Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

M3U8 streams can be encrypted using AES-128 with or without IV, as described here: Now I have a stream that is apparently encrypted using certificates. It is located at:

In this file, we have a key URI with the form of faxs:// and an IV. This key URI means that we have to use EXT-X-FAXS-CM, which holds base64-encoded PKCS #7 certificates chaining.

Can we get stream with all this information, and how?

share|improve this question

In order to decrypt encrypted video stream you need encryption key. This key is not part of the stream. It should be obtained separately.

EXT-X-FAXS-CM header contains DRM meta-data and not the key.

This is excert from Adobe Media Server developer guide: The Adobe Access Server protected variant playlist also needs to include the #EXT-X-FAXS-CM tag. The value of #EXT-X-FAXS-CM tag in variant playlist is the relative URI referring to the DRM metadata of one of the individual streams.At the client, the #EXT-X-FAXS-CM tag in variant playlist will be used to create the DRM session. The same DRM session will be used for all encrypted M3U8 files inside the variant playlist.

Full guide can be found here:

There is also mention that faxs:// URI is for local key serving. So key obtained locally from a device.

By the way its AES-128 encryption and PKCS#7 padding.

share|improve this answer
So we must find the encryption key in the Android app... – Velcro May 1 '13 at 8:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.