The Principle of Common Encryption
Prior to standardized Common Encryption (CENC), distributing secured video required encrypting and storing distinct media files for each proprietary DRM system. Today, standard AES-128 cryptographic algorithms allow a single encrypted video stream to be decrypted across different platforms using system-native Key System Modules.
1. ISO/IEC 23001-7 Common Encryption (CENC) Architecture
CENC standardizes how video and audio payloads inside ISOBMFF containers are protected. Encryption is applied at the sample level using AES 128-bit keys, leaving file container headers, codec metadata, and timing tracks in plaintext to facilitate transparent CDN routing and player inspection.
The standard specifies two primary cipher modes:
- 'cenc' Mode (AES-CTR): Counter mode encryption. Historically adopted by MPEG-DASH ecosystems, Google Widevine, and Microsoft PlayReady. CTR mode enables parallelized multithreaded block decryption and arbitrary seek access.
- 'cbcs' Mode (AES-CBC with 10% pattern protection): Cipher Block Chaining mode where 1 in every 10 blocks is encrypted while the remaining 9 are skipped in uncompressed video frames. Apple FairPlay Streaming mandates 'cbcs'. Modern versions of Widevine and PlayReady have converged to support 'cbcs', allowing a single set of encrypted fragments to serve all major consumer devices.
2. The W3C Encrypted Media Extensions (EME) Stack
In web browsers, content protection executes without plugins via the Encrypted Media Extensions (EME) JavaScript API. The workflow coordinates several distinct system components:
- HTMLMediaElement: The standard HTML5 video tag handles media decoding and presentation.
- Content Decryption Module (CDM): A secure, sandboxed hardware or software environment provided by the operating system or browser vendor. JavaScript code cannot directly access the CDM's internal memory or inspect decrypted audio/video buffers.
- Key System: Proprietary modules identified by reverse-DNS identifiers (e.g.,
com.widevine.alpha,com.apple.fps,com.microsoft.playready). - License Exchange: When an encrypted fragment containing a
pssh(Protection System Specific Header) box is encountered, the player generates an encrypted key request payload, dispatches it to a multi-DRM license server, receives an encrypted license token, and feeds it into the CDM to initiate hardware decryption.
3. Hardware vs. Software Security Levels
Content rights holders require different security compliance tiers depending on content resolution and commercial licensing value:
| DRM System | Security Tier | Decryption Environment | Permitted Resolution |
|---|---|---|---|
| Widevine | Level 1 (L1) | Hardware TEE (Trusted Execution Environment) | 4K UHD, HDR, Premium Early-Window |
| Widevine | Level 3 (L3) | Software Host OS Memory (Userspace) | Standard Definition (SD) / 720p maximum |
| FairPlay | Secure Enclave | Apple Silicon Hardware Crypto Engine | Full Resolution (4K Dolby Vision) |
| PlayReady | SL3000 | Dedicated Hardware TEE / Secure Microcode | Full 4K Ultra-HD Tier |
4. Key Rotation and Session Management
For high-value live events such as championship sporting matches, relying on a single static encryption key across an entire three-hour broadcast introduces vulnerabilities. If a decryption key is compromised, the entire stream can be ripped and redistributed.
Enterprise streaming platforms implement dynamic key rotation. The packager derives a new AES-128 encryption key every 5 to 15 minutes. The media manifest signals upcoming key rotation events using tagged sequence markers. Client players establish asynchronous background worker connections to license servers to pre-fetch incoming key pairs without disrupting active video decoding pipelines.
5. Forensic Watermarking and Leak Attribution
While DRM prevents unauthorized recording at the player layer, it cannot prevent physical re-recording of television screens or capture card HDMI exploitation on compromised HDCP chains. To deter piracy, streaming architects integrate session-based forensic watermarking.
Two approaches are commonly deployed: client-side graphics composition (rendering invisible or steganographic luminance variations into random frame sequences) and A/B server-side watermarking. In A/B watermarking, two variants of each video chunk are encoded with imperceptible mathematical differences. By steering individual viewer sessions to unique sequences of Variant A and Variant B chunks, security teams extract a unique identifier from pirated streams to pinpoint the compromised account.