I have to implement a crypto-plugin in Java. The approach followed is conceptually similar to that used for SRTP. The algorithm used for data confidentiality is AES in CTR mode (I'm following a specification).

As I know, if we want to encrypt data using AES in java we use IV, session key and we specifie the mode (CTR in this case). The problem is that this specification gives many parameters to use in encryption as :

SessionSalt := HMAC(MasterKey,"SessionSalt" + MasterSessionSalt + SessionId).

SessionKey := HMAC(MasterKey,"SessionKey" + MasterSalt + SessionId).

SessionHMACKey := HMAC(MasterKey,"SessionHMACKey" + MasterHMACSalt + SessionId).

My question is: When must I use SessionSalt and SessionHMACKey with AES ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.