[FFmpeg-devel] About SAMPLE-AES encryption for m3u8

[Eran Kornblau]

> Been trying to figure out how to decrypt SAMPLE-AES and eventually hit an issue with my lack of understanding how H264 and ffmpeg work.
> 
> Example
> 
> https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fd3iki3eydrtvsa.cloudfront.net%2FChernobyl_20200618213021%2FHLS%2FChernobyl_20200618213021_360.m3u8&data=02%7C01%7Ceran.kornblau%40kaltura.com%7C6b231576b6b547753d7208d815406a65%7C0c503748de3f4e2597e26819d53a42b6%7C0%7C0%7C637282713691576600&sdata=ofJoFI7Ly%2BsUMG1S1UOZ1L%2FwwcMYfmkUsf3J0Rx7%2B6M%3D&reserved=0
> 
> (might be georestricted)
> 
> This is what it looks like
> 
> #EXTM3U
> #EXT-X-VERSION:5
> #EXT-X-TARGETDURATION:10
> #EXT-X-MEDIA-SEQUENCE:1
> #EXT-X-PLAYLIST-TYPE:VOD
> #EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://eyJDb250ZW50SWQiOiI5ODFjNmZmOC1jOTRiLTRmYTUtODY2Mi0zYmM2NmFkNWRjOTgiLCJLZXlJZCI6ImQzNWE2OWQ5LWIzYTItNGJjMC04MDQyLWQ2YTJiODVhODkzZCIsIklWIjoiQUFBQUFBQUFBQUFBQUFBQUFBQUFBQT09In0=",KEYFORMAT="com.apple.streamingkeydelivery",IV=0x00000000000000000000000000000000
> #EXTINF:10,
> Chernobyl_20200618213021_360_00001.ts
> 
> and so on.
> 
> I think the skd:// actually contains all it is needed to decrypt.
>
No, that is incorrect, KEYFORMAT="com.apple.streamingkeydelivery" means Apple FairPlay DRM.
In this case, the skd contains the keyId which, as the name suggests, is an identifier representing the encryption key,
but it is not the key itself.
The key can only be retrieved by sending a license request to some DRM server that holds this key.
If the license request is valid, the DRM server will return the key securely inside a license response.

But anyway, the bottom line is that the main goals of DRM are to prevent exactly what you're trying to do - 
prevent you from getting access to the content encryption key and/or the decrypted content. 
So, what you're trying to do, is very hard... (and that is putting aside the legal aspects of it...)

Eran