SharpSRTP is not thread-safe. If multiple threads need to access the same SRTP context, proper synchronization mechanisms must be implemented by the user.
DTLS
The current DTLS implementation is based upon BouncyCastle and supports DTLS 1.2 only.
DTLS Server
Start with generating the TLS certificate. Self-signed RSA SHA256 certificate can be generated as follows:
DtlsServer server = new DtlsServer(rsaCertificate.Certificate, rsaCertificate.PrivateKey, SignatureAlgorithm.rsa, HashAlgorithm.sha256);
Create the DTLS transport. Here we will use UDP on localhost, port 8888:
EndPoint localEndpoint = new IPEndPoint(IPAddress.Any, 8888);
EndPoint remoteEndpoint = new IPEndPoint(IPAddress.Any, 0);
Socket listenSocket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
listenSocket.ReceiveTimeout = 0;
listenSocket.Bind(localEndpoint);
Wait for the client and perform DTLS handshake:
UdpTransport transport = null;
byte[] buffer = new byte[UdpTransport.MTU];
bool isShutdown = false;
while(!isShutdown)
{
int length = listenSocket.ReceiveFrom(buffer, ref remoteEndpoint);
if (length > 0)
{
if(transport != null)
{
if (!transport.TryAddToReceiveQueue(buffer.ToArray()))
{
throw new Exception("Receive queue full!");
}
}
else
{
transport = new UdpTransport(listenSocket, remoteEndpoint, UdpTransport.MTU, (t) => activeSessions.TryRemove(t.RemoteEndpoint, out _));
transport.TryAddToReceiveQueue(buffer.Take(length).ToArray());
var session = Task.Run(() =>
{
DtlsTransport dtlsTransport = server.DoHandshake(transport, out string error, null);
if (dtlsTransport != null)
{
...
}
else
{
transport = null;
}
});
}
}
}
Receive data from the client:
byte[] buffer = new byte[dtlsTransport.GetReceiveLimit()];
int receivedLength = dtlsTransport.Receive(buffer, 0, buffer.Length, 1000);
Send data to the client:
dtlsTransport.Send(buffer, 0, buffer.Length);
To modify the offered crypto suites for the DTLS handshake, simply override GetSupportedCipherSuites and return a different set of crypto suites. To support a different version of DTLS, override GetSupportedVersions and return a different version. Note that as of January 2026, BouncyCastle still does not support DTLS 1.3.
DTLS Client
Start with creating the TLS certificate. Certificate type of the client must match the certificate type on the server, meaning if the server uses RSA certificate, the client has to use RSA certificate as well:
var rsaCertificate = DtlsCertificateUtils.GenerateCertificate("DTLS", DateTime.UtcNow.AddDays(-1), DateTime.UtcNow.AddDays(30), true);
Create the DTLS client:
DtlsClient client = new DtlsClient(null, rsaCertificate.certificate, rsaCertificate.key, SignatureAlgorithm.rsa, HashAlgorithm.sha256);
Optionally, you can let the client auto-generate the matching certificate:
DtlsClient client = new DtlsClient();
Create the DTLS transport. Here we will use UDP on localhost, port 8888:
Socket socket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
IPEndPoint remoteEndpoint = new IPEndPoint(IPAddress.Loopback, 8888);
socket.Connect(remoteEndpoint);
UdpTransport udpClientTransport = new UdpTransport(socket);
byte[] buffer = new byte[dtlsTransport.GetReceiveLimit()];
int receivedLength = dtlsTransport.Receive(buffer, 0, buffer.Length, 100);
Close the transport:
dtlsTransport.Close();
SRTP
SRTP implementation is designed to take RTP/RTCP and convert it to SRTP/SRTCP while maintaining the SRTP context. RTP/RTSP server and clients are out of the scope of this library, but for a fully working example based upon SharpRTSP please refer to the examples.
Server
Generate a random SRTP master key for AES_CM_128_HMAC_SHA1_80 on the server:
DTLS-SRTP uses a modified DTLS client/server with the "use_srtp" extension to negotiate the SRTP encryption parameters and derive the corresponding SRTP keys.
Server
First generate the TLS certificate, this time it will be ECDsa:
var server = new DtlsSrtpServer(ecdsaCertificate.Certificate, ecdsaCertificate.PrivateKey, SignatureAlgorithm.ecdsa, HashAlgorithm.sha256);
Subscribe for OnSessionStarted:
server.OnSessionStarted += (sender, e) =>
{
var context = e.Context;
var clientTransport = e.ClientDatagramTransport;
...
};
Create the DTLS transport as in the previous example. After the OnSessionStarted event is executed, you can use the Context to protect/unprotect data and clientTransport to send/receive SRTP.
Client
Generate the TLS certificate, this time it will be ECDsa:
var client = new DtlsSrtpClient(ecdsaCertificate.Certificate, ecdsaCertificate.PrivateKey, SignatureAlgorithm.ecdsa, HashAlgorithm.sha256)
Subscribe for OnSessionStarted:
client.OnSessionStarted += (sender, e) =>
{
var context = e.Context;
var clientTransport = e.ClientDatagramTransport;
...
};
Create the DTLS transport as in the previous example. After the OnSessionStarted event is executed, you can use the Context to protect/unprotect data and clientTransport to send/receive SRTP.
