Implementing HLS Streaming with ClearKey DRM in VideoJS

Question

I would like to know how my HLS manifest has to look like in order to trigger videojs-contrib-eme ClearKey functionality explicitly using HLS streaming (not DASH). Currently, my manifest looks like below, but from my understanding this isn't ClearKey, this is simply encrypted HLS using AES-128:

#EXTM3U
#EXT-X-VERSION:7
#EXT-X-TARGETDURATION:6
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-PLAYLIST-TYPE:VOD
#EXT-X-INDEPENDENT-SEGMENTS
#EXT-X-MAP:URI="init.m4s"
#EXT-X-KEY:METHOD=AES-128,URI="https://some_domain_com/9915b885-bd21-4455-9c76-351657640fe7/yKgyvNsw252Z973520yg3yj9hlFCVGUIDWyDWvB6V1qLXyvTV4EvVvwRlOgnds1f",IV=e5aa88fe5bf759221369e7656138d6bb
#EXTINF:6.000000,
lots of segments ...

1. Does VideoJS support ClearKey using HLS?
2. How does my #EXT-X-KEY line has to look like in order to trigger the eme extension of VideoJS and later use the getLicense call with videoJS ?

I'm not sure how far VideoJS supports HLS with ClearKey but I had the hope that maybe sombody else has already implemented it in the past an help me out.

Thanks in advance

Answer 1

You have to separate issues.

1. key exchange
2. encryption

The key exchange is vendor specific and happens in secure memory of the Encrypted Media Extensions (EME) implementation. ClearyKey is one implementation of key exchange. As the name implies - ClearKey exchanges the key in clear text. So the ClearKey DRM system is not secure. I use ClearKey for system testing and not for any production purpose.

ClearKey is a DRM system used in DASH. The DRM part of DASH requires a common encryption which must be the same across vendors.

There is no ClearKey for HLS that would work across multiple players or platform.

For most devices and for Apple devices - I would follow Apples instruction for encryption - either SAMPLE-AES encryption or Common Encryption with 10% partial encryption.

Then you can use the #EXT-X-KEY tag to reference the key in clear text for test purposes. So you save the encryption key in a file and put it along with your HLS package.

Doing something like

#EXT-X-KEY:METHOD=SAMPLE-AES,URI="http://example.com/my16ByteKey.bin",KEYFORMAT="identity",IV=0xA30FE123ECBF1BE323A775A119C553BC

is conceptually the closest to DASH ClearKey DRM.