Common Encryption (CENC)

Common Encryption (CENC)
Name	Common Encryption (CENC)
Introduced	2013
Standard	ISO/IEC 23001-7
Developer	MPEG, DASH Industry Forum
Application	Digital video distribution

Common Encryption (CENC) Common Encryption (CENC) is a media encryption interoperability approach standardized to allow multiple Digital Rights Management systems to use a single encrypted media stream. It was developed to reduce fragmentation among streaming platforms and to facilitate content protection across devices such as set-top boxes used by Netflix, Amazon Prime Video, Hulu, YouTube, and broadcasters like BBC and NHK. CENC aligns with standards produced by organizations such as ISO/IEC, the Moving Picture Experts Group, and the DASH Industry Forum to enable easier integration with ecosystems led by companies like Apple Inc., Google, Microsoft, and Adobe Systems.

Overview

CENC defines a metadata and packaging strategy that separates encrypted media samples from license acquisition mechanisms employed by systems like Widevine, PlayReady, and FairPlay. The effort emerged in the context of standardization work at MPEG and interoperability initiatives influenced by vendors including Samsung Electronics, Sony Corporation, LG Electronics, and content owners such as Warner Bros., Disney, and Paramount Pictures. By specifying initialization vectors, subsample encryption indices, and key identifier placement compatible with containers pioneered by ISO base media file format derivatives, CENC streamlines workflows across distribution networks run by companies like Akamai Technologies and Cloudflare.

Technical Specification

CENC builds on the ISO/IEC 14496-12 base media file format and extensions in ISO/IEC 23001-7, defining how to store the 'Protection System Specific Header' and 'Track Encryption Box' for sample-level encryption. The specification prescribes use of cryptographic primitives such as Advanced Encryption Standard in modes like Cipher Block Chaining and Counter (CTR) and details how to include 'pssh' boxes carrying system IDs for providers like Google LLC's Widevine Modular, Microsoft Corporation's PlayReady, and Apple Inc.'s FairPlay Streaming. Implementers often reference related standards such as RFC 7515 for JSON Web Signature and RFC 7516 for JSON Web Encryption when integrating license token exchange with systems like OAuth 2.0 and OpenID Connect adopted by platforms including Facebook, Twitter, and LinkedIn.

Supported Codecs and Containers

CENC has been applied to media encoded with codecs standardized or widely adopted by industry actors: Advanced Video Coding (H.264/AVC) from ITU-T, High Efficiency Video Coding (H.265/HEVC) from MPEG and ITU-T, and newer codecs such as AV1 developed by the Alliance for Open Media and VP9 from Google. Containers include MP4 based on the ISO base media file format, MPEG-TS used by broadcasters like Eutelsat and Intelsat, and segments for MPEG-DASH and HTTP Live Streaming (HLS) authored for environments like Apple TV and Roku. Content distributors such as HBO and ESPN routinely rely on CENC compatibility lists that map codec support to device capabilities like those from Roku, Inc., Amazon Fire TV, and Chromecast.

DRM Systems and Compatibility

CENC is not a DRM system itself but a bridge among systems including Google's Widevine, Microsoft PlayReady, and Apple FairPlay. It defines how key identifiers and system specific data coexist in a single file so that license servers operated by entities like Verizon, Comcast, BT Group, and Deutsche Telekom can issue keys based on device entitlement checked against identity providers such as Okta or Ping Identity. Interoperability has been influenced by industry consortia such as the Digital Entertainment Content Ecosystem and standards bodies like EBU and 3GPP, enabling compatibility checks in devices certified by organizations such as CTA (formerly CEA) and DTCP license frameworks.

Implementation and Adoption

Major content platforms and device manufacturers implemented CENC to streamline packaging and reduce storage duplication; vendors offering packagers include Bitmovin, Mux, Inc., Harmonic Inc., and Telestream. Broadcasters and OTT providers including Sky Group, Discovery, Inc., and Vimeo adopted CENC in workflows combined with content delivery networks like Limelight Networks and Fastly. Open-source projects and tools supporting CENC include GPAC and implementations in libraries like FFmpeg and Shaka Player from Google, which facilitated testing across testbeds established by the DASH-IF and interoperability events hosted by organizations including IETF and W3C.

Security and Privacy Considerations

CENC's security rests on correct use of cryptographic algorithms and secure key management enforced through license servers and hardware roots of trust such as Trusted Platform Module and secure enclaves developed by Intel and ARM Holdings. Privacy concerns arise when pssh boxes and license requests are correlated with user identifiers managed by platforms like Google LLC and Meta Platforms, Inc.; mitigation strategies reference practices from General Data Protection Regulation compliance where applicable in jurisdictions like European Union and United States frameworks such as COPPA and sectoral guidance from agencies like FCC. Threat models consider replay attacks, key leakage from compromised devices including set-top boxes by vendors like Humax or Arris International, and mitigations via rotating keys, forensic watermarking from companies like Verimatrix and NAGRA, and secure provisioning using standards like X.509 certificate chains and PKCS#11 hardware token interfaces.

Category:Digital rights management