Article: How to secure Apple HTTP Live Streaming (AES-128 - external method)

Richard_Lanham · September 9, 2020, 8:43pm

Thanks for the update, Abed.

Richard

Richard_Lanham · September 9, 2020, 8:44pm

Do you have SSL configured?

It might help you to add the Access-Control-Allow-Origin http header by adding this to the Application.xml /HTTPStreamer Properties container:

<Property>
	<Name>cupertinoUserHTTPHeaders</Name>
	<Value>Access-Control-Allow-Origin: *</Value>
</Property>

Richard

Richard_Lanham · September 9, 2020, 9:50pm

This is a duplicate, Sanjeev

Jake_Hilton · September 9, 2020, 8:45pm

Indika,

You can also look at this discussion I started here: http://www.wowza.com/forums/showthread.php?10236-iPhone-authentication-for-vod-stream&highlight=

It discusses a way to secure streams down without generating a key for each one. Start on page 3.

Jake

Julien_Jabouin · September 9, 2020, 8:46pm

Hi,

I wonder what parameters should be passed to genkey if I want to have AES encryption for smil that contains several live streams:
http://[wowza-address]:1935/hls/smil:multistream.smil/playlist.m3u8
genkey iphone multistream.smil [key-url] ??
or do I have to create separate key for each stream?

Best!

@mcaron, did you find how to proceed ?

Julien_Jabouin · September 9, 2020, 8:46pm

It has to be done for each stream in the smil. You don’t do it for the smil itself, which is just a text file the playback client uses to know what streams are available.

Richard

Ok, so i need to create a key for each video ?

Not the possibility to have 1 key for all videos for the same application ?

Costel_Radulescu · September 9, 2020, 9:52pm

Hello,

I followed this example: iPhone/iPad iOS - (AES-128-external-method) and it worked great for the VOD application, but I’m having trouble getting it to work for a liverepeater-edge application

Application.xml - configuration

<Root>
	<Application>
		<!-- Uncomment to set application level timeout values
		<ApplicationTimeout>60000</ApplicationTimeout>
		<PingTimeout>12000</PingTimeout>
		<ValidationFrequency>8000</ValidationFrequency>
		<MaximumPendingWriteBytes>0</MaximumPendingWriteBytes>
		<MaximumSetBufferTime>60000</MaximumSetBufferTime>
		<MaximumStorageDirDepth>25</MaximumStorageDirDepth>
		-->
		<Connections>
			<AutoAccept>true</AutoAccept>
			<AllowDomains></AllowDomains>
		</Connections>
		<!--
			StorageDir path variables
			
			${com.wowza.wms.AppHome} - Application home directory
			${com.wowza.wms.ConfigHome} - Configuration home directory
			${com.wowza.wms.context.VHost} - Virtual host name
			${com.wowza.wms.context.VHostConfigHome} - Virtual host config directory
			${com.wowza.wms.context.Application} - Application name
			${com.wowza.wms.context.ApplicationInstance} - Application instance name
			
