How AES-128 works in HLS
Each segment is encrypted when the stream is packaged. The playlist includes a line pointing to the key. The player requests the key over HTTPS, decrypts each segment as it arrives and plays it. The key can be rotated during a stream so that one key unlocks only part of it.
What it protects against
The segments on the CDN are useless on their own, so someone who copies the stream address or downloads the files gets nothing playable. Protection then depends on who can obtain the key. If the key URL requires a signed token or a logged-in session, only entitled viewers get it.
AES-128 vs DRM
DRM systems use AES too, typically with 128-bit keys. The difference is not the cipher but how the key is guarded.
- Key delivery: with AES-128 the key reaches the player in the clear; with DRM it stays inside a protected module on the device
- Rules: AES-128 has none; a DRM license sets expiry, resolution limits and offline rights
- Output: AES-128 cannot block screen capture; hardware DRM can
- Acceptance: studios generally do not accept AES-128 alone for premium content
- Cost and effort: AES-128 is simple and has no license fees
When it is enough
For content you own, such as courses, sermons, events and independent films, AES-128 with tokenized key delivery stops casual copying at little cost. For licensed films, series and sport, expect to need DRM.
Last reviewed