# Article: How to secure Apple HTTP Live Streaming (AES-128 - external method)

**URL:** <https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101>\
**Category:** Wowza Streaming Engine\
**Tags:** media-players-and-devices\
**Created:** [October 1, 2010, 11:37am UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101 "2010-10-01T11:37:46Z")\
**Posts on this page:** 20\
**Page:** 3

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 22, 2011, 3:19pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/41 "2011-12-22T15:19:34Z")

</div>

Actually, yes, I think it is possible: “rotating keys”. However, it is not documented yet. It is on the to-do list, but it probably will not happen until after the holidays.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 22, 2011, 4:35pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/42 "2011-12-22T16:35:48Z")

</div>

I don’t have a time frame for this. Probably after the holidays, but not sure when.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 4, 2012, 11:26pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/43 "2012-01-04T23:26:04Z")

</div>

Dennis,

Have you tried this test to see if AES is working?

[https://www.wowza.com/docs/how-to-test-aes-encryption-for-apple-hls-streams](https://www.wowza.com/docs/how-to-test-aes-encryption-for-apple-hls-streams)

Does it work without AES in place?

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 6, 2012, 3:53pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/44 "2012-01-06T15:53:38Z")

</div>

I don’t have experience with Phonegap. Test with playlist.m3u8 URL in a HTML5 video tag, see if that works.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 10, 2012, 12:07pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/45 "2012-01-10T12:07:11Z")

</div>

You have to encrypt each item in the ngrp group, but not the ngrp group itself. Test each one individually.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 10, 2012, 3:02pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/46 "2012-01-10T15:02:33Z")

</div>

You’re welcome, thanks for the update

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 18, 2012, 5:33pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/47 "2012-01-18T17:33:10Z")

</div>

akilouise,

No, sorry, I don’t yet.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 18, 2012, 6:26pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/48 "2012-01-18T18:26:27Z")

</div>

But I will ask about it tomorrow

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 19, 2012, 5:42pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/49 "2012-01-19T17:42:04Z")

</div>

It still needs to be documented. I don’t have a time frame for this. Check this group of articles:

[https://www.wowza.com/docs/wowza-drm](https://www.wowza.com/docs/wowza-drm)

It will show up there when it is published.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [January 24, 2012, 9:45pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/50 "2012-01-24T21:45:54Z")

</div>

The steps are here:

[https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method](https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method)

Or you can try:

[https://www.wowza.com/docs/how-to-use-the-internal-method-of-aes-128-encryption-to-secure-live-or-vod-streams-sent-to-apple-ios-devices-moduleencryptionhandlercupertinostreaming](https://www.wowza.com/docs/how-to-use-the-internal-method-of-aes-128-encryption-to-secure-live-or-vod-streams-sent-to-apple-ios-devices-moduleencryptionhandlercupertinostreaming)

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 15, 2012, 2:32pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/51 "2012-02-15T14:32:44Z")

</div>

Thanks,

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [September 14, 2012, 3:50pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/52 "2012-09-14T15:50:19Z")

</div>

It has to be done for each stream in the smil. You don’t do it for the smil itself, which is just a text file the playback client uses to know what streams are available.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [September 14, 2012, 4:01pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/53 "2012-09-14T16:01:57Z")

</div>

I think you can use the same key for each stream, as I remember in my tests.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 7, 2013, 4:55pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/54 "2013-02-07T16:55:12Z")

</div>

Wowza calls the external script when the HLS session is started. If it does not respond with the key the session will not work.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 14, 2013, 3:02pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/55 "2013-02-14T15:02:34Z")

</div>

Hi Iwata,

I’m not sure what the problem is. Is the .cgi script reachable?

Does streaming work? I assume that AES encryption is not working…?

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [February 17, 2013, 6:23pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/56 "2013-02-17T18:23:11Z")

</div>

Please re-start the edge, then start the origin stream, then test playback **without** AES encryption enabled. Then re-start again and test playback **with** AES encryption enabled.

Then zip up and send /conf and /logs folders to support@wowza.com

The two re-starts are important, that will make two clean tests that can be compared.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [June 21, 2013, 1:57pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/57 "2013-06-21T13:57:47Z")

</div>

You have to use onHTTPCupertinoEncryptionKeyLiveChunk:

```auto
public void onHTTPCupertinoEncryptionKeyLiveChunk(ILiveStreamPacketizer liveStreamPacketizer, String streamName, CupertinoEncInfo encInfo, long chunkId, int mode)
{
	if (streamName.equals("streamName"))
	{
		encInfo.setEncMethod(CupertinoEncInfo.METHOD_AES_128);
		encInfo.setEncUrl("http://mycompanykeyserver.com/authenticate.aspx");
		encInfo.setEncKeyBytes(BufferUtils.decodeHexString("123456789ABCDEF123456789ABCDEF12"));
		encInfo.setEncIVBytes(BufferUtils.decodeHexString("FEDCBA9876543210FEDCBA9876543210"));
	}
}

```

This is included in this [HLS Encryption guide](https://www.wowza.com/docs/how-to-secure-apple-hls-streaming-using-drm-encryption)

It notes that you should not change the key with each chunk, but do it periodically during streaming.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [June 24, 2013, 3:07pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/58 "2013-06-24T15:07:16Z")

</div>

There is nothing built-in like that, you would have to develop something. Wowza provides the hook for each chunk, you can rotate keys any way you want with that.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [June 28, 2013, 12:57pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/59 "2013-06-28T12:57:36Z")

</div>

It is compatible. Make sure you have MediaCache working without AES, and make sure you have AES working without MediaCache. Then they should work together.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [June 30, 2013, 4:53pm UTC](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101/60 "2013-06-30T16:53:01Z")

</div>

With the AES external method you also need a application server to run the .php or .aspx page that is involved. Do you need that? It doesn’t sound like it. The external method allows you to integrate with, for example, a database. If you don’t need that, if you just need easy encryption, take a look at the AES internal method which is much easier to implement.

[https://www.wowza.com/docs/how-to-use-the-internal-method-of-aes-128-encryption-to-secure-live-or-vod-streams-sent-to-apple-ios-devices-moduleencryptionhandlercupertinostreaming](https://www.wowza.com/docs/how-to-use-the-internal-method-of-aes-128-encryption-to-secure-live-or-vod-streams-sent-to-apple-ios-devices-moduleencryptionhandlercupertinostreaming)

Richard

[Previous page](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101.md?page=2)

[Next page](https://community.wowza.com/t/article-how-to-secure-apple-http-live-streaming-aes-128-external-method/101.md?page=4)