AES 128 Encryption for iPhone HTTP Stream

Question

I know almost nothing about cryptography, but I would like to figure out how to encrypt HTTP live stream and decrypt it on iphone.

Apple docs for HTTP encryption read as follows:

Media files containing stream segments can be individually encrypted. When encryption is used, links to the corresponding key files appear in the index file so that the client can obtain keys for decryption.

When the key file is specified in the index file, the key file contains the encryption key that should be used to decrypt subsequent media files in the list in the index file. HTTP Live Streaming currently supports AES-128 encryption using 16-octet keys. The key file format is a packed array of these 16 octets in binary format.

The media stream segmenter available from Apple provides encryption and supports three modes for setting encryption.

The first mode allows you to specify the path to an existing disk key file. In this mode, the segmentator inserts the URL of the existing key file in the index file. This key encrypts all media files.

The second mode instructs the segmentator to generate a random key file, save it in the specified location and refer to it in the index file. All media files are encrypted using this randomly generated key.

The third mode instructs the segmentator to generate a random key file, save it in the specified location, refer to it in the index file, and then restore and link to the new key file every n files. This mode is called key rotation. Each group of n files is encrypted using a different key.

You can serve key files using HTTP or HTTPS. You can also choose to protect key file delivery using your own session-based authentication scheme.

Using encryption method 1, I think I need to do the following:

1. generate the key using the cipher and make the key available to the segmenter
2. Segmenter inserts key URL into index file
3. save this cipher in iphone (keychain?)
4. direct the movie player to the m3u8 playlist URL that refers to this index file
5. enter a cipher somehow to automatically decrypt the stream?

Can anyone help raise the fog here?

Answer 1

This is pretty much how to handle encrypted streaming:

http://developer.apple.com/iphone/library/qa/qa2009/qa1661.html

In addition, the application must connect to the https domain before running the movie so that it can transfer its credentials, and these credentials can be cached for MPMoviePlayer.

The player supports digest authentication, but not SSL client authentication using client certificates.