[Feature request] Parsing PSSH box from stream/segments

[petrkutalek]

Describe the feature

It seems that if the MPD manifest contains cenc:pssh data, everything works correctly for me.

<ContentProtection schemeIdUri="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
   <cenc:pssh>AAAA...g==</cenc:pssh>
</ContentProtection>

However, if the pssh data is missing, inputstream.adaptive cannot get it from the stream/segment from the PSSH box, even though the standard allows it. Is this the case?

<ContentProtection schemeIdUri="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
</ContentProtection>

Motivation

The service I use inputstream.adaptive for carries PSSH in stream/segments in live stream, in VOD, cenc:pssh is stored in MPD manifests.

Are you willing to contribute in development?

No

Should a possible backport be considered?

No

[CastagnaIT]

when a manifest dont provide the PSSH, the addon already extract PSSH from the stream segment, if any, and if have a supported container / drm system id, but there are differents use cases and could be that it is a specific case that is not supported or that for some other reason dont works

most of the time i saw that PSSH problems are because of Key Rotation DRM feature, that is not supported on ISA,
but there are already opened issues about it and specified on wiki that is not supported

your info are not enough to understand something,
i should either test the service locally, or if not possible, have a full debug log + downloaded segments included the init files
probably so i can understand a bit the situation

PS. live streams usually is a good candidate for Key Rotation, but i cant confirm for your case

[petrkutalek]

(OK, I will try to add more detailed information in next days, please do not close this ticket yet.)

[lavish440]

@CastagnaIT This would also solve #1657 I think.
Currently, ISA extracts the PSSH from the initial segment but there exists a standard where the correct PSSH is in the media segment.

I think the preference order for PSSH extraction should be:
Manifest > Media Segments > Initial Segments

[petrkutalek]

@lavish440 that is exactly situation I am facing. In my case, the PSSH of the live stream is not listed in the manifest. Initial MP4 segment also does not contain the information. Only the media segment is useful.

This can also be seen on the playback of the stream in Chrome with Widevine in order of request:

• MPD manifest
• IS.mp4
• media segments
• and only at this point there is the Widevine's query for keys

MPD

<ContentProtection schemeIdUri="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
</ContentProtection>

IS

$ ./mp4dump --verbosity 1 IS.mp4
...
[sinf] size=8+72
    [frma] size=8+4
        original_format = avc1
    [schm] size=12+8
        scheme_type = cenc
        scheme_version = 65536
    [schi] size=8+32
        [tenc] size=12+20
        default_isProtected = 1
        default_Per_Sample_IV_Size = 8
        default_KID = [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]
...

MS

$ ./mp4dump --verbosity 1 24828438.m4s
...
[pssh] size=12+41
    system_id = [ed ef 8b a9 79 d6 4a ce a3 c8 27 dc d5 1d 21 ed]
    data_size = 21
    data = [22 06 31 32 32 2d 74 76 38 fa ac b0 01 48 e3 dc 95 9b 06 50 00]
...

[lavish440]

Yes, my issue is similar.
Also, if you edit the manifest before it reaches ISA through a proxy and inject the correct PSSH and KID, it works with Clearkey but not with Widevine.

[CastagnaIT]

im already aware that media segments can contains pssh/kid, this is part of key rotation feature
another indicator for key rotation is the zeroed kid, as shown above
default_KID = [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]

since the PSSH change while in playback the manifest dont provide the PSSH

then this is a duplicate of #1602
no developments are currently planned to implement key rotation soon

[petrkutalek]

Well, I did not expect it to be closed so quickly. Let us assume the key is not rotating, just being distributed in the media segment. How to handle such a situation? I do not know, maybe to calculate the path to the media segment from MPD, download it, extract the PSSH and then start playback together with li.setProperty("inputstream.adaptive.license_data", ...). 🤔
Any idea @lavish440?

[CastagnaIT]

Well, I did not expect it to be closed so quickly

there is already opened linked issue, duplicate issue will be closed
it is easier for us to manage a single issue than many issues all talking about the same problem
if you want you can use the linked issue

How to handle such a situation?

must be implemented on the fragment demuxer and widevine decrypters
due to lack of documentations its not so easy to implement at least for me

[lavish440]

since the PSSH change while in playback the manifest dont provide the PSSH

My crypto period is large so the key isn't rotated very frequently and I can restart the playback, but the issue is that ISA tries to use the PSSH from Initial Segments even when Default KID and PSSH are both present in the manifest (injected with a proxy). It works fine with Clearkey DRM but not with Widevine.

[lavish440]

Well, I did not expect it to be closed so quickly. Let us assume the key is not rotating, just being distributed in the media segment. How to handle such a situation? I do not know, maybe to calculate the path to the media segment from MPD, download it, extract the PSSH and then start playback together with li.setProperty("inputstream.adaptive.license_data", ...). 🤔
Any idea @lavish440?

Currently, I am using a proxy for that.
I download the media segment, extract the PSSH from it and then inject the PSSH and KeyID in the manifest.

[petrkutalek]

must be implemented on the fragment demuxer and widevine decrypters due to lack of documentations its not so easy to implement at least for me

I see and fully understand. Unfortunately, I cannot help with that. I do not even dream of the knowledge you have. All I have is a two-page chapter 9 in the DASH-IF Interoperability Points; Part 6: Content Protection document which I would not call a specification.

Nevermind, thanks anyway for the results of this project. 👍

[petrkutalek]

Currently, I am using a proxy for that. I download the media segment, extract the PSSH from it and then inject the PSSH and KeyID in the manifest.

Is this anything you can share, please? Is it based on this Wiki page?

[lavish440]

Currently, I am using a proxy for that. I download the media segment, extract the PSSH from it and then inject the PSSH and KeyID in the manifest.

Is this anything you can share, please? Is it based on this Wiki page?

Nah, I have my own custom implementation.
It looks like a normal "fixed key" manifest to ISA.

Also if you want to do the same, use the audio segment as they are generally smaller in size.