# `XGW.Trunk.Crypto`
[🔗](https://github.com/Lazarus404/xgw/blob/main/lib/xgw/trunk/crypto.ex#L1)

Static-key SRTP for inter-edge trunk pipes.

## What problem this solves

Trunk edges exchange write-key pairs over the control plane, then protect
RTP/RTCP on the UDP pipe without DTLS. Each edge encrypts with its local
write key and decrypts with the far edge's write key.

## RFCs

* RFC 3711 -- SRTP encrypt / decrypt

# `new`

```elixir
@spec new(binary(), binary()) :: XGW.SRTPSession.t()
```

Lab alias: shared master material for both directions (`local == remote`).

# `new`

```elixir
@spec new(binary(), binary(), binary(), binary()) :: XGW.SRTPSession.t()
```

Builds an `XGW.SRTPSession` from directional write keys.

Encrypt uses `local_write_*` (SRTP server write). Decrypt uses
`remote_write_*` (SRTP client write). The far edge passes the swapped pair.

# `protect_rtcp`

```elixir
@spec protect_rtcp(XGW.SRTPSession.t(), XMediaLib.Rtcp.t()) ::
  {:ok, binary(), XGW.SRTPSession.t()} | {:error, XGW.SRTPSession.t()}
```

Encrypts RTCP.

# `protect_rtp`

```elixir
@spec protect_rtp(XGW.SRTPSession.t(), XMediaLib.Rtp.t()) ::
  {:ok, binary(), XGW.SRTPSession.t()} | {:error, XGW.SRTPSession.t()}
```

Encrypts RTP; returns ciphertext and updated session.

# `unprotect_rtcp`

```elixir
@spec unprotect_rtcp(XGW.SRTPSession.t(), binary()) ::
  {:ok, term(), XGW.SRTPSession.t()} | {:error, XGW.SRTPSession.t()}
```

Decrypts SRTCP.

# `unprotect_rtp`

```elixir
@spec unprotect_rtp(XGW.SRTPSession.t(), binary()) ::
  {:ok, XMediaLib.Rtp.t(), XGW.SRTPSession.t()} | {:error, XGW.SRTPSession.t()}
```

Decrypts SRTP to `%Rtp{}`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*