I have to implement a crypto-plugin in Java. The approach followed is conceptually similar to that used for SRTP. The algorithm used for data confidentiality is AES in CTR mode (I'm following a specification).

As I know, if we want to encrypt data using AES in java we use IV, session key and we specifie the mode (CTR in this case). The problem is that this specification gives many parameters to use in encryption as :

SessionSalt := HMAC(MasterKey,"SessionSalt" + MasterSessionSalt + SessionId).

SessionKey := HMAC(MasterKey,"SessionKey" + MasterSalt + SessionId).

SessionHMACKey := HMAC(MasterKey,"SessionHMACKey" + MasterHMACSalt + SessionId).

My question is: When must I use SessionSalt and SessionHMACKey with AES ?


You must log in to answer this question.

Browse other questions tagged .