How to Encrypt DASH Segments in FFmpeg

This article provides a straightforward guide on how to configure segment encryption in the FFmpeg DASH (Dynamic Adaptive Streaming over HTTP) muxer. You will learn the exact command-line parameters required to secure your streams using MPEG-CENC (Common Encryption), including how to define encryption keys, key identifiers (KIDs), and encryption schemes.

Understanding DASH Encryption in FFmpeg

To encrypt DASH segments, FFmpeg utilizes the ISO Common Encryption (CENC) standard. This process requires two primary components: a Key Identifier (KID) and the Encryption Key itself. Both must be 128-bit hexadecimal strings (32 characters long).

By encrypting the segments, the resulting MPD (Media Presentation Description) manifest will contain the necessary metadata (<ContentProtection> tags) to let players know the stream is encrypted and how to acquire the decryption keys.

Required Parameters

To configure encryption, you must pass the following options to the FFmpeg DASH muxer:

  • -encryption_scheme: Specifies the encryption scheme. The most common value for DASH is cenc (AES-128 CTR mode) or cbcs (AES-128 CBC pattern mode).
  • -encryption_key: The 16-byte (128-bit) encryption key represented as a 32-digit hexadecimal string.
  • -encryption_kid: The 16-byte (128-bit) key identifier represented as a 32-digit hexadecimal string.

Example FFmpeg Command

The following command transcodes an input file, packages it into encrypted DASH segments, and generates the manifest:

ffmpeg -i input.mp4 \
  -c:v libx264 -b:v 2000k \
  -c:a aac -b:a 128k \
  -encryption_scheme cenc \
  -encryption_key 0123456789abcdef0123456789abcdef \
  -encryption_kid fedcba9876543210fedcba9876543210 \
  -f dash \
  -seg_duration 4 \
  -init_seg_name "init-\$RepresentationID\$.m4s" \
  -media_seg_name "chunk-\$RepresentationID\$-\$Number%05d\$.m4s" \
  manifest.mpd

Parameter Breakdown

  • -i input.mp4: Defines the source video.
  • -c:v libx264 -b:v 2000k: Encodes the video to H.264 at a bitrate of 2 Mbps.
  • -c:a aac -b:a 128k: Encodes the audio to AAC at 128 kbps.
  • -encryption_scheme cenc: Applies the standard AES-CTR 128-bit encryption scheme.
  • -encryption_key 0123456789abcdef0123456789abcdef: The secret key used to encrypt the media.
  • -encryption_kid fedcba9876543210fedcba9876543210: The key ID associated with the encryption key.
  • -f dash: Instructs FFmpeg to use the DASH muxer.
  • manifest.mpd: The output manifest file.

Verifying the Encryption

Once the command finishes running, you can verify the encryption by opening the generated manifest.mpd file in a text editor. Look for the <ContentProtection> XML elements. If configured correctly, they will contain the urn:mpeg:dash:mp4protection:2011 scheme ID and your specified default_KID.