diff --git a/.gitignore b/.gitignore
index 8202b82014..2a4acfebb7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -72,3 +72,9 @@
 /xcodebuild
 /.vscode
 !webrtc/*
+/tmp.patch
+/out-release
+/out-debug
+/node_modules
+/libwebrtc
+/args.txt
diff --git a/api/crypto/BUILD.gn b/api/crypto/BUILD.gn
index 8d041ea059..9249b7716a 100644
--- a/api/crypto/BUILD.gn
+++ b/api/crypto/BUILD.gn
@@ -16,6 +16,24 @@ group("crypto") {
   ]
 }
 
+rtc_library("frame_crypto_transformer") {
+  visibility = [ "*" ]
+  sources = [
+    "frame_crypto_transformer.cc",
+    "frame_crypto_transformer.h",
+  ]
+
+  deps = [
+   "//api:frame_transformer_interface",
+  ]
+
+  if (rtc_build_ssl) {
+    deps += [ "//third_party/boringssl" ]
+  } else {
+    configs += [ ":external_ssl_library" ]
+  }
+}
+
 rtc_library("options") {
   visibility = [ "*" ]
   sources = [
diff --git a/api/crypto/frame_crypto_transformer.cc b/api/crypto/frame_crypto_transformer.cc
new file mode 100644
index 0000000000..ed5a17c957
--- /dev/null
+++ b/api/crypto/frame_crypto_transformer.cc
@@ -0,0 +1,675 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "frame_crypto_transformer.h"
+
+#include <openssl/aes.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+#include <openssl/rand.h>
+
+#include <iomanip>
+#include <iostream>
+#include <sstream>
+#include <string>
+
+#include "absl/container/inlined_vector.h"
+#include "absl/types/optional.h"
+#include "absl/types/variant.h"
+#include "api/array_view.h"
+#include "common_video/h264/h264_common.h"
+#include "modules/rtp_rtcp/source/rtp_format_h264.h"
+#include "rtc_base/byte_buffer.h"
+#include "rtc_base/logging.h"
+
+enum class EncryptOrDecrypt { kEncrypt = 0, kDecrypt };
+
+#define Success 0
+#define ErrorUnexpected -1
+#define OperationError -2
+#define ErrorDataTooSmall -3
+#define ErrorInvalidAesGcmTagLength -4
+
+webrtc::VideoCodecType get_video_codec_type(
+    webrtc::TransformableFrameInterface* frame) {
+  auto videoFrame =
+      static_cast<webrtc::TransformableVideoFrameInterface*>(frame);
+  return videoFrame->header().codec;
+}
+
+webrtc::H264PacketizationMode get_h264_packetization_mode(
+    webrtc::TransformableFrameInterface* frame) {
+  auto video_frame =
+      static_cast<webrtc::TransformableVideoFrameInterface*>(frame);
+  const auto& h264_header = absl::get<webrtc::RTPVideoHeaderH264>(
+      video_frame->header().video_type_header);
+  return h264_header.packetization_mode;
+}
+
+const EVP_AEAD* GetAesGcmAlgorithmFromKeySize(size_t key_size_bytes) {
+  switch (key_size_bytes) {
+    case 16:
+      return EVP_aead_aes_128_gcm();
+    case 32:
+      return EVP_aead_aes_256_gcm();
+    default:
+      return nullptr;
+  }
+}
+
+const EVP_CIPHER* GetAesCbcAlgorithmFromKeySize(size_t key_size_bytes) {
+  switch (key_size_bytes) {
+    case 16:
+      return EVP_aes_128_cbc();
+    case 32:
+      return EVP_aes_256_cbc();
+    default:
+      return nullptr;
+  }
+}
+
+std::string to_uint8_list(const uint8_t* data, int len) {
+  std::stringstream ss;
+  ss << "[";
+  for (int i = 0; i < len; i++) {
+    ss << static_cast<unsigned>(data[i]) << ",";
+  }
+  ss << "]";
+  return ss.str();
+}
+
+std::string to_hex(const uint8_t* data, int len) {
+  std::stringstream ss;
+  ss << std::uppercase << std::hex << std::setfill('0');
+  for (int i = 0; i < len; i++) {
+    ss << std::setw(2) << static_cast<unsigned>(data[i]);
+  }
+  return ss.str();
+}
+
+uint8_t get_unencrypted_bytes(webrtc::TransformableFrameInterface* frame,
+                              webrtc::FrameCryptorTransformer::MediaType type) {
+  uint8_t unencrypted_bytes = 0;
+  switch (type) {
+    case webrtc::FrameCryptorTransformer::MediaType::kAudioFrame:
+      unencrypted_bytes = 1;
+      break;
+    case webrtc::FrameCryptorTransformer::MediaType::kVideoFrame: {
+      auto videoFrame =
+          static_cast<webrtc::TransformableVideoFrameInterface*>(frame);
+      if (videoFrame->header().codec ==
+          webrtc::VideoCodecType::kVideoCodecAV1) {
+        unencrypted_bytes = 0;
+      } else if (videoFrame->header().codec ==
+                 webrtc::VideoCodecType::kVideoCodecVP8) {
+        unencrypted_bytes = videoFrame->IsKeyFrame() ? 10 : 3;
+      } else if (videoFrame->header().codec ==
+                 webrtc::VideoCodecType::kVideoCodecH264) {
+        rtc::ArrayView<const uint8_t> date_in = frame->GetData();
+        std::vector<webrtc::H264::NaluIndex> nalu_indices =
+            webrtc::H264::FindNaluIndices(date_in.data(), date_in.size());
+
+        int idx = 0;
+        for (const auto& index : nalu_indices) {
+          const uint8_t* slice = date_in.data() + index.payload_start_offset;
+          webrtc::H264::NaluType nalu_type =
+              webrtc::H264::ParseNaluType(slice[0]);
+          switch (nalu_type) {
+            case webrtc::H264::NaluType::kIdr:
+            case webrtc::H264::NaluType::kSlice:
+              unencrypted_bytes = index.payload_start_offset + 2;
+              RTC_LOG(LS_INFO)
+                  << "NonParameterSetNalu::payload_size: " << index.payload_size
+                  << ", nalu_type " << nalu_type << ", NaluIndex [" << idx++
+                  << "] offset: " << index.payload_start_offset;
+              break;
+            default:
+              break;
+          }
+        }
+      }
+      break;
+    }
+    default:
+      break;
+  }
+  return unencrypted_bytes;
+}
+
+int DerivePBKDF2KeyFromRawKey(const std::vector<uint8_t> raw_key,
+                              const std::vector<uint8_t>& salt,
+                              unsigned int optional_length_bits,
+                              std::vector<uint8_t>* derived_key) {
+  size_t key_size_bytes = optional_length_bits / 8;
+  derived_key->resize(key_size_bytes);
+
+  if (PKCS5_PBKDF2_HMAC((const char*)raw_key.data(), raw_key.size(),
+                        salt.data(), salt.size(), 100000, EVP_sha256(),
+                        key_size_bytes, derived_key->data()) != 1) {
+    RTC_LOG(LS_ERROR) << "Failed to derive AES key from password.";
+    return ErrorUnexpected;
+  }
+
+  RTC_LOG(LS_INFO) << "raw_key "
+                   << to_uint8_list(raw_key.data(), raw_key.size()) << " len "
+                   << raw_key.size() << " slat << "
+                   << to_uint8_list(salt.data(), salt.size()) << " len "
+                   << salt.size() << "\n derived_key "
+                   << to_uint8_list(derived_key->data(), derived_key->size())
+                   << " len " << derived_key->size();
+
+  return Success;
+}
+
+int AesGcmEncryptDecrypt(EncryptOrDecrypt mode,
+                         const std::vector<uint8_t> raw_key,
+                         const rtc::ArrayView<uint8_t> data,
+                         unsigned int tag_length_bytes,
+                         rtc::ArrayView<uint8_t> iv,
+                         rtc::ArrayView<uint8_t> additional_data,
+                         const EVP_AEAD* aead_alg,
+                         std::vector<uint8_t>* buffer) {
+  bssl::ScopedEVP_AEAD_CTX ctx;
+
+  if (!aead_alg) {
+    RTC_LOG(LS_ERROR) << "Invalid AES-GCM key size.";
+    return ErrorUnexpected;
+  }
+
+  if (!EVP_AEAD_CTX_init(ctx.get(), aead_alg, raw_key.data(), raw_key.size(),
+                         tag_length_bytes, nullptr)) {
+    RTC_LOG(LS_ERROR) << "Failed to initialize AES-GCM context.";
+    return OperationError;
+  }
+
+  size_t len;
+  int ok;
+
+  if (mode == EncryptOrDecrypt::kDecrypt) {
+    if (data.size() < tag_length_bytes) {
+      RTC_LOG(LS_ERROR) << "Data too small for AES-GCM tag.";
+      return ErrorDataTooSmall;
+    }
+
+    buffer->resize(data.size() - tag_length_bytes);
+
+    ok = EVP_AEAD_CTX_open(ctx.get(), buffer->data(), &len, buffer->size(),
+                           iv.data(), iv.size(), data.data(), data.size(),
+                           additional_data.data(), additional_data.size());
+  } else {
+    buffer->resize(data.size() + EVP_AEAD_max_overhead(aead_alg));
+
+    ok = EVP_AEAD_CTX_seal(ctx.get(), buffer->data(), &len, buffer->size(),
+                           iv.data(), iv.size(), data.data(), data.size(),
+                           additional_data.data(), additional_data.size());
+  }
+
+  if (!ok) {
+    RTC_LOG(LS_ERROR) << "Failed to perform AES-GCM operation.";
+    return OperationError;
+  }
+
+  buffer->resize(len);
+
+  return Success;
+}
+
+int AesCbcEncryptDecrypt(EncryptOrDecrypt mode,
+                         const std::vector<uint8_t>& raw_key,
+                         rtc::ArrayView<uint8_t> iv,
+                         const rtc::ArrayView<uint8_t> input,
+                         std::vector<uint8_t>* output) {
+  const EVP_CIPHER* cipher = GetAesCbcAlgorithmFromKeySize(raw_key.size());
+  RTC_DCHECK(cipher);  // Already handled in Init();
+  RTC_DCHECK_EQ(EVP_CIPHER_iv_length(cipher), iv.size());
+  RTC_DCHECK_EQ(EVP_CIPHER_key_length(cipher), raw_key.size());
+
+  bssl::ScopedEVP_CIPHER_CTX ctx;
+  if (!EVP_CipherInit_ex(ctx.get(), cipher, nullptr,
+                         reinterpret_cast<const uint8_t*>(raw_key.data()),
+                         iv.data(),
+                         mode == EncryptOrDecrypt::kEncrypt ? 1 : 0)) {
+    return OperationError;
+  }
+
+  // Encrypting needs a block size of space to allow for any padding.
+  output->resize(input.size() +
+                 (mode == EncryptOrDecrypt::kEncrypt ? iv.size() : 0));
+  int out_len;
+  if (!EVP_CipherUpdate(ctx.get(), output->data(), &out_len, input.data(),
+                        input.size()))
+    return OperationError;
+
+  // Write out the final block plus padding (if any) to the end of the data
+  // just written.
