What cipher for encrypting UDP packets?

Question

I have an application that does time-sensitive communications over UDP (like video streaming or a game). Packets may be lost, and do not need to be re-transmitted.

What cipher should I use to encrypt the datagrams?

I'm leaning towards blowfish in ECB mode. I know ECB mode has problems, but I need to support missing packets, so the encryption cannot rely on previous blocks. Is there a better cipher or mode I can use to reduce the issues with ECB mode and still allow for missing packets?

(I'd like to keep everything pure Java, so I cannot use DTLS.)

Answer 1

You can use CBC mode, you just need to encrypt each packet as a separate CBC stream. That means re-starting CBC each packet, with a fresh IV.

By the way, Blowfish is only a 64 bit block cipher, which these days inherently gives it a fairly low margin of security.

Answer 2

AES in counter mode (CTR) is a feasible option. When establishing a connection, you would start the counter at a randomly selected value known to both the sending and receiving programs. If each packet of video data contains a sequence number (n) long enough to not repeat within a single connection, the receiving program can add that to the initial counter value to get the value of the counter used to encrypt that packet.

Of course, for messages longer than one block, you will need to increment the counter more than once within a packet. I would determine how many blocks long the longest transmitted packet would be, for example 16 blocks, and use counter values 16*n for the first block in the packet, 16*n+1 for the second, and so on.

Answer 3

ECB is open to attack because each ciphered block is quite independent of all others, which makes it possible both make deductions about the content of the ciphertext by noticing that some two (or more) cipher blocks are identical and to alter the message undetectably by rearranging cipher blocks or substituting cipher blocks from other messages encrypted using the same key (which is itself not a good idea).

If your UDP packets contain some sequence information you can use that as the counter in CTR mode, or you can use XEX (or XTS) mode. XEX was developed for encryption situations in which data ciphering may have to be performed in random order of blocks, as is the case with encrypted random-access devices like hard drives, and would be ideal for a situation such as yours.

See http://en.wikipedia.org/wiki/Disk_encryption_theory#XEX