What is AES-128 Encryption?

AES-128 is a symmetric cipher, meaning the same 128-bit key encrypts the media segments and decrypts them on the client side. In an HLS workflow, your encoder splits video into small segments, typically two seconds long. Each segment is encrypted with the AES-128 algorithm. The resulting binary data is unreadable without the key.

The encryption key itself is not embedded in the video. Instead, the HLS playlist references a key URI. When a player requests the stream, it first downloads the playlist. The playlist contains a tag pointing to the location of the key file. The player fetches this key, then uses it to decrypt each video segment as it arrives. This process happens in real time on the user's device.

Because the key is a separate file, you can rotate it periodically. If you change the key, old segments become undecryptable with the new key, forcing players to fetch the updated key. This adds a layer of control over how long a specific key remains valid.

Basic HTTP streaming sends video data in clear text. Anyone with network access can capture and save the stream. AES-128 prevents this casual interception. It ensures that only clients with the correct key can view the content.

For operators, this protects intellectual property from simple screen recording tools or network sniffers. It is a standard baseline for securing VOD and live streams. However, AES-128 is not a complete solution. The key is often delivered in clear text or via a simple token. A determined attacker can extract the key from the player's memory or intercept the key request.

You should use AES-128 when you need basic protection for general audience content, such as educational videos or live events. It is cost-effective and widely supported across all major players and devices. For premium, high-value content like movies or exclusive sports, you will likely need stronger protection.

AES-128 and DRM both protect video, but they operate at different levels. AES-128 encrypts the media file itself. DRM encrypts the media and adds a secure container for the key, often using hardware-backed security on the device.

DRM systems like Widevine, PlayReady, or FairPlay use asymmetric cryptography. The player requests a license from a server, which validates the user's entitlement before releasing the key. This prevents key extraction because the key never exists in plain text on the device.

• Using a static key for all content. If one key is compromised, all content encrypted with it is exposed. Rotate keys per title or per session.
• Delivering keys over unsecured HTTP. Always use HTTPS for key delivery to prevent man-in-the-middle attacks.
• Assuming AES-128 stops all piracy. It stops casual capture, but not sophisticated screen recording or key extraction.
• Forgetting to update the key URI in the playlist. If the key file moves, playback breaks for all users.