search

kaltura / nginx-vod-module

NGINX-based MP4 Repackager
GNU Affero General Public License v3.0
1.99k stars 439 forks source link

CBCS to CTR on the fly conversion #1416

Open sridhard opened 1 year ago

sridhard commented 1 year ago

Hi, We have the video/audio files encrypted using CBCS mode for widevine/fairplay/playready. But some android devices are not supporting CBCS. So we want to convert CBCS to CTR mode on the fly using NGINX-VOD-Module. CBCS files are fragmented mp4 files. Is this possible?

sridhard commented 1 year ago

As per docs kaltura vod module support Decryption of CENC-encrypted MP4 files (it is possible to create such files with MP4Box)

Does this mean that it can convert encrypted CBCS DASH files to CTR DASH on the fly?

  1. CBCS DASH is created using shaka packager. Means files are fragmented
  2. Video and audio streams are in different files
  3. All segments are in single file. We have not created seperate file for each segment.
erankor commented 1 year ago

CBCS decryption is not supported, and neither is fragmented MP4. This module can perform on-the-fly encryption of CBCS & CENC, but the source file must be a regular MP4, either clear or encrypted using CENC scheme.

Leeaandrob commented 1 year ago

@erankor do you have example to make this possible using the module?

Encryption:

ffmpeg -i SampleVideo_1280x720_1mb.mp4 -vcodec copy -acodec copy -encryption_scheme cenc-aes-ctr -encryption_key 76a6c65c5ea762046bd749a2e632ccbb -encryption_kid a7e61c373e219033c21091fa607bf3b8 SampleVideo_1280x720_1mb_encrypted.mp4

Decryption:

ffplay SampleVideo_1280x720_1mb_encrypted.mp4 -decryption_key 76a6c65c5ea762046bd749a2e632ccbb

erankor commented 1 year ago

There are 2 separate features -

  1. CENC decryption - you must use mapped mode, and set the properties encryptionScheme (must be cenc) and encryptionKey on the source clip object.
  2. CBCS encryption - set vod_hls_encryption_method sample-aes; and vod_hls_container_format fmp4;, there are 2 options for setting the key - a. Set vod_secret_key to some expression (using nginx variables), the module will evaluate it and use it as a seed to generate the key b. Enable "DRM mode", the module will issue a subrequest to a configured location, and get back a JSON with the encryption key/iv. The format of the JSON is documented here https://github.com/kaltura/nginx-vod-module/#drm.