I would like to be able to manipulate the Key exchange process of my AES-128 encrypted content using VideoJS, sadly I can't do this at the moment of writing as there are no hooks present I could potentially access at the VideoJS DRM functionality. My Idea is that I can at least similar as for the EME plugin for VideoJS, trigger a function like the getLicense call but for AES-128 protected content. I'm aware that this does not provide the same level of security as a commercial DRM system, but it's a thousand times cheaper and from my understanding and testing the key exchange process can be heavily obfuscated by using WebAssembly.
The Idea basically is that VideoJS fetches the following line in my m3u8 manifest a bit differently.
Normally, the line would look something like this (Method 1):
#EXT-X-KEY:METHOD=AES-128,URI="https://example.com/license/8cefe6f8-ebf8-4e88-8440-920be62099e9/-6QgbtD5yTu6kz20kFnemCGc9_SqC6_I0UgcTRGpUqFewmUZkcFyo8TQ-rVN9XwP",IV=ac4cfa42cfb18213873b3a857791d6b0
But what If we would make this instead (Method 2):
#EXT-X-KEY:METHOD=AES-128,KEYID="8cefe6f8-ebf8-4e88-8440-920be62099e9",IV=ac4cfa42cfb18213873b3a857791d6b0
If I was able to make VideoJS return the Keyid of the EXT-X-KEY line, I could pass the KeyId along with a JWT to my Wasm module. The Wasm module will securely handle the key exchange in memory and returns a ClearKey JSON object like this one:
{"keys":[{"alg":"A128KW","k":"NDE4OTA3ZTBmNTE0NDk5ZWJjMjRlMWJiMmMwOTAyNjE","kid":"NjViM2VlOWItYTk2Yi00NDBlLTk3YjEtY2JkZjhiMWVhN2Ex","kty":"oct"}],"type":"temporary"}
Then somehow this ClearKey license needs to get saved to the browsers' EME storage. I'm not a 100% sure about the CDM in that case, but maybe you folks could provide some more details onto this, maybe the VHS decryption worker is already enough here?!
Is such a solution possible?
Thanks in advance
I already tried to get some information on github but sadly I dont get any replies at all, most likly because not many people searching for such a solution. Please also see: