Setting RIST Buffer Size and Encryption in FFmpeg

Configuring the Reliable Internet Stream Transport (RIST) protocol in FFmpeg allows for resilient, low-latency, and secure media streaming over unpredictable networks. By tuning the packet recovery buffer size, you can establish an adequate retransmission window to recover dropped packets, while defining a shared encryption secret and cipher type ensures your stream remains protected from eavesdropping.

Prerequisites

To use RIST with encryption and custom buffer settings, your FFmpeg build must be compiled with librist support enabled (--enable-librist). You can verify your installation by running ffmpeg -protocols and checking for rist under the supported protocols list.

RIST Configuration Parameters

FFmpeg configures RIST through query parameters appended directly to the URL. The key options for packet recovery and encryption are:

  • buffer_size: Sets the packet recovery buffer size in milliseconds. This determines how long packets are retained in memory for potential automatic repeat request (ARQ) retransmissions. The default is typically 1000 ms.
  • secret: The pre-shared passphrase used to encrypt and decrypt the stream. Both sender and receiver must use the exact same key.
  • encryption_type: The AES encryption level to apply. Supported values are 128 for AES-128 or 256 for AES-256. If a secret is provided without specifying this option, FFmpeg defaults to AES-128.

Sender Configuration Example

To stream a media file to a remote destination using a 2000 ms recovery buffer and 256-bit AES encryption, format the output URL with the required parameters:

ffmpeg -re -i input.mp4 -c copy -f mpegts "rist://192.168.1.100:5000?buffer_size=2000&secret=YourStrongPasswordHere&encryption_type=256"

In this command:

  • buffer_size=2000 reserves a 2-second recovery buffer for handling packet loss.
  • secret=YourStrongPasswordHere defines the encryption key.
  • encryption_type=256 enforces AES-256 encryption.

Receiver Configuration Example

The receiving instance must mirror the encryption credentials and should set a matching or greater buffer size to accommodate the sender's recovery window:

ffmpeg -i "rist://@0.0.0.0:5000?buffer_size=2000&secret=YourStrongPasswordHere&encryption_type=256" -c copy output.mp4

Using @0.0.0.0:5000 binds the receiver to port 5000 across all available network interfaces. If the secret or encryption_type does not match the sender's configuration, the receiver will be unable to decrypt the incoming payload.