+  int tail_len;
+  if (!EVP_CipherFinal_ex(ctx.get(), output->data() + out_len, &tail_len))
+    return OperationError;
+
+  out_len += tail_len;
+  RTC_CHECK_LE(out_len, static_cast<int>(output->size()));
+  return Success;
+}
+
+int AesEncryptDecrypt(EncryptOrDecrypt mode,
+                      webrtc::FrameCryptorTransformer::Algorithm algorithm,
+                      const std::vector<uint8_t>& raw_key,
+                      rtc::ArrayView<uint8_t> iv,
+                      rtc::ArrayView<uint8_t> additional_data,
+                      const rtc::ArrayView<uint8_t> data,
+                      std::vector<uint8_t>* buffer) {
+  switch (algorithm) {
+    case webrtc::FrameCryptorTransformer::Algorithm::kAesGcm: {
+      unsigned int tag_length_bits = 128;
+      return AesGcmEncryptDecrypt(
+          mode, raw_key, data, tag_length_bits / 8, iv, additional_data,
+          GetAesGcmAlgorithmFromKeySize(raw_key.size()), buffer);
+    }
+    case webrtc::FrameCryptorTransformer::Algorithm::kAesCbc:
+      return AesCbcEncryptDecrypt(mode, raw_key, iv, data, buffer);
+  }
+}
+
+namespace webrtc {
+
+FrameCryptorTransformer::FrameCryptorTransformer(
+    const std::string participant_id,
+    MediaType type,
+    Algorithm algorithm,
+    rtc::scoped_refptr<KeyProvider> key_provider)
+    : participant_id_(participant_id),
+      type_(type),
+      algorithm_(algorithm),
+      key_provider_(key_provider) {
+  RTC_DCHECK(key_provider_ != nullptr);
+}
+
+void FrameCryptorTransformer::Transform(
+    std::unique_ptr<webrtc::TransformableFrameInterface> frame) {
+  webrtc::MutexLock lock(&sink_mutex_);
+  if (sink_callback_ == nullptr && sink_callbacks_.size() == 0) {
+    RTC_LOG(LS_WARNING)
+        << "FrameCryptorTransformer::Transform sink_callback_ is NULL";
+    return;
+  }
+
+  // do encrypt or decrypt here...
+  switch (frame->GetDirection()) {
+    case webrtc::TransformableFrameInterface::Direction::kSender:
+      encryptFrame(std::move(frame));
+      break;
+    case webrtc::TransformableFrameInterface::Direction::kReceiver:
+      decryptFrame(std::move(frame));
+      break;
+    case webrtc::TransformableFrameInterface::Direction::kUnknown:
+      // do nothing
+      RTC_LOG(LS_INFO) << "FrameCryptorTransformer::Transform() kUnknown";
+      break;
+  }
+}
+
+void FrameCryptorTransformer::encryptFrame(
+    std::unique_ptr<webrtc::TransformableFrameInterface> frame) {
+  bool enabled_cryption = false;
+  rtc::scoped_refptr<webrtc::TransformedFrameCallback> sink_callback = nullptr;
+  {
+    webrtc::MutexLock lock(&mutex_);
+    enabled_cryption = enabled_cryption_;
+    if (type_ == webrtc::FrameCryptorTransformer::MediaType::kAudioFrame) {
+      sink_callback = sink_callback_;
+    } else {
+      sink_callback = sink_callbacks_[frame->GetSsrc()];
+    }
+  }
+
+  if (sink_callback == nullptr) {
+    RTC_LOG(LS_WARNING)
+        << "FrameCryptorTransformer::encryptFrame() sink_callback is NULL";
+    if (last_enc_error_ != FrameCryptionState::kInternalError) {
+      last_enc_error_ = FrameCryptionState::kInternalError;
+      if (observer_)
+        observer_->OnFrameCryptionStateChanged(participant_id_,
+                                               last_enc_error_);
+    }
+    return;
+  }
+
+  rtc::ArrayView<const uint8_t> date_in = frame->GetData();
+  if (date_in.size() == 0 || !enabled_cryption) {
+    sink_callback->OnTransformedFrame(std::move(frame));
+    return;
+  }
+
+  auto key_handler = key_provider_->GetKey(participant_id_);
+  if (key_handler == nullptr || key_handler->GetKeySet(key_index_) == nullptr) {
+    RTC_LOG(LS_INFO) << "FrameCryptorTransformer::encryptFrame() no keys, or "
+                        "key_index["
+                     << key_index_ << "] out of range for participant "
+                     << participant_id_;
+    if (last_enc_error_ != FrameCryptionState::kMissingKey) {
+      last_enc_error_ = FrameCryptionState::kMissingKey;
+      if (observer_)
+        observer_->OnFrameCryptionStateChanged(participant_id_,
+                                               last_enc_error_);
+    }
+    return;
+  }
+
+  auto key_set = key_handler->GetKeySet(key_index_);
+  uint8_t unencrypted_bytes = get_unencrypted_bytes(frame.get(), type_);
+
+  rtc::Buffer frame_header(unencrypted_bytes);
+  for (size_t i = 0; i < unencrypted_bytes; i++) {
+    frame_header[i] = date_in[i];
+  }
+
+  rtc::Buffer frame_trailer(2);
+  frame_trailer[0] = getIvSize();
+  frame_trailer[1] = key_index_;
+  rtc::Buffer iv = makeIv(frame->GetSsrc(), frame->GetTimestamp());
+
+  rtc::Buffer payload(date_in.size() - unencrypted_bytes);
+  for (size_t i = unencrypted_bytes; i < date_in.size(); i++) {
+    payload[i - unencrypted_bytes] = date_in[i];
+  }
+
+  std::vector<uint8_t> buffer;
+  if (AesEncryptDecrypt(EncryptOrDecrypt::kEncrypt, algorithm_,
+                        key_set->encryption_key, iv, frame_header, payload,
+                        &buffer) == Success) {
+    rtc::Buffer encrypted_payload(buffer.data(), buffer.size());
+    rtc::Buffer data_out;
+    data_out.AppendData(frame_header);
+    data_out.AppendData(encrypted_payload);
+    data_out.AppendData(iv);
+    data_out.AppendData(frame_trailer);
+
+    RTC_CHECK_EQ(data_out.size(), frame_header.size() +
+                                      encrypted_payload.size() + iv.size() +
+                                      frame_trailer.size());
+
+    frame->SetData(data_out);
+
+    RTC_LOG(LS_INFO) << "FrameCryptorTransformer::encryptFrame() ivLength="
+                     << static_cast<int>(iv.size()) << " unencrypted_bytes="
+                     << static_cast<int>(unencrypted_bytes)
+                     << " key_index=" << static_cast<int>(key_index_)
+                     << " aesKey="
+                     << to_hex(key_set->encryption_key.data(),
+                               key_set->encryption_key.size())
+                     << " iv=" << to_hex(iv.data(), iv.size());
+    if (last_enc_error_ != FrameCryptionState::kOk) {
+      last_enc_error_ = FrameCryptionState::kOk;
+      if (observer_)
+        observer_->OnFrameCryptionStateChanged(participant_id_,
+                                               last_enc_error_);
+    }
+    sink_callback->OnTransformedFrame(std::move(frame));
+  } else {
+    if (last_enc_error_ != FrameCryptionState::kEncryptionFailed) {
+      last_enc_error_ = FrameCryptionState::kEncryptionFailed;
+      if (observer_)
+        observer_->OnFrameCryptionStateChanged(participant_id_,
+                                               last_enc_error_);
+    }
+    RTC_LOG(LS_ERROR) << "FrameCryptorTransformer::encryptFrame() failed";
+  }
+}
+
+void FrameCryptorTransformer::decryptFrame(
+    std::unique_ptr<webrtc::TransformableFrameInterface> frame) {
+  bool enabled_cryption = false;
+  rtc::scoped_refptr<webrtc::TransformedFrameCallback> sink_callback = nullptr;
+  {
+    webrtc::MutexLock lock(&mutex_);
+    enabled_cryption = enabled_cryption_;
+    if (type_ == webrtc::FrameCryptorTransformer::MediaType::kAudioFrame) {
+      sink_callback = sink_callback_;
+    } else {
+      sink_callback = sink_callbacks_[frame->GetSsrc()];
+    }
+  }
+
+  if (sink_callback == nullptr) {
+    RTC_LOG(LS_WARNING)
+        << "FrameCryptorTransformer::decryptFrame() sink_callback is NULL";
+    if (last_dec_error_ != FrameCryptionState::kInternalError) {
+      last_dec_error_ = FrameCryptionState::kInternalError;
+      if (observer_)
+        observer_->OnFrameCryptionStateChanged(participant_id_,
+                                               last_dec_error_);
+    }
+    return;
+  }
+
+  rtc::ArrayView<const uint8_t> date_in = frame->GetData();
+
+  if (date_in.size() == 0 || !enabled_cryption) {
+    sink_callback->OnTransformedFrame(std::move(frame));
+    return;
+  }
+  
+  auto uncrypted_magic_bytes = key_provider_->options().uncrypted_magic_bytes;
+  if (uncrypted_magic_bytes.size() > 0 &&
+      date_in.size() >= uncrypted_magic_bytes.size() + 1) {
+    auto tmp = date_in.subview(date_in.size() - (uncrypted_magic_bytes.size() + 1),
+                               uncrypted_magic_bytes.size());
+
+    if (uncrypted_magic_bytes == std::vector<uint8_t>(tmp.begin(), tmp.end())) {
+
+      RTC_CHECK_EQ(tmp.size(), uncrypted_magic_bytes.size());
+      auto frame_type = date_in.subview(date_in.size() - 1, 1);
+      RTC_CHECK_EQ(frame_type.size(), 1);
+
+      RTC_LOG(LS_INFO) << "FrameCryptorTransformer::uncrypted_magic_bytes( type "
+                       << frame_type[0] << ", tmp "
+                       << to_hex(tmp.data(), tmp.size()) << ", magic bytes "
+                       << to_hex(uncrypted_magic_bytes.data(),
+                                 uncrypted_magic_bytes.size())
+                       << ")";
+
+      // magic bytes detected, this is a non-encrypted frame, skip frame decryption.