		-->
		<Streams>
			<StreamType>liverepeater-edge</StreamType>
			<StorageDir>${com.wowza.wms.context.VHostConfigHome}/content</StorageDir>
			<KeyDir>${com.wowza.wms.context.VHostConfigHome}/keys/${com.wowza.wms.context.Application}/${com.wowza.wms.context.ApplicationInstance}</KeyDir>
			<!-- LiveStreamPacketizers (separate with commas): cupertinostreamingpacketizer, smoothstreamingpacketizer, cupertinostreamingrepeater, smoothstreamingrepeater -->
			<LiveStreamPacketizers>cupertinostreamingrepeater</LiveStreamPacketizers>
			<!-- Properties defined here will override any properties defined in conf/Streams.xml for any streams types loaded by this application -->
			<Properties>
			</Properties>
		</Streams>
		<!-- HTTPStreamers (separate with commas): cupertinostreaming, smoothstreaming -->
		<HTTPStreamers>cupertinostreaming</HTTPStreamers>
		<SharedObjects>
			<StorageDir></StorageDir>
		</SharedObjects>
		<Client>
			<IdleFrequency>-1</IdleFrequency>
			<Access>
				<StreamReadAccess>*</StreamReadAccess>
				<StreamWriteAccess>*</StreamWriteAccess>
				<StreamAudioSampleAccess></StreamAudioSampleAccess>
				<StreamVideoSampleAccess></StreamVideoSampleAccess>
				<SharedObjectReadAccess>*</SharedObjectReadAccess>
				<SharedObjectWriteAccess>*</SharedObjectWriteAccess>
			</Access>
		</Client>
		<RTP>
			<!-- RTP/Authentication/[type]Methods defined in Authentication.xml. Default setup includes; none, basic, digest -->
			<Authentication>
				<PublishMethod>none</PublishMethod>
				<PlayMethod>digest</PlayMethod>
			</Authentication>
			<!-- RTP/AVSyncMethod. Valid values are: senderreport, systemclock, rtptimecode -->
			<AVSyncMethod>senderreport</AVSyncMethod>
			<MaxRTCPWaitTime>12000</MaxRTCPWaitTime>
			<IdleFrequency>75</IdleFrequency>
			<RTSPSessionTimeout>90000</RTSPSessionTimeout>
			<RTSPMaximumPendingWriteBytes>0</RTSPMaximumPendingWriteBytes>
			<RTSPBindIpAddress>[edge-address]</RTSPBindIpAddress>
			<RTSPConnectionIpAddress>[edge-address]</RTSPConnectionIpAddress>
			<RTSPOriginIpAddress>[edge-address]</RTSPOriginIpAddress>
			<IncomingDatagramPortRanges>*</IncomingDatagramPortRanges>
			<!-- Properties defined here will override any properties defined in conf/RTP.xml for any depacketizers loaded by this application -->
			<Properties>
			</Properties>
		</RTP>
		<MediaCaster>
			<!-- Properties defined here will override any properties defined in conf/MediaCasters.xml for any MediaCasters loaded by this applications -->
			<Properties>
			</Properties>
		</MediaCaster>
		<MediaReader>
			<!-- Properties defined here will override any properties defined in conf/MediaReaders.xml for any MediaReaders loaded by this applications -->
			<Properties>
			</Properties>
		</MediaReader>
		<MediaWriter>
			<!-- Properties defined here will override any properties defined in conf/MediaWriter.xml for any MediaWriter loaded by this applications -->
			<Properties>
			</Properties>
		</MediaWriter>
		<LiveStreamPacketizer>
			<!-- Properties defined here will override any properties defined in conf/LiveStreamPacketizers.xml for any LiveStreamPacketizers loaded by this applications -->
			<Properties>
				<Property>
					<Name>forceH264BaselineProfile</Name>
					<Value>true</Value>
					<Type>Boolean</Type>
				</Property>
			</Properties>
		</LiveStreamPacketizer>
		<HTTPStreamer>
			<!-- Properties defined here will override any properties defined in conf/HTTPStreamers.xml for any HTTPStreamer loaded by this applications -->
			<Properties>
			</Properties>
		</HTTPStreamer>
		<Repeater>
			<OriginURL>rtmp://[origin-server-address]/[application-name]</OriginURL>
			<QueryString><![CDATA[]]></QueryString>
		</Repeater>
		<Modules>
			<Module>
				<Name>base</Name>
				<Description>Base</Description>
				<Class>com.wowza.wms.module.ModuleCore</Class>
			</Module>
			<Module>
				<Name>properties</Name>
				<Description>Properties</Description>
				<Class>com.wowza.wms.module.ModuleProperties</Class>
			</Module>
			<Module>
				<Name>logging</Name>
				<Description>Client Logging</Description>
				<Class>com.wowza.wms.module.ModuleClientLogging</Class>
			</Module>
			<Module>
				<Name>flvplayback</Name>
				<Description>FLVPlayback</Description>
				<Class>com.wowza.wms.module.ModuleFLVPlayback</Class>
			</Module>
		</Modules>
		<!-- Properties defined here will be added to the IApplication.getProperties() and IApplicationInstance.getProperties() collections -->
		<Properties>
		</Properties>
	</Application>
</Root>

the stream works using http://[repeater-address]:1935/[application-name]/[application-instance-name]/[stream-name]/playlist.m3u8

I have the key named [stream-name].key in the /keys/[application-name]/[application-instance-name]/ directory and the url to the [stream-name].php which supplies the key is active and working (just like it worked for the VOD app), my problems is that the stream is not encrypted and will play with a valid or invalid key in the [stream-name].php file.

One thing i noticed was that if I change the stream (there are multiple streams running on the origin on multiple application-instances) Wowza creates the key/[application-name]/[application-instance-name]/ directory looking for they key.

Is this possible or must I update the Origin Application.xml conf file to match?

Costel_Radulescu · September 9, 2020, 8:58pm

Hello Richard,

I tried what you suggested and still no success, the stream still works regardless of keys.

I even fooled around with the [stream-name].stream link and removed some parts of the Application.xml file like:

		<Repeater>
			<OriginURL></OriginURL> <!-- rtmp://[origin-server-address]/[application-name] used to be here -->
			<QueryString><![CDATA[]]></QueryString>
		</Repeater>

just to be sure Wowza used the [steam-name].stream file and it does, but still no encryption…

for the VOD example Wowza displays the following in the log:

#EXTM3U
#EXT-X-TARGETDURATION:11
#EXT-X-MEDIA-SEQUENCE:1
#EXT-X-KEY:METHOD=AES-128, URI="http://[web-server-address]/[supply-key].php?wowzasessionid=[id]"
#EXTINF:11

For the LIVE example all i get is:

#EXTM3U
#EXT-X-ALLOW-CACHE:NO
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:6239
#EXTINF:2

Martin_Simka · September 9, 2020, 8:58pm

Hi all,

I am trying to encrypt a transcoded (MPEG4 -> H.264) live stream for iPad, with no success though. What should be the filename for the key file?

