Secure SRT Streams in FFmpeg With Passphrase

Securing a Secure Reliable Transport (SRT) stream in FFmpeg involves enabling native AES encryption by passing specific parameters directly within the SRT connection URL. By defining the passphrase and pbkeylen (key length) parameters, you can encrypt your live video transmission across public networks, ensuring that only authorized endpoints with matching credentials can decode the stream.

Understanding the Parameters

SRT uses symmetric encryption, meaning both the sender and the receiver must use identical settings:

  • passphrase: The secret password used to generate the encryption keys. It must be between 10 and 79 characters long.
  • pbkeylen: The encryption key length in bytes. This determines the Advanced Encryption Standard (AES) strength:
    • 16: AES-128 encryption (default if unspecified)
    • 24: AES-192 encryption
    • 32: AES-256 encryption

Sending an Encrypted SRT Stream

To broadcast an encrypted stream, append passphrase and pbkeylen as query parameters to your destination SRT URL. Always wrap the URL in quotes to prevent your shell from interpreting the & character.

ffmpeg -re -i input.mp4 -c:v libx264 -c:a aac -f mpegts "srt://receiver_ip:9000?passphrase=MySecurePassphrase123&pbkeylen=32"

In this command:

  • passphrase=MySecurePassphrase123 sets the shared secret.
  • pbkeylen=32 enforces AES-256 encryption.

Receiving an Encrypted SRT Stream

The receiving instance of FFmpeg must specify the same passphrase and key length to decrypt the incoming packets.

Caller mode (connecting to a listener):

ffmpeg -i "srt://sender_ip:9000?passphrase=MySecurePassphrase123&pbkeylen=32" -c copy output.mp4

Listener mode (waiting for an incoming connection):

ffmpeg -i "srt://0.0.0.0:9000?mode=listener&passphrase=MySecurePassphrase123&pbkeylen=32" -c copy output.mp4

Essential Considerations

  • Passphrase Length: If the passphrase is shorter than 10 characters or exceeds 79 characters, FFmpeg will return a connection initialization error.
  • Parameter Matching: If the pbkeylen or passphrase values do not match exactly on both sender and receiver, the SRT handshake will fail, and no connection will be established.