Understanding SRTP Key Management: SDES vs ZRTP Encryption Protocols

Secure Real-time Transport Protocol, or SRTP, is what keeps modern VoIP calls confidential as they travel across public and private IP networks. SRTP encrypts the actual voice packets so eavesdroppers cannot understand the conversation, but it cannot work alone. Before two phones can scramble audio, they must first agree on a secret encryption key. That agreement process is called SRTP key management, and two competing protocols dominate the field today: SDES and ZRTP. Understanding the SDES vs ZRTP tradeoff is essential for any business deploying encrypted voice.

How SRTP Key Management Works

The core challenge in secure VoIP is not the encryption itself, but how to safely deliver the encryption key to the far end. If two endpoints share the same key, SRTP can encrypt and decrypt media quickly with almost no performance overhead. If the key is intercepted, an attacker can decode the audio as easily as the intended recipient.

Key management protocols solve this problem. They run inside the call signaling flow or directly between endpoints to negotiate a unique master key for each phone call, derive the session keys that SRTP uses, and verify that neither side has been impersonated. The choice of protocol determines how secure the exchange is, how easy it is to deploy, and whether the call can be recorded or decoded by intermediate devices.

SDES: Session Description Protocol Security Descriptions

SDES is the older and more widely supported of the two methods. It works by embedding the SRTP master key directly into the SIP SDP (Session Description Protocol) body using a base64-encoded crypto attribute. Because the key is transported inside the signaling packets, SDES depends entirely on securing the SIP signaling layer. The key itself is exchanged in the clear unless the entire SIP dialog is wrapped inside TLS or another transport encryption.

The biggest advantage of SDES is simplicity and interoperability. Almost every IP phone, softphone, session border controller, and media gateway supports it, and provisioning is straightforward. It also makes lawful interception and on-network call recording easy to implement because the key is known to any intermediate element that has access to the TLS-protected signaling.

The main weakness is that SDES does not provide end-to-end security. If the signaling channel or any proxy that holds the key is compromised, the media encryption becomes meaningless. The key is visible to the PBX, the SBC, and any carrier along the path, which means SDES alone is hop-by-hop encryption, not true end-to-end.

ZRTP: The Zimmermann Real-time Transport Protocol

ZRTP protocol explained simply: it is a peer-to-peer key agreement protocol that runs directly between two media endpoints, out of band from SIP signaling. It uses a Diffie-Hellman style exchange and a short authentication string to derive a unique SRTP session key without ever exposing the key in signaling packets. The endpoints negotiate everything inside the RTP media path itself.

The primary advantage of ZRTP is strong end-to-end security. Because the PBX, carrier, and SBC never see the encryption keys, they cannot decrypt the audio even if they want to. A short authentication string displayed on both phones allows users to verbally confirm there is no man-in-the-middle attack, providing an explicit verification step that SDES completely lacks.

The tradeoffs are interoperability and operational complexity. ZRTP support is less universal than SDES, particularly on older hardphones and carrier SBCs. It also breaks standard call recording and lawful intercept unless the endpoint itself is configured to record, because the intermediate recording server cannot obtain the media keys.

Choosing Between SDES and ZRTP for Your Business

Most deployments today use SDES because it is supported everywhere and easy to operate alongside existing call recording, contact center, and service provider trunks. It is an excellent choice for companies that need strong hop-by-hop confidentiality and depend on their PBX or SBC to record, monitor, or transcode calls.

Organizations with strict end-to-end confidentiality requirements — such as law firms, financial institutions, and government agencies — should prefer ZRTP. When paired with TLS signaling for call setup, ZRTP provides the highest level of call privacy currently available in standards-based VoIP. Many modern platforms support both modes and can fall back automatically based on endpoint capability.

New Rock Technologies: Encryption-Ready VoIP for Every Deployment

New Rock Technologies builds IP PBX platforms and VoIP endpoints that support both SDES and ZRTP for comprehensive SRTP key management. New Rock's session border controllers and gateways enable secure SDES trunking with service providers while also allowing ZRTP-capable endpoints to negotiate true end-to-end encryption between themselves. With New Rock, businesses can select the key management approach that matches their confidentiality, interoperability, and compliance requirements.

Conclusion

The SDES vs ZRTP decision comes down to priorities. SDES is simple, interoperable, and compatible with centralized call recording and monitoring, but it cannot protect against a compromised service provider or PBX. ZRTP delivers genuine end-to-end confidentiality and explicit authentication at the cost of broader compatibility and traditional recording. For most businesses, the practical answer is to deploy a platform that supports both protocols and enable them selectively by role and call type.