Encrypted Media: Encryption Scheme Query

1. MediaKeySystemMediaCapability dictionary extension

partial dictionary MediaKeySystemMediaCapability {
  DOMString? encryptionScheme = null;
};

The encryptionScheme field indicates an encryption scheme required by the application in combination with the other fields of the MediaKeySystemMediaCapability dictionary. A value which is null or not present indicates to the user agent that no specific encryption scheme is required by the application, and therefore any encryption scheme is acceptable.

NOTE: Applications that are aware of this field should always specify a value. See § 4 Application Notes for details.

NOTE: If encryptionScheme is not present, the encryptionScheme field of the MediaKeySystemMediaCapability object returned from MediaKeySystemAccess.getConfiguration() must be present and set to the default value of null. This enables detection of this feature in polyfills for user agents which do not support this field. See also § 5 Polyfills and Backward Compatibility.

NOTE: The empty string is distinct from null or not present, and so would be treated as an unrecognized encryption scheme.

Well-known values for encryptionScheme are:

• cenc: The "cenc" mode, defined in ISO 23001-7:2016, section 4.2a. AES-CTR mode full sample and video NAL subsample encryption.

• cbcs: The "cbcs" mode, defined in ISO 23001-7:2016, section 4.2d. AES-CBC mode partial video NAL pattern encryption. For video, the spec allows various encryption patterns.

• cbcs-1-9: The same as "cbcs" mode, but with a specific encrypt:skip pattern of 1:9 for video, as recommended in ISO 23001-7:2016, section 10.4.2.

NOTE: The document WebM Encryption defines WebM encryption to be equivalent to and compatible with the "cenc" encryption mode defined in ISO 23001-7:2016.

A registry should be created for encryption schemes, and the existing format registry should be updated with respect to encryption schemes. <https://github.com/wicg/encrypted-media-encryption-scheme/issues/#9>

2. Algorithm Extensions

In the Get Supported Capabilities... algorithm, the following changes should be made:

1. In the loop that begins with "For each requested media capability in requested media capabilities", the user agent MUST run the following steps at the beginning of the loop:

   1. Let encryption scheme be requested media capability’s encryptionScheme member.

   2. If encryption scheme is non-null and is not recognized or not supported by the user agent, continue to the next iteration.

2. In the step that says "If the user agent and implementation definitely support playback of encrypted media data for the combination of container, media types, robustness and local accumulated configuration in combination with restrictions", the user agent MUST replace the condition with the following condition:

   1. If the user agent and implementation definitely support playback of encrypted media data for the combination of container, media types, robustness, encryption scheme, and local accumulated configuration in combination with restrictions...

3. Clear Key Requirements

Clear Key implementations MUST support the cenc scheme at a minimum, to ensure interoperability for users of this common key system.

7. Examples

function tryTwoEncryptionSchemesInSeparateConfigurations(keySystem) {
  // Query two configurations with different encryption schemes.
  // Only one will be chosen by the user agent.

  return navigator.requestMediaKeySystemAccess(keySystem, [
    { // A configuration which uses the "cenc" encryption scheme
      videoCapabilities: [{
        contentType: 'video/mp4; codecs="avc1.640028"',
        encryptionScheme: 'cenc',
      }],
      audioCapabilities: [{
        contentType: 'audio/mp4; codecs="mp4a.40.2"',
        encryptionScheme: 'cenc',
      }],
      initDataTypes: ['keyids'],
    },

    { // A configuration which uses the "cbcs-1-9" encryption scheme
      videoCapabilities: [{
        contentType: 'video/mp4; codecs="avc1.640028"',
        encryptionScheme: 'cbcs-1-9',
      }],
      audioCapabilities: [{
        contentType: 'audio/mp4; codecs="mp4a.40.2"',
        encryptionScheme: 'cbcs-1-9',
      }],
      initDataTypes: ['keyids'],
    },
  ]);
}

function tryTwoEncryptionSchemesInOneConfiguration(keySystem) {
  // Query one configuration with two different encryption schemes.
  // The user agent will eliminate any capabilities object it cannot support,
  // so the accumulated configuration may contain one encryption scheme or both.

  return navigator.requestMediaKeySystemAccess(keySystem, [{
    videoCapabilities: [
      { // A capability object which uses the "cenc" encryption scheme
        contentType: 'video/mp4; codecs="avc1.640028"',
        encryptionScheme: 'cenc',
      },
      { // A capability object which uses the "cbcs-1-9" encryption
        // scheme
        contentType: 'video/mp4; codecs="avc1.640028"',
        encryptionScheme: 'cbcs-1-9',
      },
    ],
    audioCapabilities: [
      { // A capability object which uses the "cenc" encryption scheme
        contentType: 'audio/mp4; codecs="mp4a.40.2"',
        encryptionScheme: 'cenc',
      },
      { // A capability object which uses the "cbcs-1-9" encryption
        // scheme
        contentType: 'audio/mp4; codecs="mp4a.40.2"',
        encryptionScheme: 'cbcs-1-9',
      },
    ],
    initDataTypes: ['keyids'],
  }]);
}