Support HLS AES-128 encryption with Key Rotation

[afriza]

Before filing a feature request:

When filing a feature request:

Replace the content in the sections below.

[REQUIRED] Use case description

We would like to use AES-128 encryption for HLS with key-rotation.

Proposed solution

N/A

Alternatives considered

N/A

Issues faced with ExoPlayer/Media3

Using ffplay, we are able to play bunny.m3u8 from bunny.zip (after hosting it on HTTPS, e.g. here)

Using ExoPlayer/Media3 1.3.0, we had the following error:

Playback error
androidx.media3.exoplayer.ExoPlaybackException: Source error
    at androidx.media3.exoplayer.ExoPlayerImplInternal.handleIoException(ExoPlayerImplInternal.java:713)
    at androidx.media3.exoplayer.ExoPlayerImplInternal.handleMessage(ExoPlayerImplInternal.java:689)
    at android.os.Handler.dispatchMessage(Handler.java:102)
    at android.os.Looper.loopOnce(Looper.java:211)
    at android.os.Looper.loop(Looper.java:300)
    at android.os.HandlerThread.run(HandlerThread.java:67)
Caused by: java.io.IOException: javax.crypto.BadPaddingException: error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT
    at javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:133)
    at javax.crypto.CipherInputStream.read(CipherInputStream.java:249)
    at androidx.media3.exoplayer.hls.Aes128DataSource.read(Aes128DataSource.java:101)
    at androidx.media3.datasource.StatsDataSource.read(StatsDataSource.java:94)
    at androidx.media3.extractor.DefaultExtractorInput.readFromUpstream(DefaultExtractorInput.java:293)
    at androidx.media3.extractor.DefaultExtractorInput.read(DefaultExtractorInput.java:70)
    at androidx.media3.extractor.ts.TsExtractor.fillBufferWithAtLeastOnePacket(TsExtractor.java:565)
    at androidx.media3.extractor.ts.TsExtractor.read(TsExtractor.java:448)
    at androidx.media3.exoplayer.hls.BundledHlsMediaChunkExtractor.read(BundledHlsMediaChunkExtractor.java:102)
    at androidx.media3.exoplayer.hls.HlsMediaChunk.feedDataToExtractor(HlsMediaChunk.java:503)
    at androidx.media3.exoplayer.hls.HlsMediaChunk.loadMedia(HlsMediaChunk.java:467)
    at androidx.media3.exoplayer.hls.HlsMediaChunk.load(HlsMediaChunk.java:424)
    at androidx.media3.exoplayer.upstream.Loader$LoadTask.run(Loader.java:421)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:644)
    at java.lang.Thread.run(Thread.java:1012)
Caused by: javax.crypto.BadPaddingException: error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT
    at com.android.org.conscrypt.NativeCrypto.EVP_CipherFinal_ex(Native Method)
    at com.android.org.conscrypt.OpenSSLEvpCipher.doFinalInternal(OpenSSLEvpCipher.java:152)
    at com.android.org.conscrypt.OpenSSLCipher.engineDoFinal(OpenSSLCipher.java:409)
    at javax.crypto.Cipher.doFinal(Cipher.java:2003)
    at javax.crypto.CipherInputStream.getMoreData(CipherInputStream.java:130)
    at javax.crypto.CipherInputStream.read(CipherInputStream.java:249) 
    at androidx.media3.exoplayer.hls.Aes128DataSource.read(Aes128DataSource.java:101) 
    at androidx.media3.datasource.StatsDataSource.read(StatsDataSource.java:94) 
    at androidx.media3.extractor.DefaultExtractorInput.readFromUpstream(DefaultExtractorInput.java:293) 
    at androidx.media3.extractor.DefaultExtractorInput.read(DefaultExtractorInput.java:70) 
    at androidx.media3.extractor.ts.TsExtractor.fillBufferWithAtLeastOnePacket(TsExtractor.java:565) 
    at androidx.media3.extractor.ts.TsExtractor.read(TsExtractor.java:448) 
    at androidx.media3.exoplayer.hls.BundledHlsMediaChunkExtractor.read(BundledHlsMediaChunkExtractor.java:102) 
    at androidx.media3.exoplayer.hls.HlsMediaChunk.feedDataToExtractor(HlsMediaChunk.java:503) 
    at androidx.media3.exoplayer.hls.HlsMediaChunk.loadMedia(HlsMediaChunk.java:467) 
    at androidx.media3.exoplayer.hls.HlsMediaChunk.load(HlsMediaChunk.java:424) 
    at androidx.media3.exoplayer.upstream.Loader$LoadTask.run(Loader.java:421) 
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:644) 
    at java.lang.Thread.run(Thread.java:1012)

[afriza]

@tianyif may I know the status if this issue? would it be possible to implement or if you have successfully reproduced the issue?

[tianyif]

Hi @afriza,

Sorry for the late reply! May I make sure if your padding method is PKCS7? The Aes128DataSource requires that.

[google-oss-bot]

Hey @afriza. We need more information to resolve this issue but there hasn't been an update in 14 weekdays. I'm marking the issue as stale and if there are no new updates in the next 7 days I will close it automatically.

If you have more information that will help us get to the bottom of this, just add a comment!

[google-oss-bot]

Since there haven't been any recent updates here, I am going to close this issue.

@afriza if you're still experiencing this problem and want to continue the discussion just leave a comment here and we are happy to re-open this.