When you make a VoIP call, your voice gets broken into tiny packets and sent over the internet. That’s simple enough. But when you add encryption-like SRTP-to protect that call from eavesdropping, people worry: Does it slow things down? Does it make calls choppy? Does it kill call quality? The short answer: not really. Not in any way you’d notice. But the details matter, especially if you’re running a large system or using older hardware.
What SRTP Actually Does
SRTP stands for Secure Real-time Transport Protocol. It’s not a new way to encode your voice. It’s not replacing your G.711 or G.729 codec. Instead, it wraps your existing RTP packets in a security layer. Think of it like putting your voice packets into a locked box before sending them. The box has a key, and only the other end has the matching key to open it. Inside that box, your voice data stays unchanged-just protected.
SRTP uses AES-128 or AES-256 encryption in Counter Mode. That’s the same encryption used in banking apps and secure websites. It also adds authentication, so you know the packet hasn’t been tampered with. This isn’t optional anymore. Regulations like HIPAA, GDPR, and CCPA require encrypted media for voice calls in healthcare, finance, and legal sectors. If you’re not using SRTP, you’re not compliant.
How Much CPU Does SRTP Actually Use?
Here’s where people get scared. They hear “encryption” and think “heavy processing.” But SRTP was designed for real-time use. It’s lean. Real-world tests show the CPU overhead is tiny.
On a modern VoIP phone or router, encrypting a single call with SRTP adds about 0.3% to 1.4% CPU usage, depending on the voice packet size. For a 10-byte payload (small, low-bitrate codecs like iLBC), encryption uses just 0.31% average CPU. For an 80-byte payload (common with G.711), it’s 1.36%. Add authentication, and you’re looking at 0.97% to 2.16%.
Compare that to TLS, which encrypts the entire SIP signaling channel. TLS can add 5-10% overhead. SRTP? Less than 3%. That’s why SRTP is the standard. It’s the only encryption method that doesn’t break real-time performance.
And here’s the kicker: the codec type doesn’t matter. Whether you’re using G.711, G.726, GSM, iLBC, or Speex, SRTP adds the same percentage of overhead. The encryption doesn’t care how the voice was compressed-it just encrypts the bytes. Voice quality, measured by MOS scores, stays within 0.2 points of unencrypted calls. That’s less than the difference between a good and a great microphone.
Where SRTP Causes Problems
It’s not that SRTP is slow. It’s that some systems were never built to handle even a small extra load.
Avaya’s own documentation admits that their IP Office system sees a 15-20% drop in concurrent call capacity when SRTP is enabled. Why? Because those older systems were running at 85% CPU during peak hours. Adding 2% more overhead pushes them over the edge. It’s not SRTP’s fault-it’s the system’s age.
Small businesses with aging Yealink or Grandstream phones have reported audio clipping during multi-party calls. Why? Their phones have processors under 200 MHz. Modern smartphones and enterprise-grade VoIP phones run at 1-2 GHz. That’s 10x faster. On a $100 phone from 2018, SRTP might be fine. On a $50 phone from 2012, it’s a problem.
Another hidden issue: double encryption. If your PBX encrypts media with SRTP and your firewall or router also tries to encrypt it (thinking it’s “securing traffic”), you get two layers. That doubles the CPU load. Cisco warns about this in their 2022 technical bulletin. The fix? Check your network path. Only one device should handle SRTP encryption.
Key Management Is the Real Challenge
SRTP’s biggest headache isn’t performance-it’s key exchange. How do you securely share the encryption key between devices?
There are two main methods: SDES and DTLS-SRTP. SDES sends keys over SIP signaling. It’s simple but insecure if SIP isn’t also encrypted. DTLS-SRTP uses a secure handshake over the same connection as the voice. It’s more robust, and RFC 9147 (2022) made it even faster-cutting handshake time by 15-20%.
But here’s the problem: not all vendors implement DTLS the same way. A Cisco phone might not talk properly to a Polycom system if key negotiation settings don’t match. That’s why you see complaints about interoperability on forums like Reddit and Spiceworks. The fix? Stick to one vendor’s ecosystem, or test everything before deployment.
Also, don’t skip NTP. SRTP uses packet sequence numbers to prevent replay attacks. If your device’s clock is off by even half a second, it might think packets are being replayed-and drop them. That causes gaps in audio. Sync your devices to a reliable time server. It’s not optional.
