# HLS AES external - key rotation

**URL:** <https://community.wowza.com/t/hls-aes-external-key-rotation/476>\
**Category:** Wowza Streaming Engine\
**Tags:** media-players-and-devices\
**Created:** [May 17, 2016, 7:44am UTC](https://community.wowza.com/t/hls-aes-external-key-rotation/476 "2016-05-17T07:44:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/system/32/447_2.png) [@system](https://community.wowza.com/u/system)\
**Post date:** [May 17, 2016, 7:44am UTC](https://community.wowza.com/t/hls-aes-external-key-rotation/476/1 "2016-05-17T07:44:24Z")

</div>

With respect to the following article

[https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method](https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method)

is possible to implement a key or vector rotation?

Thanks,

Joe

---

<div class="post-metadata">

**Author:** ![Jason\_Tuchler](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/jason_tuchler/32/462_2.png) [@Jason\_Tuchler](https://community.wowza.com/u/Jason_Tuchler)\
**Post date:** [May 20, 2016, 2:29pm UTC](https://community.wowza.com/t/hls-aes-external-key-rotation/476/2 "2016-05-20T14:29:16Z")

</div>

Hello,

If you would like a rotation, Secure Token probably will be your best bet, since you can set an expiration of the token that’s generated.

[Setting up Secure Token](https://www.wowza.com/docs/how-to-protect-streaming-using-securetoken-in-wowza-streaming-engine)

-JasonT

---

<div class="post-metadata">

**Author:** ![Joe\_Bray](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@Joe\_Bray](https://community.wowza.com/u/Joe_Bray)\
**Post date:** [May 26, 2016, 8:00am UTC](https://community.wowza.com/t/hls-aes-external-key-rotation/476/3 "2016-05-26T08:00:02Z")

</div>

With all due respect Jason, your answer is equivocal. I know about token protection, which is an entirely different technology altogether. I am enquiring about key rotation in AES encryption. This article describes the basic process

[https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method](https://www.wowza.com/docs/how-to-secure-apple-http-live-streaming-aes-128-external-method)

but later articles expand on this

[https://www.wowza.com/docs/how-to-secure-apple-hls-streaming-using-drm-encryption](https://www.wowza.com/docs/how-to-secure-apple-hls-streaming-using-drm-encryption)

which hint at key and vector rotation.

I ask that you disambiguate.

Specifically, I am trying to rotate the key by rewriting the values in the xxxxx.key file, however the server does not pick up these new values. I have then tried to use the jconsole to see if there was a way of kicking the server to reload the amended key file but I can’t see anything related.

Thanks,

Joe

---

<div class="post-metadata">

**Author:** ![Jason\_Tuchler](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/jason_tuchler/32/462_2.png) [@Jason\_Tuchler](https://community.wowza.com/u/Jason_Tuchler)\
**Post date:** [May 26, 2016, 1:52pm UTC](https://community.wowza.com/t/hls-aes-external-key-rotation/476/4 "2016-05-26T13:52:49Z")

</div>

Hello,

I have looked more into this and you will need to use Server-Side API.

I have not tested this yet, although it’s in this article under “On-the-Fly PlayReady Encryption Using Server-Side API”.

[https://www.wowza.com/docs/how-to-secure-apple-hls-streaming-using-drm-encryption](https://www.wowza.com/docs/how-to-secure-apple-hls-streaming-using-drm-encryption)

`onHTTPCupertinoEncryptionKeyVODChunk` or `onHTTPCupertinoEncryptionKeyLiveChunk` are called for each chunk when it’s created.

In those methods, you can set the key info.

Best,

JasonT