+      rtc::Buffer data_out;
+      data_out.AppendData(
+          date_in.subview(0, date_in.size() - uncrypted_magic_bytes.size() - 1));
+      frame->SetData(data_out);
+      sink_callback->OnTransformedFrame(std::move(frame));
+      return;
+    }
+  }
+
+  uint8_t unencrypted_bytes = get_unencrypted_bytes(frame.get(), type_);
+
+  rtc::Buffer frame_header(unencrypted_bytes);
+  for (size_t i = 0; i < unencrypted_bytes; i++) {
+    frame_header[i] = date_in[i];
+  }
+
+  rtc::Buffer frame_trailer(2);
+  frame_trailer[0] = date_in[date_in.size() - 2];
+  frame_trailer[1] = date_in[date_in.size() - 1];
+  uint8_t ivLength = frame_trailer[0];
+  uint8_t key_index = frame_trailer[1];
+
+  if (ivLength != getIvSize()) {
+    RTC_LOG(LS_ERROR) << "FrameCryptorTransformer::decryptFrame() ivLength["
+                      << static_cast<int>(ivLength) << "] != getIvSize()["
+                      << static_cast<int>(getIvSize()) << "]";
+    if (last_dec_error_ != FrameCryptionState::kDecryptionFailed) {
+      last_dec_error_ = FrameCryptionState::kDecryptionFailed;
+      if (observer_)
+        observer_->OnFrameCryptionStateChanged(participant_id_,
+                                               last_dec_error_);
+    }
+    return;
+  }
+
+  auto key_handler = key_provider_->GetKey(participant_id_);
+  if (key_index >= KEYRING_SIZE || key_handler == nullptr ||
+      key_handler->GetKeySet(key_index) == nullptr) {
+    RTC_LOG(LS_INFO) << "FrameCryptorTransformer::decryptFrame() no keys, or "
+                        "key_index["
+                     << key_index_ << "] out of range for participant "
+                     << participant_id_;
+    if (last_dec_error_ != FrameCryptionState::kMissingKey) {
+      last_dec_error_ = FrameCryptionState::kMissingKey;
+      if (observer_)
+        observer_->OnFrameCryptionStateChanged(participant_id_,
+                                               last_dec_error_);
+    }
+    return;
+  }
+
+  if(last_dec_error_ == kDecryptionFailed && !key_handler->have_valid_key) {
+      // if decryption failed and we have an invalid key,
+      // please try to decrypt with the next new key
+      return;
+  }
+
+  auto key_set = key_handler->GetKeySet(key_index);
+
+  rtc::Buffer iv = rtc::Buffer(ivLength);
+  for (size_t i = 0; i < ivLength; i++) {
+    iv[i] = date_in[date_in.size() - 2 - ivLength + i];
+  }
+
+  rtc::Buffer encrypted_payload(date_in.size() - unencrypted_bytes - ivLength -
+                                2);
+  for (size_t i = unencrypted_bytes; i < date_in.size() - ivLength - 2; i++) {
+    encrypted_payload[i - unencrypted_bytes] = date_in[i];
+  }
+  std::vector<uint8_t> buffer;
+
+  int ratchet_count = 0;
+  auto initialKeyMaterial = key_set->material;
+  bool decryption_success = false;
+  if (AesEncryptDecrypt(EncryptOrDecrypt::kDecrypt, algorithm_,
+                        key_set->encryption_key, iv, frame_header,
+                        encrypted_payload, &buffer) == Success) {
+    decryption_success = true;
+  } else {
+    RTC_LOG(LS_ERROR) << "FrameCryptorTransformer::decryptFrame() failed";
+    std::shared_ptr<ParticipantKeyHandler::KeySet> ratcheted_key_set;
+    auto currentKeyMaterial = key_set->material;
+    if (key_handler->options().ratchet_window_size > 0) {
+      while (ratchet_count < key_handler->options().ratchet_window_size) {
+        ratchet_count++;
+
+        RTC_LOG(LS_INFO) << "ratcheting key attempt " << ratchet_count << " of "
+                         << key_handler->options().ratchet_window_size;
+
+        auto new_material = key_handler->RatchetKeyMaterial(currentKeyMaterial);
+        ratcheted_key_set = key_handler->DeriveKeys(new_material, key_handler->options().ratchet_salt, 128);
+
+        if (AesEncryptDecrypt(EncryptOrDecrypt::kDecrypt, algorithm_,
+                              ratcheted_key_set->encryption_key, iv, frame_header,
+                              encrypted_payload, &buffer) == Success) {
+          RTC_LOG(LS_INFO) << "FrameCryptorTransformer::decryptFrame() "
+                              "ratcheted to key_index="
+                           << static_cast<int>(key_index);
+          decryption_success = true;
+          // success, so we set the new key
+          key_handler->SetKeyFromMaterial(new_material, key_index);
+          if (last_dec_error_ != FrameCryptionState::kKeyRatcheted) {
+            last_dec_error_ = FrameCryptionState::kKeyRatcheted;
+            if (observer_)
+              observer_->OnFrameCryptionStateChanged(participant_id_,
+                                                     last_dec_error_);
+          }
+          break;
+        }
+        // for the next ratchet attempt
+        currentKeyMaterial = new_material;
+      }
+
+      /* Since the key it is first send and only afterwards actually used for
+        encrypting, there were situations when the decrypting failed due to the
+        fact that the received frame was not encrypted yet and ratcheting, of
+        course, did not solve the problem. So if we fail RATCHET_WINDOW_SIZE
+        times, we come back to the initial key.
+       */
+      if (!decryption_success ||
+          ratchet_count >= key_handler->options().ratchet_window_size) {
+        key_handler->SetKeyFromMaterial(initialKeyMaterial, key_index);
+      }
+    }
+  }
+
+  if (!decryption_success) {
+    if (last_dec_error_ != FrameCryptionState::kDecryptionFailed) {
+      last_dec_error_ = FrameCryptionState::kDecryptionFailed;
+      key_handler->have_valid_key = false;
+      if (observer_)
+        observer_->OnFrameCryptionStateChanged(participant_id_,
+                                               last_dec_error_);
+    }
+    return;
+  }
+
+  rtc::Buffer payload(buffer.data(), buffer.size());
+  rtc::Buffer data_out;
+  data_out.AppendData(frame_header);
+  data_out.AppendData(payload);
+  frame->SetData(data_out);
+
+  RTC_LOG(LS_INFO) << "FrameCryptorTransformer::decryptFrame() ivLength="
+                   << static_cast<int>(ivLength) << " unencrypted_bytes="
+                   << static_cast<int>(unencrypted_bytes)
+                   << " key_index=" << static_cast<int>(key_index_) << " aesKey="
+                   << to_hex(key_set->encryption_key.data(),
+                             key_set->encryption_key.size())
+                   << " iv=" << to_hex(iv.data(), iv.size());
+
+  if (last_dec_error_ != FrameCryptionState::kOk) {
+    last_dec_error_ = FrameCryptionState::kOk;
+    if (observer_)
+      observer_->OnFrameCryptionStateChanged(participant_id_, last_dec_error_);
+  }
+  sink_callback->OnTransformedFrame(std::move(frame));
+}
+
+rtc::Buffer FrameCryptorTransformer::makeIv(uint32_t ssrc, uint32_t timestamp) {
+  uint32_t send_count = 0;
+  if (send_counts_.find(ssrc) == send_counts_.end()) {
+    srand((unsigned)time(NULL));
+    send_counts_[ssrc] = floor(rand() * 0xFFFF);
+  } else {
+    send_count = send_counts_[ssrc];
+  }
+  rtc::ByteBufferWriter buf;
+  buf.WriteUInt32(ssrc);
+  buf.WriteUInt32(timestamp);
+  buf.WriteUInt32(timestamp - (send_count % 0xFFFF));
+  send_counts_[ssrc] = send_count + 1;
+
+  RTC_CHECK_EQ(buf.Length(), getIvSize());
+
+  return rtc::Buffer(buf.Data(), buf.Length());
+}
+
+uint8_t FrameCryptorTransformer::getIvSize() {
+  switch (algorithm_) {
+    case Algorithm::kAesGcm:
+      return 12;
+    case Algorithm::kAesCbc:
+      return 16;
+    default:
+      return 0;
+  }
+}
+
+}  // namespace webrtc
diff --git a/api/crypto/frame_crypto_transformer.h b/api/crypto/frame_crypto_transformer.h
new file mode 100644
index 0000000000..7f98deb11d
--- /dev/null
+++ b/api/crypto/frame_crypto_transformer.h
@@ -0,0 +1,329 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef WEBRTC_FRAME_CRYPTOR_TRANSFORMER_H_
+#define WEBRTC_FRAME_CRYPTOR_TRANSFORMER_H_
+
+#include <unordered_map>
+
+#include "api/frame_transformer_interface.h"
+#include "rtc_base/buffer.h"
+#include "rtc_base/synchronization/mutex.h"
+#include "rtc_base/system/rtc_export.h"
+#include "rtc_base/thread.h"
+
+int DerivePBKDF2KeyFromRawKey(const std::vector<uint8_t> raw_key,
+                              const std::vector<uint8_t>& salt,
+                              unsigned int optional_length_bits,
+                              std::vector<uint8_t>* derived_key);
+
+namespace webrtc {
+
+const size_t KEYRING_SIZE = 16;
+
+struct KeyProviderOptions {
+  bool shared_key;
+  std::vector<uint8_t> ratchet_salt;
+  std::vector<uint8_t> uncrypted_magic_bytes;
+  int ratchet_window_size;
+  KeyProviderOptions() : shared_key(false), ratchet_window_size(0) {}
+  KeyProviderOptions(KeyProviderOptions& copy)
+      : shared_key(copy.shared_key),
+        ratchet_salt(copy.ratchet_salt),
+        uncrypted_magic_bytes(copy.uncrypted_magic_bytes),
+        ratchet_window_size(copy.ratchet_window_size) {}
+};
+
+class ParticipantKeyHandler {
+ friend class FrameCryptorTransformer;
+ public:
+  struct KeySet {
+    std::vector<uint8_t> material;
+    std::vector<uint8_t> encryption_key;
+    KeySet(std::vector<uint8_t> material, std::vector<uint8_t> encryptionKey)
+        : material(material), encryption_key(encryptionKey) {}
+  };
+
+ public:
+  ParticipantKeyHandler(KeyProviderOptions options) : options_(options) {
+    crypto_key_ring_.resize(KEYRING_SIZE);
+  }
+
+  virtual ~ParticipantKeyHandler() = default;
+
+  virtual std::vector<uint8_t> RatchetKey(int key_index) {
+    auto current_material = GetKeySet(key_index)->material;
+    std::vector<uint8_t> new_material;
+    if (DerivePBKDF2KeyFromRawKey(current_material, options_.ratchet_salt, 256,
+                                  &new_material) != 0) {
+      return std::vector<uint8_t>();
+    }
+    SetKeyFromMaterial(new_material,
+                       key_index != -1 ? key_index : current_key_index_);
+    return new_material;
+  }
+
+  virtual std::shared_ptr<KeySet> GetKeySet(int key_index) {
+    return crypto_key_ring_[key_index != -1 ? key_index : current_key_index_];
+  }
+
+  virtual void SetKey(std::vector<uint8_t> password, int key_index) {
+    SetKeyFromMaterial(password, key_index);
+    have_valid_key = true;
+  }
+
+  virtual void SetKeyFromMaterial(std::vector<uint8_t> password, int key_index) {
+    if (key_index >= 0) {
+      current_key_index_ = key_index % crypto_key_ring_.size();
+    }
+    crypto_key_ring_[current_key_index_] =
+        DeriveKeys(password, options_.ratchet_salt, 128);
+  }
+
+  virtual KeyProviderOptions& options() { return options_; }
+
+  std::shared_ptr<KeySet> DeriveKeys(std::vector<uint8_t> password,
+                                     std::vector<uint8_t> ratchet_salt,
+                                     unsigned int optional_length_bits) {
+    std::vector<uint8_t> derived_key;
+    if (DerivePBKDF2KeyFromRawKey(password, ratchet_salt, optional_length_bits,
+                                  &derived_key) == 0) {
+      return std::make_shared<KeySet>(password, derived_key);
+    }
+    return nullptr;
+  }
+
+  std::vector<uint8_t> RatchetKeyMaterial(
+      std::vector<uint8_t> current_material) {
+    std::vector<uint8_t> new_material;
+    if (DerivePBKDF2KeyFromRawKey(current_material, options_.ratchet_salt, 256,
+                                  &new_material) != 0) {
+      return std::vector<uint8_t>();
+    }
+    return new_material;
+  }
+ protected:
+  bool have_valid_key = false;
+ private:
+  int current_key_index_ = 0;
+  KeyProviderOptions options_;
+  std::vector<std::shared_ptr<KeySet>> crypto_key_ring_;
+};
+
+class KeyProvider : public rtc::RefCountInterface {
+ public:
+  enum { kRawKeySize = 32 };
+
+ public:
+  virtual const std::shared_ptr<ParticipantKeyHandler> GetKey(
+      const std::string participant_id) const = 0;
+
+  virtual bool SetKey(const std::string participant_id,
+                      int index,
+                      std::vector<uint8_t> key) = 0;
+
+  virtual const std::vector<uint8_t> RatchetKey(
+      const std::string participant_id,
+      int key_index) = 0;
+
+  virtual const std::vector<uint8_t> ExportKey(const std::string participant_id,
+                                               int key_index) const = 0;
+
+  virtual KeyProviderOptions& options() = 0;
+
+ protected:
+  virtual ~KeyProvider() {}
+};
+
+class DefaultKeyProviderImpl : public KeyProvider {
+ public:
+  DefaultKeyProviderImpl(KeyProviderOptions options) : options_(options) {}
+  ~DefaultKeyProviderImpl() override = default;
+
+  /// Set the key at the given index.
