How to apply a block cipher to (large) packetized communication when packets can get lost/erased? In light of current events (Zoom getting strong headwinds for using AES-128 in ECB mode), I was wondering what the general approach is to packetized data encryption, where the packet length (UDP for video over internet: > 1200 B payload)


Is it really just a block cipher in ECB mode, so that each packet can be decoded without any prior packet⁰?
Is it a block cipher in some non-ECB mode, but it gets reset at the start of a packet?
Is it a block cipher in some non-ECB mode, but we're just using a sufficiently large number of say $N$ different keys, de- and encoder, which we use in interleaved / sequential fashion, so that any erasure of less than $N$ successive packets gives us enough time to let the transmitter know we need to re-initialize the receiver?¹
Would you go the WiFi/WPA route of deriving a key for each packet, leading to the couple of  attacks we know against that TKIP/KDF method?
Am I totally missing everything?


I've tried to look into how KASUMI (3G crypto standard) does this, but I haven't been able to track down the relevant standards document.



⁰ ... and everyone is bashing Zoom for adhering to industry best practice?

¹ wouldn't that lead to feasibility of forcing the encoder to a known state by an attacker with control over which packets get lost?
Is it really just a block cipher in ECB mode, so that each packet can be decoded without any prior packet⁰?


No. ECB is bad and creating a secure real-time channel (that can even handle packet loss) is a solved problem. It has been for years. There's no good excuse for using ECB here.


  Is it a block cipher in some non-ECB mode, but it gets reset at the start of a packet?


The usual approach would be to have some form of initialization vector for the encryption which is sent as cleartext with every packet and is used to re-synchronize the state between both endpoints if packet loss is expected. For some encryption schemes this can simply be the packet counter. Then once you have synchronized state for a packet, you use a stateful encryption scheme, like GCM or CTR + HMAC to encrypt the singular packet.

If you want to have a look at how this works out in practice, the three big secure channel standards are TLS (cannot handle lossy underlying layer), DTLS (adaption of TLS 1.2 for lossy contexts) and SRTP.