DASH, HLS & Common Encryption

DASH and HLS at a glance

Both are segmented streaming protocols: the player downloads a manifest, then media in chunks.

Modern integrations often package once with CMAF (fragmented MP4) and serve it as both DASH and HLS by generating both manifest types over the same media. Combined with cbcs encryption, the same files play on Widevine, PlayReady, and FairPlay.

Anatomy of an MPD

<MPD xmlns="urn:mpeg:dash:schema:mpd:2011" type="static" mediaPresentationDuration="PT2H10M">
  <Period>
    <AdaptationSet mimeType="video/mp4" codecs="avc1.640028">
      <ContentProtection
        schemeIdUri="urn:mpeg:dash:mp4protection:2011"
        value="cenc"
        cenc:default_KID="..."/>
      <ContentProtection
        schemeIdUri="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed"
        value="Widevine">
        <cenc:pssh>AAAAQ3Bzc2g...</cenc:pssh>
      </ContentProtection>
      <Representation id="hd" bandwidth="5000000" width="1920" height="1080">
        <BaseURL>video-1080.mp4</BaseURL>
        <SegmentBase indexRange="900-1500"/>
      </Representation>
    </AdaptationSet>
  </Period>
</MPD>

Key things to notice:

• cenc:default_KID — the KID for this adaptation set (premium content has different KIDs per resolution).
• The Widevine ContentProtection element with the system UUID and a PSSH box.
• Representations carry concrete media via SegmentBase / SegmentTemplate / SegmentList.

Common Encryption (CENC)

CENC standardises how MP4 carries encryption metadata so the same bytes work for multiple DRMs. Subschemes:

• cenc (AES-CTR) — full-sample encryption.
• cbcs (AES-CBC, pattern 1:9) — encrypts the first block, leaves nine in the clear, repeating. FairPlay-compatible. Modern Widevine and PlayReady accept it.

cbcs is the multi-DRM choice today. cenc exists in older catalogues.

PSSH

The PSSH box (Protection System Specific Header) carries DRM-specific init data. Each DRM has a unique system ID:

• Widevine: edef8ba9-79d6-4ace-a3c8-27dcd51d21ed
• PlayReady: 9a04f079-9840-4286-ab92-e65be0885f95
• FairPlay: 94ce86fb-07ff-4f43-adb8-93d2fa968ca2

A CENC-packaged file typically has all three PSSH boxes side-by-side; each CDM picks its own.