What Is SRTP? Secure Media for VoIP Explained
Encrypting how a call is set up but not the call itself is like locking the envelope and mailing the letter open. SRTP is what seals the letter.
SRTP (Secure Real-time Transport Protocol) encrypts the media — the actual voice and video — of a call, so it can't be intercepted or recorded in transit. It's the media-stream counterpart to encrypting SIP signalling.
The other half of a secure call
Recall that a call has two streams: signalling (SIP) and media (RTP). Securing SIP with TLS protects the setup — who called whom — but the audio still flows over RTP. If that RTP is unencrypted, anyone who can tap the network can reconstruct the conversation. SRTP encrypts that media so the audio is unintelligible to an eavesdropper.
A genuinely secure call therefore needs both: TLS for signalling and SRTP for media. One without the other leaves a gap.
SRTP and DTLS-SRTP
SRTP needs encryption keys, and there are different ways to exchange them. Traditional SIP phones often use SDES over a TLS-protected SIP channel. Browser-based WebRTC calls use DTLS-SRTP, which negotiates the keys directly between endpoints and is mandatory in WebRTC — which is why browser calls are always encrypted.
Modern systems negotiate the strongest mutually supported cipher automatically, preferring authenticated encryption suites like AES-256-GCM.
Why it should be a default, not a toggle
Media encryption is only useful if it's actually on. On many systems it's an optional setting that never gets enabled. A platform that negotiates SRTP by default — strongest suite first — means every call is protected without anyone having to remember to switch it on.
Frequently asked questions
What's the difference between SRTP and DTLS-SRTP?
Both protect the media with SRTP; they differ in how the keys are exchanged. DTLS-SRTP negotiates keys peer-to-peer and is used by WebRTC; SDES-over-TLS is common on traditional SIP phones.
Does SRTP slow calls down?
Negligibly on modern hardware. The encryption overhead is tiny compared to the benefit of a call that can't be tapped.