Currently I use keys/enc.stream.key. However, the content link is: http://wowzaIP:1935/crypt/ngrp:enc.stream_mobile/playlist.m3u8

The content is not encrypted. The VOD case, without transcoding works fine.

Thanks in advance!

Martin_Simka · September 9, 2020, 8:58pm

You have to encrypt each item in the ngrp group, but not the ngrp group itself. Test each one individually.

Thanks, but I didn’t get it, sorry.

Currently I can find this in access logs:

2012-01-10      13:29:41        CET     comment server  INFO    200     -       LiveStreamPacketizerCupertino.init[crypt/_definst_/enc.stream]: Encrypt Cupertino stream: key: *A1D2

In the ngrp groups I have this:

Groups:

enc.stream_mobile[remove stream group]

160p

enc.stream_all[remove stream group]

160p

What are the items of the group and how to encrypt them?

How should be named the file with encryption key?

Martin_Simka · September 9, 2020, 8:58pm

ok, it works now, with disabled relative addressing and key filename: enc.stream_160p.key

thanks a lot.

Salloum_ELDAHDAAH · September 9, 2020, 8:58pm

I’m trying to set up a Cupertino VOD file for simple secure streaming to a iPad application in Phonegap 1.2.0.

My local ip is 10.120.1.157 so I’ll use that for my example. I’ve encrypted the file sampleblocked.mp4 using

./genkey.sh ipad sampleblocked.mp4 http://10.120.1.157:1935

Returning:

cupertinostreaming-aes128-key: F96B05094642E835D09AF434CFD55DE1

cupertinostreaming-aes128-url: http://10.120.1.157:1935/video.php

I’ve moved the resulting key file sampleblocked.mp4.key into the [wowzaroot]/keys directory.

Where I’m confused is what I should use to call the encrypted VOD file so it will play.

If I use:

the iPad app appropriately returns “The operation could not be completed”

But I don’t understand what code should be used to get this file to play.

I assumed it might be:

http://10.120.1.157:1935/video.php?keyinfo=F96B05094642E835D09AF434CFD55DE1

but that doesn’t work.

Thanks for any pointers and best regards–

Dennis

Haveyou been able to solve this? please can you post the solution how to call the video from wowza with key send step by step.

Abed_Islam · September 9, 2020, 9:56pm

It still needs to be documented. I don’t have a time frame for this. Check this group of articles:

https://www.wowza.com/docs/wowza-drm

It will show up there when it is published.

Richard

I understand you may not yet have a time frame for when documentation for key rotation will go up. Just posting to let you know there’s at least one more party interested in this.

Will keep checking that group of articles over time.

Thanks.

Ferdinand_Hernandez · September 9, 2020, 9:01pm

Is there a way to remove wowzasessionid=xxxxxxx parameter in the playlist generated by wowza for the key url. For example if we would like to use a local file as a key like this:

#EXT-X-KEY:METHOD=AES-128,URI=“file://data/misc/safeview/36.key?wowzasessionid=24173829”,KEYFORMATVERSIONS=“1”

It will not work if it has the session id since it will be looking for the file 36.key?wowzasessionid=24173829 instead of 36.key

Tony_Collins · September 9, 2020, 9:01pm

What means would the external script have to know if Wowza is in an approved or pirated session?

Wowza calls the external script when the HLS session is started. If it does not respond with the key the session will not work.

Richard

Naoki_Iwata · September 9, 2020, 9:02pm

Hello Rchard-san,

This is Iwata.

I am afraid Iam not good at English.

I have same problem too.

now status is the following.

(1) WMS3.0 + Transcoder (in One server)

=> external encrypt on live stream is OK.

safari on iOS was normal requested to CGI URL in key file.

CGI is set on WMS3.0+Transcoder.

(2) WMS3.0 + Transcoder (origin) -> WMS3.5(edge)

=> external encrypt is NG.

this pattern,

safari on iOS was not requested to CGI URL in key file.

CGI is set on WMS3.5(edge).

but, I was look the following log in wowzamediaserver_access.log.

INFO server comment - LiveStreamPacketizerCupertino.init[liveedge/definst/recsmart.stream_240p_test]:

Encrypt Cupertino stream: key: *F367 url: http://[WMS3.5(edge)IPaddress]/cgi-bin/recsmartcheck_240p_test.cgi

Moreover, about (2) , we were set the vod and key files to the server.

but it was successfull.

