In this post, we’ll look at what encryption HLS supports and how to encrypt your videos with ffmpeg.
Encryption is the process of encoding information in such a way that only authorised parties can read it. The encryption process requires some kind of secret (key) together with an encryption algorithm.
There are many different types of encryption algorithms but HLS only supports AES-128. The Advanced Encryption Standard (AES) is an example of a block cipher, which encrypts (and decrypts) data in fixed-size blocks. It’s a symmetric key algorithm, which means that the key that is used to encrypt data is also used to decrypt it. AES-128 uses a key length of 128 bits (16 bytes).
HLS uses AES in cipher block chaining (CBC) mode. This means each block is encrypted using the cipher text of the preceding block, but this gives us a problem: how do we encrypt the first block? There is no block before it! To get around this problem we use what is known as an initialisation vector (IV). In this instance, it’s a 16-byte random value that is used to intialize the encryption process. It doesn’t need to be kept secret for the encryption to be secure.
Before we can encrypt our videos, we need an encryption key. I’m going to use OpenSSL to create the key, which we can do like so:
$ openssl rand 16 > enc.key
This instructs OpenSSL to generate a random 16-byte value, which corresponds to the key length (128 bits).
The next step is to generate an IV. This step is optional. (If no value is provided, the segment sequence number will be used instead.)
$ openssl rand -hex 16 ecd0d06eaf884d8226c33928e87efa33
Make a note of the output as you’ll need it shortly.
To encrypt the video we need to tell ffmpeg what encryption key to use, the URI of the key, and so on. We do this with -hls_key_info_file option passing it the location of a key info file. The file must be in the following format:
Key URI Path to key file IV (optional)
The first line specifies the URI of the key, which will be written to the playlist. The second line is the path to the file containing the encryption key, and the (optional) third line contains the initialisation vector. Here’s an example (
https://hlsbook.net/enc.key enc.key ecd0d06eaf884d8226c33928e87efa33
Now that we have everything we need, run the following command to encrypt the video segments:
ffmpeg -y \ -i sample.mov \ -hls_time 9 \ -hls_key_info_file enc.keyinfo -hls_playlist_type vod \ -hls_segment_filename "fileSequence%d.ts" \ prog_index.m3u8
Take a look at the generated playlist (
prog_index.m3u8). It should look something like this:
#EXTM3U #EXT-X-VERSION:3 #EXT-X-TARGETDURATION:9 #EXT-X-MEDIA-SEQUENCE:0 #EXT-X-PLAYLIST-TYPE:VOD #EXT-X-KEY:METHOD=AES-128,URI="https://hlsbook.net/enc.key",IV=0xecd0d06eaf884d8226c33928e87efa33 #EXTINF:8.33333 fileSequence0.ts #EXTINF:8.33333 fileSequence1.ts #EXTINF:8.33333 fileSequence2.ts #EXTINF:8.33333 fileSequence3.ts #EXTINF:8.33333 fileSequence4.ts #EXTINF:5.66667 fileSequence5.ts #EXT-X-ENDLIST
Note the URI of the encryption key. The player will retrieve the key from this location to decrypt the media segments. To protect the key from eavesdroppers it should be served over HTTPS. You may also want to implement some of authentication mechanism to restrict who has access to the key. If you’re interested, the book goes into some detail about how to achieve this. Click here to buy a copy.
To verify that the segments really are encrypted, try playing them using a media player like QuickTime or VLC. You shouldn’t be able to. Now run the command above without the encryption and then try playing a segment. Notice the difference.
Even though HLS supports encryption, which provides some sort of content protection, it isn’t a full DRM solution. If that kind of thing interests you then you may want to take a look at Apple’s FairPlay Streaming solution.