+  bool SetKey(const std::string participant_id,
+              int index,
+              std::vector<uint8_t> key) override {
+    webrtc::MutexLock lock(&mutex_);
+
+    if (keys_.find(participant_id) == keys_.end()) {
+      keys_[participant_id] = std::make_shared<ParticipantKeyHandler>(options_);
+    }
+
+    auto key_handler = keys_[participant_id];
+    key_handler->SetKey(key, index);
+    return true;
+  }
+
+  const std::shared_ptr<ParticipantKeyHandler> GetKey(
+      const std::string participant_id) const override {
+    webrtc::MutexLock lock(&mutex_);
+    if (keys_.find(participant_id) == keys_.end()) {
+      return nullptr;
+    }
+
+    return keys_.find(participant_id)->second;
+  }
+
+  const std::vector<uint8_t> RatchetKey(const std::string participant_id,
+                                        int key_index) override {
+    webrtc::MutexLock lock(&mutex_);
+    if (keys_.find(participant_id) == keys_.end()) {
+      return std::vector<uint8_t>();
+    }
+
+    return keys_[participant_id]->RatchetKey(key_index);
+  }
+
+  const std::vector<uint8_t> ExportKey(const std::string participant_id,
+                                       int key_index) const override {
+    webrtc::MutexLock lock(&mutex_);
+    if (keys_.find(participant_id) == keys_.end()) {
+      return std::vector<uint8_t>();
+    }
+
+    auto key_set = GetKey(participant_id);
+
+    if (!key_set) {
+      return std::vector<uint8_t>();
+    }
+
+    return key_set->GetKeySet(key_index)->material;
+  }
+
+  KeyProviderOptions& options() override { return options_; }
+
+ private:
+  mutable webrtc::Mutex mutex_;
+  KeyProviderOptions options_;
+  std::unordered_map<std::string, std::shared_ptr<ParticipantKeyHandler>> keys_;
+};
+
+enum FrameCryptionState {
+  kNew = 0,
+  kOk,
+  kEncryptionFailed,
+  kDecryptionFailed,
+  kMissingKey,
+  kKeyRatcheted,
+  kInternalError,
+};
+
+class FrameCryptorTransformerObserver {
+ public:
+  virtual void OnFrameCryptionStateChanged(const std::string participant_id,
+                                           FrameCryptionState error) = 0;
+
+ protected:
+  virtual ~FrameCryptorTransformerObserver() {}
+};
+
+class RTC_EXPORT FrameCryptorTransformer
+    : public rtc::RefCountedObject<webrtc::FrameTransformerInterface> {
+ public:
+  enum class MediaType {
+    kAudioFrame = 0,
+    kVideoFrame,
+  };
+
+  enum class Algorithm {
+    kAesGcm = 0,
+    kAesCbc,
+  };
+
+  explicit FrameCryptorTransformer(const std::string participant_id,
+                                   MediaType type,
+                                   Algorithm algorithm,
+                                   rtc::scoped_refptr<KeyProvider> key_provider);
+
+  virtual void SetFrameCryptorTransformerObserver(
+      FrameCryptorTransformerObserver* observer) {
+    webrtc::MutexLock lock(&mutex_);
+    observer_ = observer;
+  }
+
+  virtual void SetKeyIndex(int index) {
+    webrtc::MutexLock lock(&mutex_);
+    key_index_ = index;
+  }
+
+  virtual int key_index() const { return key_index_; }
+
+  virtual void SetEnabled(bool enabled) {
+    webrtc::MutexLock lock(&mutex_);
+    enabled_cryption_ = enabled;
+  }
+  virtual bool enabled() const {
+    webrtc::MutexLock lock(&mutex_);
+    return enabled_cryption_;
+  }
+  virtual const std::string participant_id() const { return participant_id_; }
+
+ protected:
+  virtual void RegisterTransformedFrameCallback(
+      rtc::scoped_refptr<webrtc::TransformedFrameCallback> callback) override {
+    webrtc::MutexLock lock(&sink_mutex_);
+    sink_callback_ = callback;
+  }
+  virtual void UnregisterTransformedFrameCallback() override {
+    webrtc::MutexLock lock(&sink_mutex_);
+    sink_callback_ = nullptr;
+  }
+  virtual void RegisterTransformedFrameSinkCallback(
+      rtc::scoped_refptr<webrtc::TransformedFrameCallback> callback,
+      uint32_t ssrc) override {
+    webrtc::MutexLock lock(&sink_mutex_);
+    sink_callbacks_[ssrc] = callback;
+  }
+  virtual void UnregisterTransformedFrameSinkCallback(uint32_t ssrc) override {
+    webrtc::MutexLock lock(&sink_mutex_);
+    auto it = sink_callbacks_.find(ssrc);
+    if (it != sink_callbacks_.end()) {
+      sink_callbacks_.erase(it);
+    }
+  }
+
+  virtual void Transform(
+      std::unique_ptr<webrtc::TransformableFrameInterface> frame) override;
+
+ private:
+  void encryptFrame(std::unique_ptr<webrtc::TransformableFrameInterface> frame);
+  void decryptFrame(std::unique_ptr<webrtc::TransformableFrameInterface> frame);
+  rtc::Buffer makeIv(uint32_t ssrc, uint32_t timestamp);
+  uint8_t getIvSize();
+
+ private:
+  std::string participant_id_;
+  mutable webrtc::Mutex mutex_;
+  mutable webrtc::Mutex sink_mutex_;
+  bool enabled_cryption_ RTC_GUARDED_BY(mutex_) = false;
+  MediaType type_;
+  Algorithm algorithm_;
+  rtc::scoped_refptr<webrtc::TransformedFrameCallback> sink_callback_;
+  std::map<uint32_t, rtc::scoped_refptr<webrtc::TransformedFrameCallback>>
+      sink_callbacks_;
+  int key_index_ = 0;
+  std::map<uint32_t, uint32_t> send_counts_;
+  rtc::scoped_refptr<KeyProvider> key_provider_;
+  FrameCryptorTransformerObserver* observer_ = nullptr;
+  std::unique_ptr<rtc::Thread> thread_;
+  FrameCryptionState last_enc_error_ = FrameCryptionState::kNew;
+  FrameCryptionState last_dec_error_ = FrameCryptionState::kNew;
+};
+
+}  // namespace webrtc
+
+#endif  // WEBRTC_FRAME_CRYPTOR_TRANSFORMER_H_
diff --git a/api/frame_transformer_interface.h b/api/frame_transformer_interface.h
index 2f7b139f9f..b7c03da468 100644
--- a/api/frame_transformer_interface.h
+++ b/api/frame_transformer_interface.h
@@ -61,6 +61,8 @@ class TransformableVideoFrameInterface : public TransformableFrameInterface {
   virtual VideoFrameMetadata Metadata() const = 0;
 
   virtual void SetMetadata(const VideoFrameMetadata&) = 0;
+
+  virtual const RTPVideoHeader& header () const = 0;
 };
 
 // Extends the TransformableFrameInterface to expose audio-specific information.
diff --git a/audio/channel_receive.cc b/audio/channel_receive.cc
index e6435ad1b1..99405b1c78 100644
--- a/audio/channel_receive.cc
+++ b/audio/channel_receive.cc
@@ -357,7 +357,6 @@ void ChannelReceive::OnReceivedPayloadData(
 void ChannelReceive::InitFrameTransformerDelegate(
     rtc::scoped_refptr<webrtc::FrameTransformerInterface> frame_transformer) {
   RTC_DCHECK(frame_transformer);
-  RTC_DCHECK(!frame_transformer_delegate_);
   RTC_DCHECK(worker_thread_->IsCurrent());
 
   // Pass a callback to ChannelReceive::OnReceivedPayloadData, to be called by
@@ -920,11 +919,9 @@ void ChannelReceive::SetAssociatedSendChannel(
 void ChannelReceive::SetDepacketizerToDecoderFrameTransformer(
     rtc::scoped_refptr<webrtc::FrameTransformerInterface> frame_transformer) {
   RTC_DCHECK_RUN_ON(&worker_thread_checker_);
-  // Depending on when the channel is created, the transformer might be set
-  // twice. Don't replace the delegate if it was already initialized.
