diff --git a/api/BUILD.gn b/api/BUILD.gn
index 28b35356ff..79d52714d2 100644
--- a/api/BUILD.gn
+++ b/api/BUILD.gn
@@ -52,6 +52,8 @@ rtc_static_library("libjingle_peerconnection_api") {
     "bitrate_constraints.h",
     "candidate.cc",
     "candidate.h",
+    "crypto/framedecryptorinterface.h",
+    "crypto/frameencryptorinterface.h",
     "cryptoparams.h",
     "datachannelinterface.cc",
     "datachannelinterface.h",
@@ -94,7 +96,6 @@ rtc_static_library("libjingle_peerconnection_api") {
     "umametrics.h",
     "videosourceproxy.h",
   ]
-
   deps = [
     ":array_view",
     ":audio_options_api",
diff --git a/api/crypto/framedecryptorinterface.h b/api/crypto/framedecryptorinterface.h
new file mode 100644
index 0000000000..7a3668594d
--- /dev/null
+++ b/api/crypto/framedecryptorinterface.h
@@ -0,0 +1,52 @@
+/*
+ *  Copyright 2018 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef API_CRYPTO_FRAMEDECRYPTORINTERFACE_H_
+#define API_CRYPTO_FRAMEDECRYPTORINTERFACE_H_
+
+#include "api/array_view.h"
+#include "api/mediatypes.h"
+#include "rtc_base/refcount.h"
+
+namespace webrtc {
+
+// FrameDecryptorInterface allows users to provide a custom decryption
+// implementation for all incoming audio and video frames. The user must also
+// provide a FrameEncryptorInterface to be able to encrypt the frames being
+// sent out of the device. Note this is an additional layer of encyrption in
+// addition to the standard SRTP mechanism and is not intended to be used
+// without it. You may assume that this interface will have the same lifetime
+// as the RTPReceiver it is attached to. It must only be attached to one
+// RTPReceiver.
+// Note:
+// This interface is not ready for production use.
+class FrameDecryptorInterface : public rtc::RefCountInterface {
+ public:
+  virtual ~FrameDecryptorInterface() {}
+
+  // Attempts to decrypt the encrypted frame. You may assume the frame size will
+  // be allocated to the size returned from GetOutputSize. You may assume that
+  // the frames are in order if SRTP is enabled. The stream is not provided here
+  // and it is up to the implementor to transport this information to the
+  // receiver if they care about it.
+  // TODO(benwright) integrate error codes
+  virtual bool Decrypt(cricket::MediaType media_type,
+                       rtc::ArrayView<const uint8_t> encrypted_frame,
+                       rtc::ArrayView<uint8_t> frame) = 0;
+
+  // Returns the total required length in bytes for the output of the
+  // decryption.
+  virtual size_t GetOutputSize(cricket::MediaType media_type,
+                               size_t encrypted_frame_size) = 0;
+};
+
+}  // namespace webrtc
+
+#endif  // API_CRYPTO_FRAMEDECRYPTORINTERFACE_H_
diff --git a/api/crypto/frameencryptorinterface.h b/api/crypto/frameencryptorinterface.h
new file mode 100644
index 0000000000..6c448a1acb
--- /dev/null
+++ b/api/crypto/frameencryptorinterface.h
@@ -0,0 +1,50 @@
+/*
+ *  Copyright 2018 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef API_CRYPTO_FRAMEENCRYPTORINTERFACE_H_
+#define API_CRYPTO_FRAMEENCRYPTORINTERFACE_H_
+
+#include "api/array_view.h"
+#include "api/mediatypes.h"
+#include "rtc_base/refcount.h"
+
+namespace webrtc {
+
+// FrameEncryptorInterface allows users to provide a custom encryption
+// implementation to encrypt all outgoing audio and video frames. The user must
+// also provide a FrameDecryptorInterface to be able to decrypt the frames on
+// the receiving device. Note this is an additional layer of encryption in
+// addition to the standard SRTP mechanism and is not intended to be used
+// without it. Implementations of this interface will have the same lifetime as
+// the RTPSenders it is attached to.
+// This interface is not ready for production use.
+class FrameEncryptorInterface : public rtc::RefCountInterface {
+ public:
+  virtual ~FrameEncryptorInterface() {}
+
+  // Attempts to encrypt the provided frame. You may assume the encrypted_frame
+  // will match the size returned by GetOutputSize for a give frame. You may
+  // assume that the frames will arrive in order if SRTP is enabled. The ssrc
+  // will simply identify which stream the frame is travelling on.
+  // TODO(benwright) integrate error codes.
+  virtual bool Encrypt(cricket::MediaType media_type,
+                       uint32_t ssrc,
+                       rtc::ArrayView<const uint8_t> frame,
+                       rtc::ArrayView<uint8_t> encrypted_frame) = 0;
+
+  // Returns the total required length in bytes for the output of the
+  // encryption.
+  virtual size_t GetOutputSize(cricket::MediaType media_type,
+                               size_t frame_size) = 0;
+};
+
+}  // namespace webrtc
+
+#endif  // API_CRYPTO_FRAMEENCRYPTORINTERFACE_H_