Forum Discussion

stevelaw18's avatar
stevelaw18
Visitor
14 years ago

HLS Decryption Key Retrieval

Our HLS streams are hosted by an external vendor and the playlists are encrypted using AES-128.

When the HLS player parses the EXT-X-KEY field (example below), and attempts to retrieve the key, we either need to be able to have cookies sent along with the request for the key, or be able to append additional query parameters to the URL of the request (e.g. http://somePath/generateKey?id=someId&someOtherParam=something).

EXT-X-KEY:METHOD=AES-128,URI="http://somePath/generateKey?id=someId


Is this possible?
Roku Developer Program

4 Replies

  • RokuMarkn's avatar
    RokuMarkn
    Visitor
    14 years ago
    Yes, you can put extra parameters in the URI field. Also, any parameters passed to the request for the m3u8 itself are inherited by the key acquisition URL (I believe this is not specified in the HLS spec but it is the way the Apple players work, so we duplicated that functionality).

    Also note that there's very little security in either of these methods unless you use https rather than http, if a malefactor is sniffing your traffic.

    --Mark
  • streamingguy's avatar
    streamingguy
    Visitor
    14 years ago
    Hello Mark,

    Do you have any other suggestions to secure the stream? If we use HTTPS, we will not be able to get benefit from CDNs.

    Thank you
  • stevelaw18's avatar
    stevelaw18
    Visitor
    14 years ago
    Thanks Mark. How about having cookies passed when the key request is made? I think I saw a previous post about using the AddHeader method of the video object. Is that correct?
  • RokuMarkn's avatar
    RokuMarkn
    Visitor
    14 years ago
    There are a number of ways to retrieve the key, with varying levels of security. You (the content owner) will of course have to decide on what level of security you are comfortable with. One very secure method using client certificates is outlined in section 4.1 of the Encoding Guide and section 4.25 of the Component Reference. Other methods are possible. I believe that AddHeader on the video object will indeed cause those headers to be passed to the key URL.

    --Mark