-  if (!frame_transformer || frame_transformer_delegate_) {
-    RTC_DCHECK_NOTREACHED() << "Not setting the transformer?";
-    return;
+
+  if(frame_transformer_delegate_ && frame_transformer) {
+    frame_transformer_delegate_->Reset();
   }
 
   InitFrameTransformerDelegate(std::move(frame_transformer));
diff --git a/modules/rtp_rtcp/source/rtp_sender_video_frame_transformer_delegate.cc b/modules/rtp_rtcp/source/rtp_sender_video_frame_transformer_delegate.cc
index 34b4af0ec9..6203ff57ff 100644
--- a/modules/rtp_rtcp/source/rtp_sender_video_frame_transformer_delegate.cc
+++ b/modules/rtp_rtcp/source/rtp_sender_video_frame_transformer_delegate.cc
@@ -78,6 +78,8 @@ class TransformableVideoSenderFrame : public TransformableVideoFrameInterface {
     csrcs_ = metadata.GetCsrcs();
   }
 
+  const RTPVideoHeader& header() const override { return header_; }
+
   const RTPVideoHeader& GetHeader() const { return header_; }
   uint8_t GetPayloadType() const override { return payload_type_; }
   absl::optional<VideoCodecType> GetCodecType() const { return codec_type_; }
diff --git a/modules/rtp_rtcp/source/rtp_video_stream_receiver_frame_transformer_delegate.cc b/modules/rtp_rtcp/source/rtp_video_stream_receiver_frame_transformer_delegate.cc
index 6e915bf758..394ff5f7a9 100644
--- a/modules/rtp_rtcp/source/rtp_video_stream_receiver_frame_transformer_delegate.cc
+++ b/modules/rtp_rtcp/source/rtp_video_stream_receiver_frame_transformer_delegate.cc
@@ -58,6 +58,10 @@ class TransformableVideoReceiverFrame
         << "TransformableVideoReceiverFrame::SetMetadata is not implemented";
   }
 
+  const RTPVideoHeader& header () const override {
+    return frame_->GetRtpVideoHeader();
+  }
+
   std::unique_ptr<RtpFrameObject> ExtractFrame() && {
     return std::move(frame_);
   }
diff --git a/pc/audio_rtp_receiver.cc b/pc/audio_rtp_receiver.cc
index 804d31352d..1f78574b9d 100644
--- a/pc/audio_rtp_receiver.cc
+++ b/pc/audio_rtp_receiver.cc
@@ -298,7 +298,7 @@ void AudioRtpReceiver::Reconfigure(bool track_enabled) {
     media_channel_->SetFrameDecryptor(*signaled_ssrc_, frame_decryptor_);
   }
 
-  if (frame_transformer_) {
+  if (frame_transformer_ && track_enabled) {
     media_channel_->SetDepacketizerToDecoderFrameTransformer(
         signaled_ssrc_.value_or(0), frame_transformer_);
   }
diff --git a/sdk/BUILD.gn b/sdk/BUILD.gn
index bfbfc33eaf..5fe0f67b63 100644
--- a/sdk/BUILD.gn
+++ b/sdk/BUILD.gn
@@ -1026,6 +1026,12 @@ if (is_ios || is_mac) {
         "objc/api/peerconnection/RTCDtmfSender.mm",
         "objc/api/peerconnection/RTCFieldTrials.h",
         "objc/api/peerconnection/RTCFieldTrials.mm",
+        "objc/api/peerconnection/RTCFrameCryptor+Private.h",
+        "objc/api/peerconnection/RTCFrameCryptor.h",
+        "objc/api/peerconnection/RTCFrameCryptor.mm",
+        "objc/api/peerconnection/RTCFrameCryptorKeyProvider+Private.h",
+        "objc/api/peerconnection/RTCFrameCryptorKeyProvider.h",
+        "objc/api/peerconnection/RTCFrameCryptorKeyProvider.mm",
         "objc/api/peerconnection/RTCIceCandidate+Private.h",
         "objc/api/peerconnection/RTCIceCandidate.h",
         "objc/api/peerconnection/RTCIceCandidate.mm",
@@ -1133,6 +1139,7 @@ if (is_ios || is_mac) {
         ":videorendereradapter_objc",
         ":videosource_objc",
         ":videotoolbox_objc",
+        "../api/crypto:frame_crypto_transformer",
         "../api:dtmf_sender_interface",
         "../api:libjingle_peerconnection_api",
         "../api:media_stream_interface",
@@ -1380,6 +1387,8 @@ if (is_ios || is_mac) {
           "objc/api/peerconnection/RTCConfiguration.h",
           "objc/api/peerconnection/RTCDataChannel.h",
           "objc/api/peerconnection/RTCDataChannelConfiguration.h",
+          "objc/api/peerconnection/RTCFrameCryptor.h",
+          "objc/api/peerconnection/RTCFrameCryptorKeyProvider.h",
           "objc/api/peerconnection/RTCFieldTrials.h",
           "objc/api/peerconnection/RTCIceCandidate.h",
           "objc/api/peerconnection/RTCIceCandidateErrorEvent.h",
@@ -1504,6 +1513,8 @@ if (is_ios || is_mac) {
           "objc/api/peerconnection/RTCDataChannel.h",
           "objc/api/peerconnection/RTCDataChannelConfiguration.h",
           "objc/api/peerconnection/RTCDtmfSender.h",
+          "objc/api/peerconnection/RTCFrameCryptor.h",
+          "objc/api/peerconnection/RTCFrameCryptorKeyProvider.h",
           "objc/api/peerconnection/RTCFieldTrials.h",
           "objc/api/peerconnection/RTCIceCandidate.h",
           "objc/api/peerconnection/RTCIceCandidateErrorEvent.h",
diff --git a/sdk/android/BUILD.gn b/sdk/android/BUILD.gn
index 73cfe51730..596dbc9693 100644
--- a/sdk/android/BUILD.gn
+++ b/sdk/android/BUILD.gn
@@ -261,6 +261,10 @@ if (is_android) {
       "api/org/webrtc/DataChannel.java",
       "api/org/webrtc/DtmfSender.java",
       "api/org/webrtc/FecControllerFactoryFactoryInterface.java",
+      "api/org/webrtc/FrameCryptor.java",
+      "api/org/webrtc/FrameCryptorAlgorithm.java",
+      "api/org/webrtc/FrameCryptorFactory.java",
+      "api/org/webrtc/FrameCryptorKeyProvider.java",
       "api/org/webrtc/FrameDecryptor.java",
       "api/org/webrtc/FrameEncryptor.java",
       "api/org/webrtc/IceCandidate.java",
@@ -719,6 +723,10 @@ if (current_os == "linux" || is_android) {
       "src/jni/pc/data_channel.cc",
       "src/jni/pc/data_channel.h",
       "src/jni/pc/dtmf_sender.cc",
+      "src/jni/pc/frame_cryptor.cc",
+      "src/jni/pc/frame_cryptor.h",
+      "src/jni/pc/frame_cryptor_key_provider.cc",
+      "src/jni/pc/frame_cryptor_key_provider.h",
       "src/jni/pc/ice_candidate.cc",
       "src/jni/pc/ice_candidate.h",
       "src/jni/pc/media_constraints.cc",
@@ -776,6 +784,7 @@ if (current_os == "linux" || is_android) {
       "../../api:rtp_parameters",
       "../../api:rtp_sender_interface",
       "../../api:turn_customizer",
+      "../../api/crypto:frame_crypto_transformer",
       "../../api/crypto:options",
       "../../api/rtc_event_log:rtc_event_log_factory",
       "../../api/task_queue:default_task_queue_factory",
@@ -1401,6 +1410,9 @@ if (current_os == "linux" || is_android) {
       "api/org/webrtc/CryptoOptions.java",
       "api/org/webrtc/DataChannel.java",
       "api/org/webrtc/DtmfSender.java",
+      "api/org/webrtc/FrameCryptor.java",
+      "api/org/webrtc/FrameCryptorFactory.java",
+      "api/org/webrtc/FrameCryptorKeyProvider.java",
       "api/org/webrtc/IceCandidate.java",
       "api/org/webrtc/IceCandidateErrorEvent.java",
       "api/org/webrtc/MediaConstraints.java",
diff --git a/sdk/android/api/org/webrtc/FrameCryptor.java b/sdk/android/api/org/webrtc/FrameCryptor.java
new file mode 100644
index 0000000000..d633e05005
--- /dev/null
+++ b/sdk/android/api/org/webrtc/FrameCryptor.java
@@ -0,0 +1,108 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.webrtc;
+
+import androidx.annotation.Nullable;
+
+public class FrameCryptor {
+  public enum FrameCryptionState {
+    NEW,
+    OK,
+    ENCRYPTIONFAILED,
+    DECRYPTIONFAILED,
+    MISSINGKEY,
+    KEYRATCHETED,
+    INTERNALERROR;
+
+    @CalledByNative("FrameCryptionState")
+    static FrameCryptionState fromNativeIndex(int nativeIndex) {
+      return values()[nativeIndex];
+    }
+  }
+
+  public static interface Observer {
+    @CalledByNative("Observer")
+    void onFrameCryptionStateChanged(String participantId, FrameCryptionState newState);
+  }
+
+  private long nativeFrameCryptor;
+  private long observerPtr;
+
+  public long getNativeFrameCryptor() {
+    return nativeFrameCryptor;
+  }
+
+  @CalledByNative
+  public FrameCryptor(long nativeFrameCryptor) {
+    this.nativeFrameCryptor = nativeFrameCryptor;
+    this.observerPtr = 0;
+  }
+
+  public void setEnabled(boolean enabled) {
+    checkFrameCryptorExists();
+    nativeSetEnabled(nativeFrameCryptor, enabled);
+  }
+
+  public boolean isEnabled() {
+    checkFrameCryptorExists();
+    return nativeIsEnabled(nativeFrameCryptor);
+  }
+
+  public int getKeyIndex() {
+    checkFrameCryptorExists();
+    return nativeGetKeyIndex(nativeFrameCryptor);
+  }
+
+  public void setKeyIndex(int index) {
+    checkFrameCryptorExists();
+    nativeSetKeyIndex(nativeFrameCryptor, index);
+  }
+
+  public void dispose() {
+    checkFrameCryptorExists();
+    nativeUnSetObserver(nativeFrameCryptor);
+    JniCommon.nativeReleaseRef(nativeFrameCryptor);
+    nativeFrameCryptor = 0;
+    if (observerPtr != 0) {
+      JniCommon.nativeReleaseRef(observerPtr);
+      observerPtr = 0;
+    }
+  }
+
+  public void setObserver(@Nullable Observer observer) {
+    checkFrameCryptorExists();
+    long newPtr = nativeSetObserver(nativeFrameCryptor, observer);
+    if (observerPtr != 0) {
+      JniCommon.nativeReleaseRef(observerPtr);
+      observerPtr = 0;
+    }
+    newPtr = observerPtr;
+  }
+
+  private void checkFrameCryptorExists() {
+    if (nativeFrameCryptor == 0) {
+      throw new IllegalStateException("FrameCryptor has been disposed.");
+    }
+  }
+
+  private static native void nativeSetEnabled(long frameCryptorPointer, boolean enabled);
+  private static native boolean nativeIsEnabled(long frameCryptorPointer);
+  private static native void nativeSetKeyIndex(long frameCryptorPointer, int index);
+  private static native int nativeGetKeyIndex(long frameCryptorPointer);
+  private static native long nativeSetObserver(long frameCryptorPointer, Observer observer);
+  private static native void nativeUnSetObserver(long frameCryptorPointer);
+}
diff --git a/sdk/android/api/org/webrtc/FrameCryptorAlgorithm.java b/sdk/android/api/org/webrtc/FrameCryptorAlgorithm.java
new file mode 100644
index 0000000000..d0d4dc8374
--- /dev/null
+++ b/sdk/android/api/org/webrtc/FrameCryptorAlgorithm.java
@@ -0,0 +1,22 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.webrtc;
+
+public enum FrameCryptorAlgorithm {
+  AES_GCM,
+  AES_CBC,
+}
\ No newline at end of file
diff --git a/sdk/android/api/org/webrtc/FrameCryptorFactory.java b/sdk/android/api/org/webrtc/FrameCryptorFactory.java
new file mode 100644
index 0000000000..74df6a5b29
--- /dev/null
+++ b/sdk/android/api/org/webrtc/FrameCryptorFactory.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.webrtc;
+
+public class FrameCryptorFactory {
+  public static FrameCryptorKeyProvider createFrameCryptorKeyProvider(
+      boolean sharedKey, byte[] ratchetSalt, int ratchetWindowSize, byte[] uncryptedMagicBytes) {
+    return nativeCreateFrameCryptorKeyProvider(sharedKey, ratchetSalt, ratchetWindowSize, uncryptedMagicBytes);
+  }
+
+  public static FrameCryptor createFrameCryptorForRtpSender(RtpSender rtpSender,
+      String participantId, FrameCryptorAlgorithm algorithm, FrameCryptorKeyProvider keyProvider) {
+    return nativeCreateFrameCryptorForRtpSender(rtpSender.getNativeRtpSender(), participantId,
+        algorithm.ordinal(), keyProvider.getNativeKeyProvider());
+  }
+
+  public static FrameCryptor createFrameCryptorForRtpReceiver(RtpReceiver rtpReceiver,
+      String participantId, FrameCryptorAlgorithm algorithm, FrameCryptorKeyProvider keyProvider) {
+    return nativeCreateFrameCryptorForRtpReceiver(rtpReceiver.getNativeRtpReceiver(), participantId,
+        algorithm.ordinal(), keyProvider.getNativeKeyProvider());
+  }
+
+  private static native FrameCryptor nativeCreateFrameCryptorForRtpSender(
+      long rtpSender, String participantId, int algorithm, long nativeFrameCryptorKeyProvider);
+  private static native FrameCryptor nativeCreateFrameCryptorForRtpReceiver(
+      long rtpReceiver, String participantId, int algorithm, long nativeFrameCryptorKeyProvider);
+
+  private static native FrameCryptorKeyProvider nativeCreateFrameCryptorKeyProvider(
+      boolean sharedKey, byte[] ratchetSalt, int ratchetWindowSize, byte[] uncryptedMagicBytes);
+}
diff --git a/sdk/android/api/org/webrtc/FrameCryptorKeyProvider.java b/sdk/android/api/org/webrtc/FrameCryptorKeyProvider.java
new file mode 100644
index 0000000000..1c89eac55b
--- /dev/null
+++ b/sdk/android/api/org/webrtc/FrameCryptorKeyProvider.java
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.webrtc;
+
+import java.util.ArrayList;
+
+public class FrameCryptorKeyProvider {
+  private long nativeKeyProvider;
+
+  @CalledByNative
+  public FrameCryptorKeyProvider(long nativeKeyProvider) {
+    this.nativeKeyProvider = nativeKeyProvider;
+  }
+
+  public long getNativeKeyProvider() {
+    return nativeKeyProvider;
+  }
+
+  public boolean setKey(String participantId, int index, byte[] key) {
+    checkKeyProviderExists();
+    return nativeSetKey(nativeKeyProvider, participantId, index, key);
+  }
+
+  public byte[] ratchetKey(String participantId, int index) {
+    checkKeyProviderExists();
+    return nativeRatchetKey(nativeKeyProvider, participantId, index);
+  }
+
+  public byte[] exportKey(String participantId, int index) {
+    checkKeyProviderExists();
+    return nativeExportKey(nativeKeyProvider, participantId, index);
+  }
+
+  public void dispose() {
+    checkKeyProviderExists();
+    JniCommon.nativeReleaseRef(nativeKeyProvider);
+    nativeKeyProvider = 0;
+  }
+
+  private void checkKeyProviderExists() {
+    if (nativeKeyProvider == 0) {
+      throw new IllegalStateException("FrameCryptorKeyProvider has been disposed.");
+    }
+  }
+
+  private static native boolean nativeSetKey(
+      long keyProviderPointer, String participantId, int index, byte[] key);
+  private static native byte[] nativeRatchetKey(
+      long keyProviderPointer, String participantId, int index);
+  private static native byte[] nativeExportKey(
+      long keyProviderPointer, String participantId, int index);
+}
\ No newline at end of file
diff --git a/sdk/android/src/jni/pc/frame_cryptor.cc b/sdk/android/src/jni/pc/frame_cryptor.cc
new file mode 100644
index 0000000000..d02f0c62da
--- /dev/null
+++ b/sdk/android/src/jni/pc/frame_cryptor.cc
@@ -0,0 +1,190 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "sdk/android/src/jni/pc/frame_cryptor.h"
+
+#include "api/rtp_receiver_interface.h"
+#include "api/rtp_sender_interface.h"
+#include "rtc_base/ref_counted_object.h"
+#include "sdk/android/generated_peerconnection_jni/FrameCryptorFactory_jni.h"
+#include "sdk/android/generated_peerconnection_jni/FrameCryptor_jni.h"
+#include "sdk/android/native_api/jni/java_types.h"
+#include "sdk/android/src/jni/jni_helpers.h"
+#include "sdk/android/src/jni/pc/frame_cryptor_key_provider.h"
+
+namespace webrtc {
+namespace jni {
+
+FrameCryptorObserverJni::FrameCryptorObserverJni(
+    JNIEnv* jni,
+    const JavaRef<jobject>& j_observer)
+    : j_observer_global_(jni, j_observer) {}
+
+FrameCryptorObserverJni::~FrameCryptorObserverJni() {}
+
+void FrameCryptorObserverJni::OnFrameCryptionStateChanged(
+    const std::string participant_id,
+    FrameCryptionState new_state) {
+  JNIEnv* env = AttachCurrentThreadIfNeeded();
+  Java_Observer_onFrameCryptionStateChanged(
+      env, j_observer_global_, NativeToJavaString(env, participant_id),
+      Java_FrameCryptionState_fromNativeIndex(env, new_state));
+}
+
+ScopedJavaLocalRef<jobject> NativeToJavaFrameCryptor(
+    JNIEnv* env,
+    rtc::scoped_refptr<FrameCryptorTransformer> cryptor) {
+  if (!cryptor)
+    return nullptr;
+  // Sender is now owned by the Java object, and will be freed from
+  // FrameCryptor.dispose().
