PROTOCOL NOTES / 06
Voice & forwarding
Preserve the voice packet. Keep local playback independent.
Implemented software · Physical qualification pending
Authenticate once, then separate the work
Before forwarding, an incoming datagram must pass active-role authorization, hop authentication/replay, source SRTP authentication/replay, and source-clock expiry. Source decryption produces a separate clear Opus copy for local playback; the original protected bytes continue to other branches without a decode/re-encode cycle. Local encoder or renderer delays must not stall authenticated forwarding or control.
Two protection layers serve different purposes
A source uses SRTP AES-GCM around RTP/Opus. Each hop adds a directional authenticated envelope with version, hop budget, age, ride tag, and hop sequence. Relays preserve source ciphertext while updating hop-specific fields and authentication.
Late voice is often worse than missing voice
| Bound | Meaning |
|---|---|
| 20 ms / 48 kHz | Source Opus frame duration and RTP clock |
| 12 packets | Bounded ingress |
| 32 packets per link | Egress credits |
| 40 ms | Queue time-to-live |
| 180 ms | Media age ceiling |
Independent bounded queues prevent unbounded speech backlog. Immutable source payloads and scatter/gather writes avoid copying a full ciphertext for each branch. Backpressure, queue expiry, and revoked link generations are observable events. A software enqueue/send benchmark measures that stage, not mouth-to-ear latency.
Know who holds the source keys
All admitted members receive source symmetric keys. Source SRTP therefore does not prevent a malicious admitted rider from impersonating another source. Membership and transport authentication narrow the boundary, but the model is a trusted admitted group, not mutually distrustful end users.
Authority: Media ownership; wire reference. Public examples are synthetic. This guide is maintained against the private implementation; it does not imply access to its source.