# Secure channel encryption (/en/realtime-media/rtc-server-sdk/build/secure-and-optimize-connections/media-stream-encryption)

> For AI agents: see the complete documentation index at [llms.txt](/llms.txt).

During real-time audio and video interactions, encrypting media streams ensures user data security. The Server Gateway offers a built-in encryption solution to safeguard your media streams effectively.

## Implementation [#implementation]

Starting from version 3.8.200, Agora recommends using the `AES_128_GCM2` or `AES_256_GCM2` encryption modes with key and salt settings. Versions prior to 3.8.200 only support 128-bit SM4 in ECB mode.

Agora recommends using the `AES_128_GCM2` or `AES_256_GCM2` encryption mode and setting the key and salt.

<CalloutContainer type="info">
  <CalloutDescription>
    * Ensure all users in a channel use the same encryption mode, key, and salt.
    * The `GCM2` encryption modes offer enhanced security with a stronger Key Derivation Function (KDF) and support for setting a salt. For other encryption modes, you only need to configure the encryption mode and key.
  </CalloutDescription>
</CalloutContainer>

### Generate and set the key [#generate-and-set-the-key]

To generate and set the encryption `key`, refer to the following steps.

1. To randomly generate a 32-byte encryption key in string format using OpenSSL on your server:

   ```bash
   # Randomly generate a 32-byte key in the string format, and pass the string key in the encryptionKey parameter of enableEncryption.
   openssl rand -hex 32
   dba643c8ba6b6dc738df43d9fd624293b4b12d87a60f518253bd10ba98c48453
   ```

2. The client gets the string `key` from the server and passes it to the SDK in the `enableEncryption` method.

### Generate and set the salt [#generate-and-set-the-salt]

To generate the `salt`:

1. Randomly generate a Base64-encoded, 32-byte salt through OpenSSL on the server. Refer to the [C++ sample code](https://github.com/AgoraIO/Tools/blob/master/DynamicKey/AgoraDynamicKey/cpp/sample/RtcChannelEncryptionSaltSample.cpp) provided by Agora on GitHub to randomly generate a salt in the byte array format and convert it to `Base64` on the server.

   ```bash
   # Randomly generate a 32-byte salt in the Base64 format. Convert the salt from Base64 to uint8_t, and pass the uint8_t salt in the encryptionKdfSalt parameter of enableEncryption.
   openssl rand -base64 32
   X5w9T+50kzxVOnkJKiY/lUk82/bES2kATOt3vBuGEDw=
   ```

2. The client gets the `Base64` salt from the server.

3. The client converts the salt from `Base64` to a `uint8_t` array of length 32, and then passes it to the SDK in the `enableEncryption` method.

### Enable built-in encryption [#enable-built-in-encryption]

Before connecting to a channel, call `enableEncryption` to enable built-in encryption. You also need to set the encryption mode and encryption key. All users connected to the same channel must use the same encryption mode and key.

```cpp
// Create an EncryptionConfig instance
agora::rtc::EncryptionConfig Config;
// 256-bit AES, GCM2 mode
Config.encryptionMode = agora::rtc::AES_256_GCM2;
// Set encryption key
Config.encryptionKey = options.encryptionKey.c_str();
// Set encryption salt
Config.encryptionKdfSalt = options.encryptionKdfSalt;
// Enable built-in encryption
if (connection->enableEncryption(options.encryptionMode, Config) < 0) {
      AG_LOG(ERROR, "Failed to enable encryption!");
    }
AG_LOG(INFO, "Enable encryption successfully");
```