Support HLS identity key format

[ksuhiyp]

I am getting 4026 err code for mp4 cenc encrypted

packager args

`in=${transcodedFilesMap.get('mp4_360p')},stream=audio,output=${audioPath},drm_label=AUDIO,playlist_name=audio.m3u8 \\
        in=${transcodedFilesMap.get('mp4_360p')},stream=video,output=${mp4_360p_protectedPath},drm_label=SD,playlist_name=mp4_360p.m3u8 \\
        in=${transcodedFilesMap.get('mp4_480p')},stream=video,output=${mp4_480p_protectedPath},drm_label=SD,playlist_name=mp4_480p.m3u8 \\
        in=${transcodedFilesMap.get('mp4_720p')},stream=video,output=${mp4_720p_protectedPath},drm_label=HD,playlist_name=mp4_720p.m3u8 \\
        --hls_base_url  https://s3-eu-west-1.amazonaws.com/dash-hls-adaptive/${lecture.id}/packagedFiles/ \\
    --clear_lead 0 \\
    --enable_raw_key_encryption \\
    --keys label=AUDIO:key_id=${ENV.AUDIO_KEY_ID}:key=${ENV.AUDIO_KEY},label=SD:key_id=${ENV.SD_KEY_ID}:key=${ENV.SD_KEY},label=HD:key_id=${ENV.HD_KEY_ID}:key=${ENV.HD_KEY} \\
    --protection_scheme cenc \\
   --hls_master_playlist_output ${manifestPath}`

Player DRM config:

this.player.configure({
      drm: {
        clearKeys: {
          // correct keys
          'abba271e8bcf552bbd2e86a434a9a5d9': '69eaa802a6763af979e8d1940fb88392',
          '6d76f25cb17f5e16b8eaef6bbf582d8e': 'cb541084c99731aef4fff74500c12ead',
          'f3c5e0361e6654b28f8049c778b23946': 'a4631a153a443df9eed0593043db7519'
          // wrong keys
          // 'wrongkeywrongkeywrongkey':'abcd1234abcd1234abcd1234',
        }
      }
    });

[ksuhiyp]

https://dash-hls-adaptive.s3-eu-west-1.amazonaws.com/5d7e523e79b1a9400e72498b/packagedFiles/audio.m3u8
https://dash-hls-adaptive.s3-eu-west-1.amazonaws.com/5d7e523e79b1a9400e72498b/packagedFiles/audio.mp4
https://dash-hls-adaptive.s3-eu-west-1.amazonaws.com/5d7e523e79b1a9400e72498b/packagedFiles/manifest.m3u8
https://dash-hls-adaptive.s3-eu-west-1.amazonaws.com/5d7e523e79b1a9400e72498b/packagedFiles/mp4_360p.m3u8
https://dash-hls-adaptive.s3-eu-west-1.amazonaws.com/5d7e523e79b1a9400e72498b/packagedFiles/mp4_360p.mp4
https://dash-hls-adaptive.s3-eu-west-1.amazonaws.com/5d7e523e79b1a9400e72498b/packagedFiles/mp4_480p.m3u8
https://dash-hls-adaptive.s3-eu-west-1.amazonaws.com/5d7e523e79b1a9400e72498b/packagedFiles/mp4_480p.mp4
https://dash-hls-adaptive.s3-eu-west-1.amazonaws.com/5d7e523e79b1a9400e72498b/packagedFiles/mp4_720p.m3u8
https://dash-hls-adaptive.s3-eu-west-1.amazonaws.com/5d7e523e79b1a9400e72498b/packagedFiles/mp4_720p.mp4

[TheModMaker]

It looks like we don't support the clear-key format that Shaka Packager uses. It probably won't be too hard to add support for it. It has a tag format like this:

#EXT-X-KEY:METHOD=SAMPLE-AES-CTR,URI="data:text/plain;base64,bXbyXLF/Xha46u9rv1gtjg==",KEYFORMAT="identity"

[ksuhiyp]

Shall I add that tag to the manifest?, When I do I get 4016

[TheModMaker]

That tag is already in your manifest, we don't support it currently. We only support Widevine encryption in HLS.

[ismena]

@ksuhiyp
You're doing everything right, it's our fault that we don't have support for this.
@TheModMaker tagged the issue as an enhancement for us to work on.

[ksuhiyp]

@ismena thank you, I hope this feature added soon

[ksuhiyp]

@joeyparrish @kqyang @TheModMaker Ok, I knew it that I had to build a DRM server from the beginning, can I just generate a self license without using widevine or any other 3rdparty license authority? If yes where I can read more on the technichal design specs of such service, general instructions are appreciated

[joeyparrish]

@ksuhiyp, I don't understand your question about building a DRM server. For us to support the identity key format in HLS, that is not at all necessary.

