Configure FFmpeg Crypto Protocol Key and IV

This article explains how to configure the encryption key and Initialization Vector (IV) using FFmpeg's crypto protocol. You will learn the correct command-line syntax, formatting requirements for the keys, and practical examples for both encrypting and decrypting media files.

The FFmpeg crypto protocol acts as a stream wrapper that encrypts or decrypts an underlying stream using AES-128 in CBC mode. To configure it, you must pass the key and IV as hexadecimal strings using the -key and -iv private options.

Key and IV Formatting Requirements

• Key: Must be a 16-byte (128-bit) key, represented as a 32-character hexadecimal string.
• Initialization Vector (IV): Must be a 16-byte (128-bit) block, represented as a 32-character hexadecimal string.

Do not include any prefixes like 0x in the hexadecimal strings.

Encrypting a Video File

To encrypt an output stream, prefix the output file path with crypto: and provide the -key and -iv parameters before the output URL.

ffmpeg -i input.mp4 -key 0123456789abcdef0123456789abcdef -iv fedcba9876543210fedcba9876543210 -codec copy crypto:encrypted.mp4

In this command:

• -i input.mp4 specifies the source video.
• -key sets the 32-character hex encryption key.
• -iv sets the 32-character hex initialization vector.
• -codec copy streams the data without re-encoding.
• crypto:encrypted.mp4 tells FFmpeg to pipe the output through the crypto protocol wrapper to generate the encrypted file.

Decrypting a Video File

To decrypt an encrypted stream, prefix the input file path with crypto: and specify the corresponding -key and -iv options before the input.

ffmpeg -key 0123456789abcdef0123456789abcdef -iv fedcba9876543210fedcba9876543210 -i crypto:encrypted.mp4 -codec copy decrypted.mp4

In this command:

• The -key and -iv options are placed before the input to apply to the input stream.
• crypto:encrypted.mp4 tells FFmpeg to decrypt the source file on the fly.
• decrypted.mp4 is the resulting plaintext media file.