# AES rotating keys

**URL:** <https://community.wowza.com/t/aes-rotating-keys/97394>\
**Category:** Wowza Streaming Engine\
**Created:** [July 14, 2024, 4:33am UTC](https://community.wowza.com/t/aes-rotating-keys/97394 "2024-07-14T04:33:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Rossi1](https://avatars.discourse-cdn.com/v4/letter/d/35a633/32.png) [@Daniel\_Rossi1](https://community.wowza.com/u/Daniel_Rossi1)\
**Post date:** [July 14, 2024, 4:33am UTC](https://community.wowza.com/t/aes-rotating-keys/97394/1 "2024-07-14T04:33:06Z")

</div>

I am developing a module to rotate AES Keys. A scheduler makes an api call to the key server to update keys for for streams. So whatever is requested next is the new key.

With videojs VHS Ive noticed it’s a little behind to trying to decrypt a fragment with the new key obtained from the key server but its still the old key in the fragment.

How do I work around this issue as playback stops. I’ve tried not encrypting a chunk when just updating but still fails., setting encryption to none still requests the key server. I noticed I dont need to set all this enc info each time. Is there an efficient way to cache and reuse the enc info ?

```
public void onHTTPCupertinoEncryptionKeyLiveChunk(ILiveStreamPacketizer liveStreamPacketizer, String streamName, CupertinoEncInfo encInfo, long chunkId, int mode)
{
	
	//Log.info("Chunk request " + streamName);
	
	
	
	
	SessionAESKey keyData = streamKeys.get(streamName);
	
	Log.info("Chunk request " + streamName + " " + keyData.keyHex + " is updating "+ keyData.isUpdating);
	
	if (keyData.isUpdating) {
		encInfo.setEncMethod(CupertinoEncInfo.METHOD_NONE);
		encInfo.setEncUrl("");
		
		keyData.isUpdating = false;
		//.info("Updating: " + encInfo.toString());
		return;
	}
	
	encInfo.setEncMethod(CupertinoEncInfo.METHOD_AES_128);
	encInfo.setEncUrl(keyData.keyURL);
	encInfo.setEncKeyBytes(keyData.key);
	encInfo.setEncIVBytes(keyData.iv);
	encInfo.setEncKeyFormatVersion("1");	
}
```

---

<div class="post-metadata">

**Author:** ![Daniel\_Rossi1](https://avatars.discourse-cdn.com/v4/letter/d/35a633/32.png) [@Daniel\_Rossi1](https://community.wowza.com/u/Daniel_Rossi1)\
**Post date:** [July 17, 2024, 5:17pm UTC](https://community.wowza.com/t/aes-rotating-keys/97394/2 "2024-07-17T17:17:43Z")

</div>

I figured something out that was trivial. Use a hash on the key urls to identify which key to deliver for the stream. ie keyserver/streamname/hash. This brings up a configured set cache using the streamname and hash. old segements will load the old key then. Rotation still causes temporary playback buffers. The cache I set to expire minutes in advance of the rotation interval so old segements loading will get the cache not expired yet.