srtp_protect_rtcp_aead (srtp_t ctx, srtp_stream_ctx_t *stream, 
                        void *rtcp_hdr, unsigned int *pkt_octet_len)
{
    srtcp_hdr_t *hdr = (srtcp_hdr_t*)rtcp_hdr;
    uint32_t *enc_start;        /* pointer to start of encrypted portion  */
    uint32_t *trailer;          /* pointer to start of trailer            */
    unsigned int enc_octet_len = 0; /* number of octets in encrypted portion */
    uint8_t *auth_tag = NULL;   /* location of auth_tag within packet     */
    err_status_t status;
    int tag_len;
    uint32_t seq_num;
    v128_t iv;
    uint32_t tseq;

    /* get tag length from stream context */
    tag_len = auth_get_tag_length(stream->rtcp_auth);

    /*
     * set encryption start and encryption length - if we're not
     * providing confidentiality, set enc_start to NULL
     */
    enc_start = (uint32_t*)hdr + uint32s_in_rtcp_header;
    enc_octet_len = *pkt_octet_len - octets_in_rtcp_header;

    /* NOTE: hdr->length is not usable - it refers to only the first
           RTCP report in the compound packet! */
    /* NOTE: trailer is 32-bit aligned because RTCP 'packets' are always
           multiples of 32-bits (RFC 3550 6.1) */
    trailer = (uint32_t*)((char*)enc_start + enc_octet_len + tag_len);

    if (stream->rtcp_services & sec_serv_conf) {
        *trailer = htonl(SRTCP_E_BIT); /* set encrypt bit */
    } else {
        enc_start = NULL;
        enc_octet_len = 0;
        /* 0 is network-order independant */
        *trailer = 0x00000000; /* set encrypt bit */
    }

    /*
     * set the auth_tag pointer to the proper location, which is after
     * the payload, but before the trailer
     * (note that srtpc *always* provides authentication, unlike srtp)
     */
    /* Note: This would need to change for optional mikey data */
    auth_tag = (uint8_t*)hdr + *pkt_octet_len;

    /*
     * check sequence number for overruns, and copy it into the packet
     * if its value isn't too big
     */
    status = rdb_increment(&stream->rtcp_rdb);
    if (status) {
        return status;
    }
    seq_num = rdb_get_value(&stream->rtcp_rdb);
    *trailer |= htonl(seq_num);
    debug_print(mod_srtp, "srtcp index: %x", seq_num);

    /*
     * Calculating the IV and pass it down to the cipher 
     */
    srtp_calc_aead_iv_srtcp(stream, &iv, seq_num, hdr);
    status = cipher_set_iv(stream->rtcp_cipher, &iv, direction_encrypt);
    if (status) {
        return err_status_cipher_fail;
    }

    /*
     * Set the AAD for GCM mode
     */
    if (enc_start) {
	/*
	 * If payload encryption is enabled, then the AAD consist of
	 * the RTCP header and the seq# at the end of the packet
	 */
	status = cipher_set_aad(stream->rtcp_cipher, (uint8_t*)hdr, 
                                octets_in_rtcp_header);
	if (status) {
	    return ( err_status_cipher_fail);
	}
    } else {
	/*
	 * Since payload encryption is not enabled, we must authenticate
	 * the entire packet as described in section 10.3 in revision 07
	 * of the draft.
	 */
	status = cipher_set_aad(stream->rtcp_cipher, (uint8_t*)hdr, 
                                *pkt_octet_len);
	if (status) {
	    return ( err_status_cipher_fail);
	}
    }
    /* 
     * put the idx# into network byte order and process it as AAD
     */
    tseq = htonl(*trailer);
    status = cipher_set_aad(stream->rtcp_cipher, (uint8_t*)&tseq, 
                            sizeof(srtcp_trailer_t));
    if (status) {
        return ( err_status_cipher_fail);
    }

    /* if we're encrypting, exor keystream into the message */
    if (enc_start) {
        status = cipher_encrypt(stream->rtcp_cipher,
                                (uint8_t*)enc_start, &enc_octet_len);
        if (status) {
            return err_status_cipher_fail;
        }
	/*
	 * Get the tag and append that to the output
	 */
	status = cipher_get_tag(stream->rtcp_cipher, (uint8_t*)auth_tag, 
                                &tag_len);
	if (status) {
	    return ( err_status_cipher_fail);
	}
	enc_octet_len += tag_len;
    } else {
	/*
	 * Even though we're not encrypting the payload, we need
	 * to run the cipher to get the auth tag.
	 */
	unsigned int nolen = 0;
        status = cipher_encrypt(stream->rtcp_cipher, NULL, &nolen);
        if (status) {
            return err_status_cipher_fail;
        }
	/*
	 * Get the tag and append that to the output
	 */
	status = cipher_get_tag(stream->rtcp_cipher, (uint8_t*)auth_tag, 
                                &tag_len);
	if (status) {
	    return ( err_status_cipher_fail);
	}
	enc_octet_len += tag_len;
    }

    /* increase the packet length by the length of the auth tag and seq_num*/
    *pkt_octet_len += (tag_len + sizeof(srtcp_trailer_t));

    return err_status_ok;
}