# SRTP decryption invalid authTag in golang srtp lib

**URL:** <https://mediasoup.discourse.group/t/srtp-decryption-invalid-authtag-in-golang-srtp-lib/6275>\
**Category:** Integration\
**Created:** [October 1, 2024, 7:01am UTC](https://mediasoup.discourse.group/t/srtp-decryption-invalid-authtag-in-golang-srtp-lib/6275 "2024-10-01T07:01:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jsd](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/jsd/32/2029_2.png) [@jsd](https://mediasoup.discourse.group/u/jsd)\
**Post date:** [October 1, 2024, 7:01am UTC](https://mediasoup.discourse.group/t/srtp-decryption-invalid-authtag-in-golang-srtp-lib/6275/1 "2024-10-01T07:01:45Z")

</div>

Hi there

I have the following setup: mediasoup PlainTransport with srtpParameters (AES\_CM\_128\_HMAC\_SHA1\_80 profile) sends SRTP packets to golang app with `pion/srtp` lib on board. keyBase64 are equal as well as encryption profile on both sides.

Decryption fails with message: `failed to verify auth tag`.

I found the code where pion/srtp compares expected authTag (the length of 10 from the tail of encrypted packet) with actual one.

I would be grateful if someone could tell me how to debug encryption on mediasoup side? Where is the code in worker that generates authTag?

---

<div class="post-metadata">

**Author:** ![ibc](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/ibc/32/1540_2.png) [@ibc](https://mediasoup.discourse.group/u/ibc)\
**Post date:** [October 1, 2024, 7:11am UTC](https://mediasoup.discourse.group/t/srtp-decryption-invalid-authtag-in-golang-srtp-lib/6275/2 "2024-10-01T07:11:24Z")

</div>

> [@jsd](#):
>
> Where is the code in worker that generates authTag?

SrtpSession.cpp and its usage in PlainTransport.cpp

---

<div class="post-metadata">

**Author:** ![jbaudanza](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/jbaudanza/32/1996_2.png) [@jbaudanza](https://mediasoup.discourse.group/u/jbaudanza)\
**Post date:** [October 1, 2024, 9:38am UTC](https://mediasoup.discourse.group/t/srtp-decryption-invalid-authtag-in-golang-srtp-lib/6275/3 "2024-10-01T09:38:38Z")

</div>

The PlainTransport actually uses two keys, one for sending and one for receiving. Given your error, it’s likely that you are using the wrong key.

For receiving into a PlainTransport, the key is generated externally and set in the `transport.connect({ srtpParameters })` call.

For sending from a PlainTransport, the key is generated internally by mediasoup when `enableSrtp` is set, and retrieved with the `transport.srtpParameters` attribute.

---

<div class="post-metadata">

**Author:** ![jsd](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/jsd/32/2029_2.png) [@jsd](https://mediasoup.discourse.group/u/jsd)\
**Post date:** [October 1, 2024, 10:24am UTC](https://mediasoup.discourse.group/t/srtp-decryption-invalid-authtag-in-golang-srtp-lib/6275/4 "2024-10-01T10:24:15Z")

</div>

> [@jbaudanza](#):
>
> transport.srtpParameters

Thank you @jbaudanza  
I’ve just found out that `srtpLocalKey` is randomly generated and was about to ask here how can I get it from the Worker. I was happy to see your answer before my question. Such a great community!