Secure HLS encoding using AES-128 encryption with FFmpeg

CK 3788
Created at Oct 03, 2023 10:55:34

1,139 0 0

To encrypt a video stream using AES-128 encryption with FFmpeg, you can use the -hls_key_info_file option for HLS (HTTP Live Streaming) encryption. AES-128 encryption is commonly applied to HLS streams, but you can adapt it for other formats if needed.

Here’s a general step-by-step guide for AES-128 encryption with HLS:

Generate a key file:
First, generate a random 128-bit (16-byte) key that will be used for encryption. You can do this using OpenSSL or similar tools.
Example command to generate a key:
```
openssl rand 16 > keyfile.key
```
Create a key info file:
The key info file tells FFmpeg how to apply the encryption. It contains the URL where the key will be available, the file path to the key, and an IV (Initialization Vector), which can be a random 16-byte value or can be omitted to let FFmpeg handle it.
Example key_info file format:
```
http://example.com/keyfile.key
/pub/your_file_path/keyfile.key
0123456789abcdef0123456789abcdef
```
- The first line is the URL where the key will be accessible.
- The second line is the path to the key file on your local machine.
- The third line is the IV (optional). If you omit this line, FFmpeg will automatically generate an IV for each segment.
Use FFmpeg to encrypt and create the HLS playlist:
Now you can use FFmpeg to apply AES-128 encryption to the video while creating HLS segments.
Example command:
```
ffmpeg -i input.mp4 -hls_time 10 -hls_key_info_file key_info -hls_playlist_type vod -hls_segment_filename 'segment_%03d.ts' output.m3u8
```
- -i input.mp4: Specifies the input video.
- -hls_time 10: Splits the video into segments of 10 seconds.
- -hls_key_info_file key_info: Uses the key info file created earlier to apply AES-128 encryption.
- -hls_playlist_type vod: Sets the playlist to "Video on Demand."
- -hls_segment_filename 'segment_%03d.ts': Defines the pattern for naming the segments.
- output.m3u8: Specifies the output HLS playlist file.

Notes:

Make sure the key file is hosted at a publicly accessible URL for the players to decrypt the video.
The generated HLS .m3u8 playlist file will contain references to the encrypted .ts segments, and the encryption key URL.

This process is commonly used for delivering encrypted HLS streams for secure video streaming applications.

Associated Data for Secure HLS Encoding using AES-128 Encryption with FFmpeg:

Secure HLS encoding using AES-128 encryption with FFmpeg
Key Concepts:

HLS (HTTP Live Streaming): A streaming protocol used for delivering video and audio content over HTTP. It is commonly used for online video platforms and live streaming applications.
AES-128 Encryption: A symmetric encryption algorithm that uses a 128-bit key to encrypt and decrypt data.
Key File: Contains the 128-bit key used for encryption.
Key Info File: Provides information on how to apply the encryption, including the key URL, file path, and optional IV.
IV (Initialization Vector): A random value used to ensure that the encryption of the same data with the same key produces different ciphertext.
FFmpeg: A powerful multimedia framework used for encoding, decoding, transcoding, and manipulating audio and video files.

Steps involved:

Generate a Key File: Generate a random 16-byte (128-bit) key using a tool like OpenSSL.
Create a Key Info File: Specify the key file path, key URL, and optional IV for FFmpeg to apply encryption.
Use FFmpeg to Encrypt and Create HLS Playlist: Run FFmpeg with the necessary options, including the key info file and playlist type, to create encrypted HLS segments and a playlist file.

If you just want to bypass the key value through parameter:

ffmpeg -i input.mp4 \
-hls_time 10 \
-hls_segment_type mpegts \
-hls_key_info_file <(echo "inlinekey 0123456789abcdef0123456789abcdef 0123456789abcdef0123456789abcdef") \
-hls_segment_filename 'segment_%03d.ts' \
-hls_playlist_type vod \
output.m3u8

If you want to use the key located on the remote server:

ffmpeg -i input.mp4 \
-hls_time 10 \
-hls_key_info_file <(echo "https://example.com/path/to/key
0123456789abcdef0123456789abcdef
0123456789abcdef0123456789abcdef") \
-hls_segment_filename 'segment_%03d.ts' \
-hls_playlist_type vod \
output.m3u8

M3U8 file example generated

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-KEY:METHOD=AES-128,URI="inlinekey",IV=0x0123456789abcdef0123456789abcdef
#EXTINF:10.000,
segment_000.ts
#EXTINF:10.000,
segment_001.ts
#EXTINF:10.000,
segment_002.ts
#EXTINF:10.000,
segment_003.ts
#EXTINF:10.000,
segment_004.ts
#EXTINF:10.000,
segment_005.ts
#EXTINF:10.000,
segment_006.ts
#EXTINF:10.000,
segment_007.ts
#EXT-X-ENDLIST

Benefits:

Secure Video Streaming: Prevents unauthorized access to video content.
Widely Supported: HLS and AES-128 encryption are industry standards supported by major players.

Additional Information:

Key Management: Securely managing and distributing the encryption key is crucial.
Content Delivery Network (CDN): Utilizing a CDN can help improve performance and reliability for delivering encrypted HLS streams.
Player Compatibility: Ensure that the video players used to access the HLS streams are compatible with AES-128 encryption.

Can we save the key file remotely instead of inline?

If you want to set the key more securly, you can locate the key on the server, and set the m3u8 like below:

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-KEY:METHOD=AES-128,URI="https://example.com/path/to/keyfile",IV=0x0123456789abcdef0123456789abcdef
#EXTINF:10.000,
segment_000.ts
#EXTINF:10.000,
segment_001.ts
#EXTINF:10.000,
segment_002.ts
#EXTINF:10.000,
segment_003.ts
#EXTINF:10.000,
segment_004.ts
#EXTINF:10.000,
segment_005.ts
#EXTINF:10.000,
segment_006.ts
#EXTINF:10.000,
segment_007.ts
#EXT-X-ENDLIST

Comments 0