What is EXT-X-KEY in HLS Playlists?

In an HLS playlist file, the EXT-X-KEY tag specifies the method to be used for decrypting media segments. It tells the video player how to retrieve the necessary decryption key to unlock the encrypted media segments and play them back.

Note, that if an HLS media playlist does not contain any EXT-X-KEY tags, then it is to be understood that the media segments are not encrypted.

In this article, we take a look at the EXT-X-KEY tag, its important attributes, and how to use it.

Attributes of EXT-X-KEY Tag

1. The EXT-X-KEY tag itself: The tag appears in the playlist file (also known as the M3U8 file) and specifies the encryption method, key location, and other optional attributes.
2. METHOD attribute: This attribute tells the player which encryption method is being used. For AES-128 encryption, the value would be “AES-128”. Other attributes include NONE, and SAMPLE-AES.
3. URI attribute: This attribute points to the location of the key file. The key file contains the actual encryption key that the player needs to decrypt the media segments. The URI can be an absolute or relative URL.
4. IV attribute (optional): This attribute specifies the hexadecimal-sequence that defines the Initialization Vector (IV) used in the encryption process. The IV ensures that even if the same key is used for multiple segments, the resulting ciphertext will be unique. If not provided, the player will use the media sequence number as the IV.

Example of EXT-X-KEY Tag in an HLS Playlist

Now, let’s take a look at a practical example. Imagine you have an HLS playlist file with encrypted media segments using AES-128 encryption. Your EXT-X-KEY tag could look something like this:

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-KEY:METHOD=AES-128,URI="https://example.com/keys/key1.bin",IV=0x0123456789abcdef0123456789abcdef
#EXTINF:10.0,
segment1.ts
#EXTINF:10.0,
segment2.ts

In this example:

• METHOD: AES-128 encryption is being used.
• URI: The key file is located at https://example.com/keys/key1.bin.
• IV: The IV is set to 0x0123456789abcdef0123456789abcdef.

When the video player encounters this EXT-X-KEY tag, it will fetch the key file from the specified URI, use the provided IV, and decrypt the subsequent media segments using the AES-128 encryption method.

And there you have it! You now know how the EXT-X-KEY tag works in an HLS playlist file, its attributes, and how to use it to protect your content with encryption. Remember to keep your keys secure, and don’t hesitate to experiment and explore further in the exciting world of streaming.

In a future post, we will talk about generating HLS Playlists with AES-128 encryption.

Until then, happy streaming!

References

1. HLS specification