Secure FFmpeg SRT Stream with Passphrase and Key Length

This article provides a straightforward guide on how to secure Secure Reliable Transport (SRT) streams using FFmpeg. You will learn how to configure AES encryption by applying the passphrase and pbkeylen (crypto key length) parameters directly within your FFmpeg command-line arguments to protect your live video broadcasts from unauthorized access.

Understanding SRT Encryption Parameters

To secure an SRT stream in FFmpeg, you must append specific encryption parameters to the SRT destination or source URL. SRT utilizes Advanced Encryption Standard (AES) to encrypt the payload.

Two primary parameters control this encryption:

  • passphrase: The secret password used to encrypt and decrypt the stream. It must be between 10 and 79 characters long.
  • pbkeylen: The crypto key length in bytes. This determines the strength of the AES encryption. The accepted values are:
    • 16 for AES-128 encryption
    • 24 for AES-192 encryption
    • 32 for AES-256 encryption

For encryption to work, both the sending FFmpeg instance and the receiving instance must use the exact same passphrase and pbkeylen values.

How to Configure the FFmpeg Command

To secure your stream, format your SRT URL in the FFmpeg command using query parameters.

1. Sending an Encrypted SRT Stream (Caller Mode)

When sending a stream to an SRT receiver, append the passphrase and pbkeylen to your output URL.

ffmpeg -re -i input.mp4 -c:v libx264 -preset veryfast -c:a aac -f mpegts "srt://192.168.1.100:9000?mode=caller&passphrase=MySecurePassword123&pbkeylen=32"

In this example:

  • passphrase=MySecurePassword123 sets the encryption password.
  • pbkeylen=32 enforces AES-256 encryption, the strongest available standard.

2. Receiving an Encrypted SRT Stream (Listener Mode)

To receive and decrypt the stream, the receiver must run a command with matching parameters.

ffmpeg -i "srt://0.0.0.0:9000?mode=listener&passphrase=MySecurePassword123&pbkeylen=32" -c copy output.mp4

Important Considerations

  • Passphrase Length: If your passphrase is shorter than 10 characters, FFmpeg will reject the connection or fail to initiate encryption.
  • Special Characters: If your passphrase contains special characters (like &, ?, or =), you must URL-encode them or wrap the entire SRT URL in double quotes to prevent your command line shell from misinterpreting the syntax.
  • Performance: AES-256 (pbkeylen=32) offers the highest security but requires slightly more CPU processing power than AES-128 (pbkeylen=16). If you are streaming from a resource-constrained hardware device, AES-128 may be preferred.