Who Should Use SRTP? Everyone.
92% of enterprise VoIP systems use SRTP. Why? Because the benefits far outweigh the costs.
- Healthcare: 98.7% adoption. Required by HIPAA.
- Finance: 96.2%. Required by PCI-DSS and GDPR.
- Legal: Near 100%. Client confidentiality demands it.
- Education and retail: Lower adoption, but growing. More people are realizing that unencrypted calls are a liability.
Even if you’re not regulated, think about this: a hacker listening to your sales calls, internal strategy, or customer complaints? That’s not just a privacy issue-it’s a business risk. SRTP costs almost nothing in performance but gives you full protection.
What’s Next for SRTP?
SRTP isn’t going anywhere. In fact, it’s getting stronger.
WebRTC, the engine behind Zoom, Google Meet, and Microsoft Teams, requires SRTP by default. That means every browser-based call is encrypted. That’s over 2 billion users-every single one protected by SRTP.
Cisco is already working on machine learning-based SRTP offloading for their next-gen routers. This could cut CPU overhead by 35% in high-density call centers. That’s huge for enterprises running thousands of concurrent calls.
Long-term, AES could be vulnerable to quantum computers. But NIST is already working on post-quantum crypto standards, expected to be finalized in 2024. SRTP is designed to be flexible-it can swap out AES for a new algorithm without changing the whole protocol. That’s why experts rate its long-term viability at 9.2 out of 10.
Practical Takeaways
If you’re deploying VoIP today, here’s what you need to do:
- Enable SRTP everywhere. Don’t wait for a breach. Enable it on your PBX, phones, and gateways.
- Use DTLS-SRTP, not SDES. It’s more secure and more reliable.
- Check your hardware. If your phones are older than 2018, test them under load. Look for audio glitches during 5+ person conferences.
- Avoid double encryption. Make sure only your PBX or VoIP server handles SRTP. Don’t let firewalls or routers do it too.
- Synchronize clocks. Use NTP on all devices. It’s simple, free, and prevents false packet drops.
- Monitor CPU usage. If your server hits 70%+ CPU with SRTP enabled, upgrade hardware before scaling.
SRTP doesn’t hurt performance. It protects it. And in a world where voice data is as valuable as financial records, that’s not just smart-it’s essential.
Does SRTP make VoIP calls sound worse?
No. Multiple studies, including those from Towson University and the University of Kuala Lumpur, show that SRTP adds less than 0.2 points to MOS (Mean Opinion Score) ratings-far below what humans can perceive. Voice quality remains unchanged whether you’re using G.711, G.729, or iLBC.
How much bandwidth does SRTP add?
SRTP adds about 40-50 bytes per packet for encryption headers and authentication tags. For a typical 20ms voice packet, that’s a 5-8% increase in packet size. Most modern networks handle this without issue. The real bottleneck is CPU, not bandwidth.
Can I use SRTP with older VoIP phones?
It depends. Phones made after 2015 with 200 MHz or faster processors handle SRTP fine. Older devices (pre-2012) or low-end models (like some Yealink T2x series) may struggle during multi-party calls. Test before rolling out. If you hear clipping or delays, switch to a lower-bitrate codec like G.729 to reduce overall load.
Is SRTP the same as ZRTP?
No. SRTP encrypts the media stream. ZRTP is a key exchange protocol that can be used to securely set up SRTP keys. ZRTP is often used alongside SRTP, especially in apps like Signal. But ZRTP alone doesn’t encrypt the voice-it just negotiates the key. SRTP does the actual encryption.
Do I need SRTP if I’m using TLS for SIP?
Yes. TLS encrypts the signaling (who’s calling whom), but not the actual voice data. SRTP encrypts the media stream itself. Without SRTP, someone who intercepts your network traffic can still listen to your calls-even if they can’t see the phone numbers. Both are needed for full security.
What’s the easiest way to enable SRTP?
If you’re using a modern PBX like Cisco Unified Communications Manager, Avaya Aura, or 3CX, SRTP can usually be enabled with a single checkbox in the media settings. Set key management to DTLS-SRTP, ensure all endpoints support it, and reboot. Most systems handle the rest automatically.
Kirk Doherty
16 Nov 2025 at 03:22SRTP doesn’t break calls, but I’ve seen old Yealinks choke on 4-way conferences. Just swap in a $30 newer model and call it done. No need to overthink it.