If you want to decrypt content with Widevine, that requires a Widevine license server under some agreement with Widevine. https://www.widevine.com/contact

[ksuhiyp]

@joeyparrish I mean key server other than clear keys but not widevine licensed, something like a custom made key server to decrypt content

[joeyparrish]

Decryption happens in the client, not the server. Your limiting factor will be the DRM clients available in various browsers. Chrome and Firefox have Widevine & ClearKey clients. Edge and IE have PlayReady clients. Safari has a FairPlay client. The license protocol understood by each client is different.

The ClearKey system is public and documented in the EME spec: https://www.w3.org/TR/encrypted-media/#clear-key-request-format

But that won't help you with HLS identity key format support, for what it's worth.

[joeyparrish]

@sbbullet, this is the original issue for the "identity" key format.

If anyone on this issue is interested to contribute, we would be happy to review a PR for this feature! Thanks for your help!

[sbbullet]

Thank you @joeyparrish. I think only Apple's interest in supporting ClearKey would provide synergy to anyone who can contribute. Anyway, thank you for your response.

[ksuhiyp]

Dear @joeyparrish, can you highlight on how to start contributing for this feature like places to read in the docs and whether upstream support from apple is required

[joeyparrish]

I would have to double-check what Safari supports, but ClearKey support would be required in the browser. This content should be playable in both Chrome and Firefox, though, which both have ClearKey CDMs. I haven't checked, but I expect new Chromium-based Edge would support it, as well.

You can check this page in any browser to see what it supports: https://shaka-player-demo.appspot.com/support.html At the bottom, you would see something like this is ClearKey is supported:

    "org.w3.clearkey": {
      "persistentState": false
    },

And this if it's not:

    "org.w3.clearkey": null,

As for contributing, I would guess that the relevant source files are:

• lib/hls/hls_parser.js
• externs/shaka/manifest.js
• possibly lib/media/drm_engine.js

The HLS parser needs to be able to parse the identity key format, which would be registered in shaka.hls.HlsParser.KEYFORMATS_TO_DRM_PARSERS_. This parser would have to return a shaka.extern.DrmInfo object, which is defined in externs/shaka/manifest.js. This would indicate ClearKey (org.w3.clearkey) as the key system. The structure would then be consumed by DrmEngine.

DrmEngine already has a private method for creating a ClearKey DrmInfo based on a config. You could make it public and generalize it to take input from the HLS parser, too. It works by turning key IDs and keys into a data: URI for the license server, which effectively lets the player inject keys directly in ClearKey license format without an external server. See configureClearKey_ in lib/media/drm_engine.js.

Use ./build/all.py and ./build/test.py to check your work before submitting a PR, and please let us know if you have other questions or need more guidance. The Closure Compiler can be a pain sometimes, but it's based on jsdoc syntax, which isn't too bad, and it really does help catch a lot of mistakes at compile time.

Thanks so much!

[ksuhiyp]

Dear @joeyparrish, on macbook safari org.w3.clearkey: null, does that mean I should not be involved in a contribution to solve this issue since it is an upstream issue. If not, I am a little bit hazed about the process of solving this issue, is there a similar approach in dash parser that can be followed to be implemented in hls parser? can you give me 30 minutes call to set me in the context of the operation?

[ksuhiyp]

@joeyparrish

You could make it public and generalize it to take input from the HLS parser, too. It works by turning key IDs and keys into a data: URI for the license server

can you please give more explanation, what do you mean by generalizing it to take input from HLS ?. till the moment I am imposing that I have to create a method in hls_parser.js that functions like widevineDrmParser_ in hls_parser.js. then head to drm_engine.js to modify configureClearKey_ to take input from hls_parser, but I am not sure what hls_parser requires here to modify?

[joeyparrish]

The "identity" key format is implicitly supported on AES-128 full-segment encryption, but support is still missing for SAMPLE-AES.

[joeyparrish]

Looking into adding support for METHOD=SAMPLE-AES, KEYFORMAT=identity through ClearKey, and it doesn't look like a good match. The ClearKey CDM requires a map of key IDs to keys, but HLS playlists don't provide the key ID.

It is possible that we will only be able to parse the tag and allow it through, but won't be able to automatically fetch the key and configure ClearKey for you. In this case, you would have to use this.player.configure('drm.clearKeys': { ... }) to provide the key ID to key mapping for SAMPLE-AES content to use the identity key format.