+  return Java_FrameCryptor_Constructor(env,
+                                       jlongFromPointer(cryptor.release()));
+}
+
+static void JNI_FrameCryptor_SetEnabled(JNIEnv* jni,
+                                        jlong j_frame_cryptor_pointer,
+                                        jboolean j_enabled) {
+  reinterpret_cast<FrameCryptorTransformer*>(j_frame_cryptor_pointer)
+      ->SetEnabled(j_enabled);
+}
+
+static jboolean JNI_FrameCryptor_IsEnabled(JNIEnv* jni,
+                                           jlong j_frame_cryptor_pointer) {
+  return reinterpret_cast<FrameCryptorTransformer*>(j_frame_cryptor_pointer)
+      ->enabled();
+}
+
+static void JNI_FrameCryptor_SetKeyIndex(JNIEnv* jni,
+                                         jlong j_frame_cryptor_pointer,
+                                         jint j_index) {
+  reinterpret_cast<FrameCryptorTransformer*>(j_frame_cryptor_pointer)
+      ->SetKeyIndex(j_index);
+}
+
+static jint JNI_FrameCryptor_GetKeyIndex(JNIEnv* jni,
+                                         jlong j_frame_cryptor_pointer) {
+  return reinterpret_cast<FrameCryptorTransformer*>(j_frame_cryptor_pointer)
+      ->key_index();
+}
+
+static jlong JNI_FrameCryptor_SetObserver(
+    JNIEnv* jni,
+    jlong j_frame_cryptor_pointer,
+    const JavaParamRef<jobject>& j_observer) {
+  auto observer =
+      rtc::make_ref_counted<FrameCryptorObserverJni>(jni, j_observer);
+  observer->AddRef();
+  reinterpret_cast<FrameCryptorTransformer*>(j_frame_cryptor_pointer)
+      ->SetFrameCryptorTransformerObserver(observer.get());
+  return jlongFromPointer(observer.get());
+}
+
+static void JNI_FrameCryptor_UnSetObserver(JNIEnv* jni,
+                                           jlong j_frame_cryptor_pointer) {
+  reinterpret_cast<FrameCryptorTransformer*>(j_frame_cryptor_pointer)
+      ->SetFrameCryptorTransformerObserver(nullptr);
+}
+
+webrtc::FrameCryptorTransformer::Algorithm AlgorithmFromIndex(int index) {
+  switch (index) {
+    case 0:
+      return webrtc::FrameCryptorTransformer::Algorithm::kAesGcm;
+    case 1:
+      return webrtc::FrameCryptorTransformer::Algorithm::kAesCbc;
+    default:
+      return webrtc::FrameCryptorTransformer::Algorithm::kAesGcm;
+  }
+}
+
+static base::android::ScopedJavaLocalRef<jobject>
+JNI_FrameCryptorFactory_CreateFrameCryptorForRtpReceiver(
+    JNIEnv* env,
+    jlong j_rtp_receiver_pointer,
+    const base::android::JavaParamRef<jstring>& participantId,
+    jint j_algorithm_index,
+    jlong j_key_provider) {
+  auto keyProvider =
+      reinterpret_cast<webrtc::DefaultKeyProviderImpl*>(j_key_provider);
+  auto participant_id = JavaToStdString(env, participantId);
+  auto rtpReceiver =
+      reinterpret_cast<RtpReceiverInterface*>(j_rtp_receiver_pointer);
+  auto mediaType =
+      rtpReceiver->track()->kind() == "audio"
+          ? webrtc::FrameCryptorTransformer::MediaType::kAudioFrame
+          : webrtc::FrameCryptorTransformer::MediaType::kVideoFrame;
+  auto frame_crypto_transformer =
+      rtc::scoped_refptr<webrtc::FrameCryptorTransformer>(
+          new webrtc::FrameCryptorTransformer(
+              participant_id, mediaType, AlgorithmFromIndex(j_algorithm_index),
+              rtc::scoped_refptr<webrtc::KeyProvider>(keyProvider)));
+
+  rtpReceiver->SetDepacketizerToDecoderFrameTransformer(
+      frame_crypto_transformer);
+  frame_crypto_transformer->SetEnabled(false);
+
+  return NativeToJavaFrameCryptor(env, frame_crypto_transformer);
+}
+
+static base::android::ScopedJavaLocalRef<jobject>
+JNI_FrameCryptorFactory_CreateFrameCryptorForRtpSender(
+    JNIEnv* env,
+    jlong j_rtp_sender_pointer,
+    const base::android::JavaParamRef<jstring>& participantId,
+    jint j_algorithm_index,
+    jlong j_key_provider) {
+  auto keyProvider =
+      reinterpret_cast<webrtc::DefaultKeyProviderImpl*>(j_key_provider);
+  auto rtpSender = reinterpret_cast<RtpSenderInterface*>(j_rtp_sender_pointer);
+  auto participant_id = JavaToStdString(env, participantId);
+  auto mediaType =
+      rtpSender->track()->kind() == "audio"
+          ? webrtc::FrameCryptorTransformer::MediaType::kAudioFrame
+          : webrtc::FrameCryptorTransformer::MediaType::kVideoFrame;
+  auto frame_crypto_transformer =
+      rtc::scoped_refptr<webrtc::FrameCryptorTransformer>(
+          new webrtc::FrameCryptorTransformer(
+              participant_id, mediaType, AlgorithmFromIndex(j_algorithm_index),
+              rtc::scoped_refptr<webrtc::KeyProvider>(keyProvider)));
+
+  rtpSender->SetEncoderToPacketizerFrameTransformer(frame_crypto_transformer);
+  frame_crypto_transformer->SetEnabled(false);
+
+  return NativeToJavaFrameCryptor(env, frame_crypto_transformer);
+}
+
+static base::android::ScopedJavaLocalRef<jobject>
+JNI_FrameCryptorFactory_CreateFrameCryptorKeyProvider(
+    JNIEnv* env,
+    jboolean j_shared,
+    const base::android::JavaParamRef<jbyteArray>& j_ratchetSalt,
+    jint j_ratchetWindowSize,
+    const base::android::JavaParamRef<jbyteArray>& j_uncryptedMagicBytes) {
+  auto ratchetSalt = JavaToNativeByteArray(env, j_ratchetSalt);
+  KeyProviderOptions options;
+  options.ratchet_salt =
+      std::vector<uint8_t>(ratchetSalt.begin(), ratchetSalt.end());
+  options.ratchet_window_size = j_ratchetWindowSize;
+
+  auto uncryptedMagicBytes = JavaToNativeByteArray(env, j_uncryptedMagicBytes);
+  options.uncrypted_magic_bytes =
+      std::vector<uint8_t>(uncryptedMagicBytes.begin(), uncryptedMagicBytes.end());
+  options.shared_key = j_shared;
+  return NativeToJavaFrameCryptorKeyProvider(
+      env, rtc::make_ref_counted<webrtc::DefaultKeyProviderImpl>(options));
+}
+
+}  // namespace jni
+}  // namespace webrtc
diff --git a/sdk/android/src/jni/pc/frame_cryptor.h b/sdk/android/src/jni/pc/frame_cryptor.h
new file mode 100644
index 0000000000..66645bb33c
--- /dev/null
+++ b/sdk/android/src/jni/pc/frame_cryptor.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SDK_ANDROID_SRC_JNI_PC_FRAME_CRYPTOR_H_
+#define SDK_ANDROID_SRC_JNI_PC_FRAME_CRYPTOR_H_
+
+#include <jni.h>
+
+#include "api/crypto/frame_crypto_transformer.h"
+#include "sdk/android/native_api/jni/scoped_java_ref.h"
+
+namespace webrtc {
+namespace jni {
+
+ScopedJavaLocalRef<jobject> NativeToJavaFrameCryptor(
+    JNIEnv* env,
+    rtc::scoped_refptr<FrameCryptorTransformer> cryptor);
+
+class FrameCryptorObserverJni : public FrameCryptorTransformerObserver,
+                                public rtc::RefCountInterface {
+ public:
+  FrameCryptorObserverJni(JNIEnv* jni, const JavaRef<jobject>& j_observer);
+  ~FrameCryptorObserverJni() override;
+
+ protected:
+  void OnFrameCryptionStateChanged(const std::string participant_id,
+                                   FrameCryptionState state) override;
+
+ private:
+  const ScopedJavaGlobalRef<jobject> j_observer_global_;
+  const ScopedJavaGlobalRef<jobject> j_observer_;
+};
+
+}  // namespace jni
+}  // namespace webrtc
+
+#endif  // SDK_ANDROID_SRC_JNI_PC_FRAME_CRYPTOR_H_
diff --git a/sdk/android/src/jni/pc/frame_cryptor_key_provider.cc b/sdk/android/src/jni/pc/frame_cryptor_key_provider.cc
new file mode 100644
index 0000000000..2732693c0f
--- /dev/null
+++ b/sdk/android/src/jni/pc/frame_cryptor_key_provider.cc
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "sdk/android/src/jni/pc/frame_cryptor_key_provider.h"
+
+#include "sdk/android/generated_peerconnection_jni/FrameCryptorKeyProvider_jni.h"
+#include "sdk/android/native_api/jni/java_types.h"
+#include "sdk/android/src/jni/jni_helpers.h"
+
+namespace webrtc {
+namespace jni {
+
+ScopedJavaLocalRef<jobject> NativeToJavaFrameCryptorKeyProvider(
+    JNIEnv* env,
+    rtc::scoped_refptr<webrtc::DefaultKeyProviderImpl> key_provider) {
+  if (!key_provider)
+    return nullptr;
+  // Sender is now owned by the Java object, and will be freed from
+  // FrameCryptorKeyProvider.dispose().
