SRTP (Secure Real-time Transport Protocol)
SRTP encrypts and authenticates RTP audio so it cannot be listened to or altered in transit. Learn how keys are exchanged and why it should be paired with TLS.
Published 8 November 2026 · 1 min read · By SpaGreen Creative
Short answer
SRTP is the profile of RTP, defined in RFC 3711, that encrypts the media payload and adds authentication and replay protection to each packet.
SRTP protects the voice stream of a call. RFC 3711 defines it as a profile of RTP: the packet header stays readable so that routers and media servers can handle the stream, but the payload is encrypted and each packet carries an authentication tag. A receiver drops packets that fail the check or that replay an earlier sequence number. RTCP is protected the same way as SRTCP.
SRTP does not define how the two sides agree on keys. The most common method is SDES, described in RFC 4568, where each side places a key in a crypto attribute in the SDP of the SIP messages. Because the key travels in the signaling, SDES only provides real protection when the SIP connection itself is encrypted with TLS. An alternative, DTLS-SRTP, negotiates keys directly in the media path and places only certificate fingerprints in the SDP.
Softphones usually offer three modes. Off sends plain RTP. Optional offers SRTP and falls back if the far end declines. Required refuses calls without SRTP. In SIPdia this is the Encrypt audio setting in the Advanced section of an account. Pair it with TLS transport for meaningful protection.
Sources and further reading
- RFC 3711: The Secure Real-time Transport Protocol (SRTP)www.rfc-editor.org
- RFC 4568: SDP Security Descriptions for Media Streamswww.rfc-editor.org
This article is published by SpaGreen Creative, the maker of SIPdia. Product names mentioned belong to their owners. Where it describes other software, treat the steps as general guidance and check the official documentation linked above.
