encrypts the payload of each packet, appends an authentication tag so a receiver can detect tampering, and tracks sequence numbers to reject replayed packets. The RTP header stays readable so routers and media servers can still handle the stream. A companion profile, SRTCP, protects the RTCP control packets that report on call quality.

Confidentiality: the payload is encrypted with AES in counter mode by default; AES-GCM profiles (RFC 7714) combine encryption and authentication in one step
Integrity: an HMAC-SHA1 tag over header and payload catches modified packets
Replay protection: a sliding window of seen sequence numbers blocks re-injected packets
Low overhead: a few bytes per packet and no extra round trips once keys are in place

SRTP does not say how the two sides agree on keys. Classic SIP deployments often use SDES, which carries keys inside the SDP session description and therefore relies on the signaling path being secure. WebRTC instead requires DTLS-SRTP (RFC 5763 and RFC 5764): the endpoints run a DTLS handshake over the media path, verified against certificate fingerprints exchanged in signaling, and derive the SRTP keys from it. Unencrypted RTP is not permitted in WebRTC at all (RFC 8827).

One detail matters for architecture. SRTP protects each hop, not the whole path. When a call passes through an SFU or other media server, that server terminates SRTP on the incoming leg and re-encrypts on each outgoing leg, so it can access the media. True end-to-end encryption of a group call needs an extra layer on top, such as SFrame carried through WebRTC insertable streams, which most conferencing products do not enable by default.

In the Ethora ecosystem

Ethora calls run on WebRTC, so every media leg between a participant and the SFU is carried over DTLS-SRTP as the standard requires; there is no mode in which call audio or video crosses the network unencrypted. Chat and API traffic use TLS in transit, and connectivity for calls follows the standard ICE model described under STUN and TURN.

Ethora does not add a client-side end-to-end layer on top of SRTP. That is the same deliberate choice the platform makes for messaging: the server is trusted so that regulated customers can archive, audit and moderate, and the deployment model (managed cloud, dedicated server in your own cloud account, or self-hosted) decides who operates that server. If your threat model requires that no server can ever access media, read the end-to-end encryption entry before choosing a platform.

SRTP (Secure Real-time Transport Protocol)

General definition

In the Ethora ecosystem

Add voice and video to your app

Talk to our team

Pick a time that works for you