+  return Java_FrameCryptorKeyProvider_Constructor(
+      env, jlongFromPointer(key_provider.release()));
+}
+
+static jboolean JNI_FrameCryptorKeyProvider_SetKey(
+    JNIEnv* jni,
+    jlong j_key_provider,
+    const base::android::JavaParamRef<jstring>& participantId,
+    jint j_index,
+    const base::android::JavaParamRef<jbyteArray>& j_key) {
+  auto key = JavaToNativeByteArray(jni, j_key);
+  auto participant_id = JavaToStdString(jni, participantId);
+  return reinterpret_cast<webrtc::DefaultKeyProviderImpl*>(j_key_provider)
+      ->SetKey(participant_id, j_index,
+               std::vector<uint8_t>(key.begin(), key.end()));
+}
+
+static base::android::ScopedJavaLocalRef<jbyteArray>
+JNI_FrameCryptorKeyProvider_RatchetKey(
+    JNIEnv* env,
+    jlong keyProviderPointer,
+    const base::android::JavaParamRef<jstring>& participantId,
+    jint j_index) {
+  auto participant_id = JavaToStdString(env, participantId);
+  auto key_provider =
+      reinterpret_cast<webrtc::DefaultKeyProviderImpl*>(keyProviderPointer);
+  auto newKey = key_provider->RatchetKey(participant_id, j_index);
+  std::vector<int8_t> int8tKey =
+      std::vector<int8_t>(newKey.begin(), newKey.end());
+  return NativeToJavaByteArray(env, rtc::ArrayView<int8_t>(int8tKey));
+}
+
+static base::android::ScopedJavaLocalRef<jbyteArray>
+JNI_FrameCryptorKeyProvider_ExportKey(
+    JNIEnv* env,
+    jlong keyProviderPointer,
+    const base::android::JavaParamRef<jstring>& participantId,
+    jint j_index) {
+  auto participant_id = JavaToStdString(env, participantId);
+  auto key_provider =
+      reinterpret_cast<webrtc::DefaultKeyProviderImpl*>(keyProviderPointer);
+  auto key = key_provider->ExportKey(participant_id, j_index);
+  std::vector<int8_t> int8tKey = std::vector<int8_t>(key.begin(), key.end());
+  return NativeToJavaByteArray(env, rtc::ArrayView<int8_t>(int8tKey));
+}
+
+}  // namespace jni
+}  // namespace webrtc
diff --git a/sdk/android/src/jni/pc/frame_cryptor_key_provider.h b/sdk/android/src/jni/pc/frame_cryptor_key_provider.h
new file mode 100644
index 0000000000..8832a83035
--- /dev/null
+++ b/sdk/android/src/jni/pc/frame_cryptor_key_provider.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SDK_ANDROID_SRC_JNI_PC_FRAME_CRYPTOR_KEY_PROVIDER_H_
+#define SDK_ANDROID_SRC_JNI_PC_FRAME_CRYPTOR_KEY_PROVIDER_H_
+
+#include <jni.h>
+
+#include "api/crypto/frame_crypto_transformer.h"
+#include "sdk/android/native_api/jni/scoped_java_ref.h"
+
+namespace webrtc {
+namespace jni {
+
+ScopedJavaLocalRef<jobject> NativeToJavaFrameCryptorKeyProvider(
+    JNIEnv* env,
+    rtc::scoped_refptr<webrtc::DefaultKeyProviderImpl> cryptor);
+
+}  // namespace jni
+}  // namespace webrtc
+
+#endif  // SDK_ANDROID_SRC_JNI_PC_FRAME_CRYPTOR_KEY_PROVIDER_H_
diff --git a/sdk/objc/api/peerconnection/RTCFrameCryptor+Private.h b/sdk/objc/api/peerconnection/RTCFrameCryptor+Private.h
new file mode 100644
index 0000000000..86e6fdff8c
--- /dev/null
+++ b/sdk/objc/api/peerconnection/RTCFrameCryptor+Private.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import "RTCFrameCryptor.h"
+
+#include <string>
+#include "api/crypto/frame_crypto_transformer.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface RTC_OBJC_TYPE (RTCFrameCryptor)
+()
+
+    @end
+
+namespace webrtc {
+
+class RTCFrameCryptorDelegateAdapter : public FrameCryptorTransformerObserver {
+ public:
+  RTCFrameCryptorDelegateAdapter(RTC_OBJC_TYPE(RTCFrameCryptor) * frameCryptor);
+  ~RTCFrameCryptorDelegateAdapter() override;
+
+  void OnFrameCryptionStateChanged(const std::string participant_id,
+                                   FrameCryptionState state) override;
+
+ private:
+  __weak RTC_OBJC_TYPE(RTCFrameCryptor) * frame_cryptor_;
+};
+
+}  // namespace webrtc
+
+NS_ASSUME_NONNULL_END
diff --git a/sdk/objc/api/peerconnection/RTCFrameCryptor.h b/sdk/objc/api/peerconnection/RTCFrameCryptor.h
new file mode 100644
index 0000000000..6712ca3688
--- /dev/null
+++ b/sdk/objc/api/peerconnection/RTCFrameCryptor.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import <Foundation/Foundation.h>
+
+#import "RTCMacros.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@class RTC_OBJC_TYPE(RTCRtpSender);
+@class RTC_OBJC_TYPE(RTCRtpReceiver);
+@class RTC_OBJC_TYPE(RTCFrameCryptorKeyProvider);
+@class RTC_OBJC_TYPE(RTCFrameCryptor);
+
+typedef NS_ENUM(NSUInteger, RTCCyrptorAlgorithm) {
+  RTCCyrptorAlgorithmAesGcm = 0,
+  RTCCyrptorAlgorithmAesCbc,
+};
+
+typedef NS_ENUM(NSInteger, FrameCryptionState) {
+  FrameCryptionStateNew = 0,
+  FrameCryptionStateOk,
+  FrameCryptionStateEncryptionFailed,
+  FrameCryptionStateDecryptionFailed,
+  FrameCryptionStateMissingKey,
+  FrameCryptionStateKeyRatcheted,
+  FrameCryptionStateInternalError,
+};
+
+RTC_OBJC_EXPORT
+@protocol RTC_OBJC_TYPE
+(RTCFrameCryptorDelegate)<NSObject>
+    /** Called when the RTCFrameCryptor got errors. */
+    - (void)frameCryptor
+    : (RTC_OBJC_TYPE(RTCFrameCryptor) *)frameCryptor didStateChangeWithParticipantId
+    : (NSString *)participantId withState : (FrameCryptionState)stateChanged;
+@end
+
+RTC_OBJC_EXPORT
+@interface RTC_OBJC_TYPE (RTCFrameCryptor) : NSObject
+
+@property(nonatomic, assign) BOOL enabled;
+
+@property(nonatomic, assign) int keyIndex;
+
+@property(nonatomic, readonly) NSString *participantId;
+
+@property(nonatomic, weak, nullable) id<RTC_OBJC_TYPE(RTCFrameCryptorDelegate)> delegate;
+
+- (instancetype)initWithRtpSender:(RTC_OBJC_TYPE(RTCRtpSender) *)sender
+                    participantId:(NSString *)participantId
+                        algorithm:(RTCCyrptorAlgorithm)algorithm
+                       keyProvider:(RTC_OBJC_TYPE(RTCFrameCryptorKeyProvider) *)keyProvider;
+
+- (instancetype)initWithRtpReceiver:(RTC_OBJC_TYPE(RTCRtpReceiver) *)receiver
+                      participantId:(NSString *)participantId
+                          algorithm:(RTCCyrptorAlgorithm)algorithm
+                         keyProvider:(RTC_OBJC_TYPE(RTCFrameCryptorKeyProvider) *)keyProvider;
+
+@end
+
+NS_ASSUME_NONNULL_END
diff --git a/sdk/objc/api/peerconnection/RTCFrameCryptor.mm b/sdk/objc/api/peerconnection/RTCFrameCryptor.mm
new file mode 100644
index 0000000000..312331f72d
--- /dev/null
+++ b/sdk/objc/api/peerconnection/RTCFrameCryptor.mm
@@ -0,0 +1,182 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import "RTCFrameCryptor+Private.h"
+#import "RTCFrameCryptorKeyProvider+Private.h"
+#import "RTCRtpReceiver+Private.h"
+#import "RTCRtpSender+Private.h"
+
+#include <memory>
+
+#import "base/RTCLogging.h"
+#import "helpers/NSString+StdString.h"
+
+#include "api/crypto/frame_crypto_transformer.h"
+#include "api/rtp_receiver_interface.h"
+#include "api/rtp_sender_interface.h"
+
+namespace webrtc {
+
+RTCFrameCryptorDelegateAdapter::RTCFrameCryptorDelegateAdapter(RTC_OBJC_TYPE(RTCFrameCryptor) *
+                                                               frameCryptor)
+    : frame_cryptor_(frameCryptor) {}
+
+RTCFrameCryptorDelegateAdapter::~RTCFrameCryptorDelegateAdapter() {}
+
+/*
+  kNew = 0,
+  kOk,
+  kEncryptionFailed,
+  kDecryptionFailed,
+  kMissingKey,
+  kInternalError,
+*/
+void RTCFrameCryptorDelegateAdapter::OnFrameCryptionStateChanged(const std::string participant_id,
+                                                                 FrameCryptionState state) {
+  RTC_OBJC_TYPE(RTCFrameCryptor) *frameCryptor = frame_cryptor_;
+  if (frameCryptor.delegate) {
+    switch (state) {
+      case FrameCryptionState::kNew:
+        [frameCryptor.delegate frameCryptor:frameCryptor
+            didStateChangeWithParticipantId:[NSString stringForStdString:participant_id]
+                                  withState:FrameCryptionStateNew];
+        break;
+      case FrameCryptionState::kOk:
+        [frameCryptor.delegate frameCryptor:frameCryptor
+            didStateChangeWithParticipantId:[NSString stringForStdString:participant_id]
+                                  withState:FrameCryptionStateOk];
+        break;
+      case FrameCryptionState::kEncryptionFailed:
+        [frameCryptor.delegate frameCryptor:frameCryptor
+            didStateChangeWithParticipantId:[NSString stringForStdString:participant_id]
+                                  withState:FrameCryptionStateEncryptionFailed];
+        break;
+      case FrameCryptionState::kDecryptionFailed:
+        [frameCryptor.delegate frameCryptor:frameCryptor
+            didStateChangeWithParticipantId:[NSString stringForStdString:participant_id]
+                                  withState:FrameCryptionStateDecryptionFailed];
+        break;
+      case FrameCryptionState::kMissingKey:
+        [frameCryptor.delegate frameCryptor:frameCryptor
+            didStateChangeWithParticipantId:[NSString stringForStdString:participant_id]
+                                  withState:FrameCryptionStateMissingKey];
+        break;
+      case FrameCryptionState::kKeyRatcheted:
+        [frameCryptor.delegate frameCryptor:frameCryptor
+            didStateChangeWithParticipantId:[NSString stringForStdString:participant_id]
+                                  withState:FrameCryptionStateKeyRatcheted];
+        break;
+      case FrameCryptionState::kInternalError:
+        [frameCryptor.delegate frameCryptor:frameCryptor
+            didStateChangeWithParticipantId:[NSString stringForStdString:participant_id]
+                                  withState:FrameCryptionStateInternalError];
+        break;
+    }
+  }
+}
+}  // namespace webrtc
+
+@implementation RTC_OBJC_TYPE (RTCFrameCryptor) {
+  const webrtc::RtpSenderInterface *_sender;
+  const webrtc::RtpReceiverInterface *_receiver;
+  NSString *_participantId;
+  rtc::scoped_refptr<webrtc::FrameCryptorTransformer> frame_crypto_transformer_;
+  std::unique_ptr<webrtc::RTCFrameCryptorDelegateAdapter> _observer;
+}
+
+@synthesize participantId = _participantId;
+@synthesize delegate = _delegate;
+
+- (webrtc::FrameCryptorTransformer::Algorithm)algorithmFromEnum:(RTCCyrptorAlgorithm)algorithm {
+  switch (algorithm) {
+    case RTCCyrptorAlgorithmAesGcm:
+      return webrtc::FrameCryptorTransformer::Algorithm::kAesGcm;
+    case RTCCyrptorAlgorithmAesCbc:
+      return webrtc::FrameCryptorTransformer::Algorithm::kAesCbc;
+    default:
+      return webrtc::FrameCryptorTransformer::Algorithm::kAesGcm;
+  }
+}
+
+- (instancetype)initWithRtpSender:(RTC_OBJC_TYPE(RTCRtpSender) *)sender
+                    participantId:(NSString *)participantId
+                        algorithm:(RTCCyrptorAlgorithm)algorithm
+                       keyProvider:(RTC_OBJC_TYPE(RTCFrameCryptorKeyProvider) *)keyProvider {
+  if (self = [super init]) {
+    _observer.reset(new webrtc::RTCFrameCryptorDelegateAdapter(self));
+    _participantId = participantId;
+    auto rtpSender = sender.nativeRtpSender;
+    auto mediaType = rtpSender->track()->kind() == "audio" ?
