Search code examples
htmlencryptionbrowserdrm

EME Key ID different in session request vs. message (ClearKey)

  1. What is the relationship between the kid supplied to MediaKeySession.generateRequest() and the one provided via MediaKeyMessageEvent?

  2. If they are supposed to be the same - why are they different in the code below? note, this won't run here due to security restrictions

navigator.requestMediaKeySystemAccess("org.w3.clearkey", [{
    initDataTypes: ['webm'],
    audioCapabilities: [{
        contentType: 'audio/webm; codecs="opus"'
    }],
    videoCapabilities: [{
        contentType: 'video/webm; codecs="vp8"'
    },
    {
        contentType: 'video/webm; codecs="vp9"'
    }
    ],
}]).then((keySystemAccess) => {
    return keySystemAccess.createMediaKeys();
}).then((mediaKeys) => {
    var session = mediaKeys.createSession("temporary");
    var keyId = "VHM2iIMGiSg";
    var initData = '{"kids":["' + keyId + '"]}';
    console.log(keyId);

    session.addEventListener('message', (evt) => {
        var requestJson = new TextDecoder().decode(evt.message);
        var request = JSON.parse(requestJson);
        console.log(request.kids[0]);
    });

    this.session.generateRequest("webm", new TextEncoder().encode(initData));
});

output:

VHM2iIMGiSg

eyJraWRzIjpbIlZITTJpSU1HaVNnIl19

expected output is for second line to also be VHM2iIMGiSg

Solution

  • eyJraWRzIjpbIlZITTJpSU1HaVNnIl19 is the base64url encoded value of initData that was passed to generateRequest.

    The reason that request.kids[0] is the full value of initData and not the value of keyId is because generateRequest was invoked with the initDataType parameter set to webm. Had the initDataType parameter been set to keyids then request.kids[0] would be the value of keyId.

    When the initDataType parameter is set to webm the initData parameter is expected to be a single key ID of one or more bytes. Whereas when the initDataType parameter is set to keyids the initData parameter is expected to be a JSON object encoded as UTF-8, containing a single member kids which is an array of base64url encoded Key ID(s).