Please help me solving about (2) problem.

configration of (2)"WMS3.5(edge) is the following.

[installdir]/conf/liveedge/Application.xml

liverepeater-edge

${com.wowza.wms.context.VHostConfigHome}/content

${com.wowza.wms.context.VHostConfigHome}/keys

cupertinostreamingrepeater,smoothstreamingrepeater,sanjosestreamingrepeater

cupertinostreaming,smoothstreaming,sanjosestreaming

wowz://[(1)WMS3.0+Tanscoder IPAddress]:1935/live

[installdir]/keys/recsmart.stream_240p_test.key

cupertinostreaming-aes128-key: F88BB4132F4A864FE9D4EC2918BEF367

cupertinostreaming-aes128-url: http://[(2)WMS3.5(edge)IPAddress]/cgi-bin/recsmartcheck_240p_test.cgi

Best regards,

Iwata

What is [stream-name] ? Is it a simple name like “myStream”, and you have the rtmp address of the origin in /originURL?

If so, try using a .stream file instead. Create a text file named origin.stream in the content folder:

/content/origin.stream, with contents:

rtmp://[wowza-address]:1935/liveorigin/definst/myStream

Now use stream name “origin.stream”

Richard

Naoki_Iwata · September 9, 2020, 9:02pm

Hi Richard,

Thank you very much for reply.

.cgi script is reachable.

I was searched on access.log of web server, but I not found for .cgi access log.

but I was access successfull to this cgi via Web browser.

Moreover, I tried same method to vod contents, but it is successfull.

Is this external encrypt method not support to liveedge?

Best regards,

Iwata

Hi Iwata,

I’m not sure what the problem is. Is the .cgi script reachable?

Does streaming work? I assume that AES encryption is not working…?

Richard

Naoki_Iwata · September 9, 2020, 9:02pm

Hi Richard,

Does streaming work? I assume that AES encryption is not working…?

streaminig is working.

and it is successfull by the following flow.

WMS3.0+TranscoderAddon(live) --> WMS3.5(liveedge)–>(HLS without external AES Encrypt)–> iOS6.X

Best regards,

Iwata

Hi Iwata,

I’m not sure what the problem is. Is the .cgi script reachable?

Does streaming work? I assume that AES encryption is not working…?

Richard

Doug_Maupin · September 9, 2020, 9:06pm

Alright, I set up the external method, however I am running into an issue with ios devices. It throws an invalid security certificate error could this have to do with the key or the authentication php form? I am bit confused Would like a bit of clarification if possible

sanjeev_chadha · September 9, 2020, 9:08pm

Hi Richard,

I am new to wowza, trying to achieve AES encryption with the external method, I have read through this entire post and all the comments, I am listing down steps which I am using to proceed with encryption and also queries, please let me know for those.

Generate a key that is used to encrypt each of the media chunks.

key name is streamname.key
created using

cd C:\Program Files (x86)\Wowza Media Systems\Wowza Streaming Engine 4.0.3\bin>

command> genkey.bat {playerOS}iphone {streamname}sample.mp4 {how will the player read the key}http://*host/Test/mf-key.php

The key file include a URL for the player to retrieve the key.
Put the key in the keys folder on the server and it’s name matches the name of the media file.
Wowza will use the key to encrypt each of the chunks before delivery and will put the key URL in the playlist file so the player can

retrieve the key to decrypt the chunks.

You provide a PHP script in your web server that distrubutes the key. You need to be sure you secure the key so only who you want to view the stream can get the key.
This applies to both live and video on demand streams.
Test it as follows.

For IOS Include the path in
To test using desktop versions use jwplayer enterprise edition

jwplayer(‘player’).setup({

wmode: “transparent”,

height: “360”,

autostart: ‘false’,

//skin: ‘bekle’,

playlist: [{

sources: [{

file: “http://[wowza-ip]:1935/vod/mp4:sample.mp4/playlist.m3u8”

}]

}],

});

Queries

Do we have to generate a .key file per stream ? If so can you help understanding how can it be achieved using php on uploading of each vod content.?
Does the .key file necessary be in wowza/keys folder or cant it be mounted to a NFS ? as in my case the transcoding is being done and all streams are accessible via nfs mounted between wowza,applciation and a cdn
Can a key file generated for iphone be used for ipad and itouch or a separate key needs to be generated for each of this ?
Will a DRM addon be recommended for encrypting streams on the fly or AES is a better approach. Please advice.

Many Thanks

Sanjeev

Wowza Community

Article: How to secure Apple HTTP Live Streaming (AES-128 - external method)

Popular Video Topics

Video Resources

Partners

Company

Stay Connected

Stay Up to Date with the Blog