+        webrtc::FrameCryptorTransformer::MediaType::kAudioFrame :
+        webrtc::FrameCryptorTransformer::MediaType::kVideoFrame;
+    frame_crypto_transformer_ = rtc::scoped_refptr<webrtc::FrameCryptorTransformer>(
+        new webrtc::FrameCryptorTransformer([participantId stdString],
+                                            mediaType,
+                                            [self algorithmFromEnum:algorithm],
+                                            keyProvider.nativeKeyProvider));
+
+    rtpSender->SetEncoderToPacketizerFrameTransformer(frame_crypto_transformer_);
+    frame_crypto_transformer_->SetEnabled(false);
+    frame_crypto_transformer_->SetFrameCryptorTransformerObserver(_observer.get());
+  }
+  return self;
+}
+
+- (instancetype)initWithRtpReceiver:(RTC_OBJC_TYPE(RTCRtpReceiver) *)receiver
+                      participantId:(NSString *)participantId
+                          algorithm:(RTCCyrptorAlgorithm)algorithm
+                         keyProvider:(RTC_OBJC_TYPE(RTCFrameCryptorKeyProvider) *)keyProvider {
+  if (self = [super init]) {
+    _observer.reset(new webrtc::RTCFrameCryptorDelegateAdapter(self));
+    _participantId = participantId;
+    auto rtpReceiver = receiver.nativeRtpReceiver;
+    auto mediaType = rtpReceiver->track()->kind() == "audio" ?
+        webrtc::FrameCryptorTransformer::MediaType::kAudioFrame :
+        webrtc::FrameCryptorTransformer::MediaType::kVideoFrame;
+    frame_crypto_transformer_ = rtc::scoped_refptr<webrtc::FrameCryptorTransformer>(
+        new webrtc::FrameCryptorTransformer([participantId stdString],
+                                            mediaType,
+                                            [self algorithmFromEnum:algorithm],
+                                            keyProvider.nativeKeyProvider));
+
+    rtpReceiver->SetDepacketizerToDecoderFrameTransformer(frame_crypto_transformer_);
+    frame_crypto_transformer_->SetEnabled(false);
+    frame_crypto_transformer_->SetFrameCryptorTransformerObserver(_observer.get());
+  }
+  return self;
+}
+
+- (BOOL)enabled {
+  return frame_crypto_transformer_->enabled();
+}
+
+- (void)setEnabled:(BOOL)enabled {
+  frame_crypto_transformer_->SetEnabled(enabled);
+}
+
+- (int)keyIndex {
+  return frame_crypto_transformer_->key_index();
+}
+
+- (void)setKeyIndex:(int)keyIndex {
+  frame_crypto_transformer_->SetKeyIndex(keyIndex);
+}
+
+- (void)dealloc {
+  frame_crypto_transformer_->SetFrameCryptorTransformerObserver(nullptr);
+}
+
+@end
diff --git a/sdk/objc/api/peerconnection/RTCFrameCryptorKeyProvider+Private.h b/sdk/objc/api/peerconnection/RTCFrameCryptorKeyProvider+Private.h
new file mode 100644
index 0000000000..eb7c83e2e7
--- /dev/null
+++ b/sdk/objc/api/peerconnection/RTCFrameCryptorKeyProvider+Private.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import "RTCFrameCryptorKeyProvider.h"
+
+#include "api/crypto/frame_crypto_transformer.h"
+#include "rtc_base/ref_count.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface RTC_OBJC_TYPE (RTCFrameCryptorKeyProvider)
+()
+
+    @property(nonatomic, readonly) rtc::scoped_refptr<webrtc::KeyProvider> nativeKeyProvider;
+
+@end
+
+NS_ASSUME_NONNULL_END
diff --git a/sdk/objc/api/peerconnection/RTCFrameCryptorKeyProvider.h b/sdk/objc/api/peerconnection/RTCFrameCryptorKeyProvider.h
new file mode 100644
index 0000000000..276b2e730c
--- /dev/null
+++ b/sdk/objc/api/peerconnection/RTCFrameCryptorKeyProvider.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import <Foundation/Foundation.h>
+
+#import "RTCMacros.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+RTC_OBJC_EXPORT
+@interface RTC_OBJC_TYPE (RTCFrameCryptorKeyProvider) : NSObject
+
+- (void)setKey:(NSData *)key withIndex:(int)index forParticipant:(NSString *)participantId;
+
+- (NSData *)ratchetKey:(NSString *)participantId withIndex:(int)index;
+
+- (NSData *)exportKey:(NSString *)participantId withIndex:(int)index;
+
+- (instancetype)initWithRatchetSalt:(NSData *)salt
+                  ratchetWindowSize:(int)windowSize
+                      sharedKeyMode:(BOOL)sharedKey
+                uncryptedMagicBytes:(nullable NSData *)uncryptedMagicBytes;
+
+@end
+
+NS_ASSUME_NONNULL_END
diff --git a/sdk/objc/api/peerconnection/RTCFrameCryptorKeyProvider.mm b/sdk/objc/api/peerconnection/RTCFrameCryptorKeyProvider.mm
new file mode 100644
index 0000000000..c27e18975b
--- /dev/null
+++ b/sdk/objc/api/peerconnection/RTCFrameCryptorKeyProvider.mm
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2022 LiveKit
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#import "RTCFrameCryptorKeyProvider+Private.h"
+
+#include <memory>
+#include "api/crypto/frame_crypto_transformer.h"
+
+#import "base/RTCLogging.h"
+#import "helpers/NSString+StdString.h"
+
+@implementation RTC_OBJC_TYPE (RTCFrameCryptorKeyProvider) {
+  rtc::scoped_refptr<webrtc::DefaultKeyProviderImpl> _nativeKeyProvider;
+}
+
+- (rtc::scoped_refptr<webrtc::KeyProvider>)nativeKeyProvider {
+  return _nativeKeyProvider;
+}
+
+- (instancetype)initWithRatchetSalt:(NSData *)salt
+                  ratchetWindowSize:(int)windowSize
+                      sharedKeyMode:(BOOL)sharedKey
+                uncryptedMagicBytes:(NSData *)uncryptedMagicBytes {
+  if (self = [super init]) {
+    webrtc::KeyProviderOptions options;
+    options.ratchet_salt = std::vector<uint8_t>((const uint8_t *)salt.bytes,
+                                                ((const uint8_t *)salt.bytes) + salt.length);
+    options.ratchet_window_size = windowSize;
+    options.shared_key = sharedKey;
+    if(uncryptedMagicBytes != nil) {
+      options.uncrypted_magic_bytes = std::vector<uint8_t>((const uint8_t *)uncryptedMagicBytes.bytes,
+                                                          ((const uint8_t *)uncryptedMagicBytes.bytes) + uncryptedMagicBytes.length);
+    }
+    _nativeKeyProvider = rtc::make_ref_counted<webrtc::DefaultKeyProviderImpl>(options);
+  }
+  return self;
+}
+
+- (void)setKey:(NSData *)key withIndex:(int)index forParticipant:(NSString *)participantId {
+  _nativeKeyProvider->SetKey(
+      [participantId stdString],
+      index,
+      std::vector<uint8_t>((const uint8_t *)key.bytes, ((const uint8_t *)key.bytes) + key.length));
+}
+
+- (NSData *)ratchetKey:(NSString *)participantId withIndex:(int)index {
+  std::vector<uint8_t> nativeKey = _nativeKeyProvider->RatchetKey([participantId stdString], index);
+  return [NSData dataWithBytes:nativeKey.data() length:nativeKey.size()];
+}
+
+- (NSData *)exportKey:(NSString *)participantId withIndex:(int)index {
+  std::vector<uint8_t> nativeKey = _nativeKeyProvider->ExportKey([participantId stdString], index);
+  return [NSData dataWithBytes:nativeKey.data() length:nativeKey.size()];
+}
+
+@end
diff --git a/sdk/objc/native/src/objc_video_track_source.mm b/sdk/objc/native/src/objc_video_track_source.mm
index 51b4d4e6b4..7937e90505 100644
--- a/sdk/objc/native/src/objc_video_track_source.mm
+++ b/sdk/objc/native/src/objc_video_track_source.mm
@@ -37,7 +37,7 @@ - (void)capturer:(RTC_OBJC_TYPE(RTCVideoCapturer) *)capturer
 ObjCVideoTrackSource::ObjCVideoTrackSource() : ObjCVideoTrackSource(false) {}
 
 ObjCVideoTrackSource::ObjCVideoTrackSource(bool is_screencast)
-    : AdaptedVideoTrackSource(/* required resolution alignment */ is_screencast? 16 : 2),
+    : AdaptedVideoTrackSource(/* required resolution alignment */ 2),
       is_screencast_(is_screencast) {}
 
 ObjCVideoTrackSource::ObjCVideoTrackSource(RTCObjCVideoSourceAdapter *adapter) : adapter_(adapter) {