Not updating init-data for In-band key rotation signalling is inefficient/wasteful

[prasadkhambete]

https://dashif.org/docs/IOP-Guidelines/DASH-IF-IOP-Part6-v5.0.0.pdf Section 9.3 does not mention that init-data needs to be updated at each key-rotation. Some content packaging providers interpret this to mean that they do not need to update the init-data for each key-rotation.

As per section 9.3 - "The initialisation segment has one PSSH box per DRM allowing to access content and a default_KID value
in the tenc box" - this means that a) content packager cannot omit the PSSH in the moov and default_KID in tenc and b) that it is for "allowing to access content" which means it always needs to fetch a valid license.

If the content packaging providers do not update the init-data, it will have a PSSH for a key that has long since rotated. One particular packaging provider is adding PSSH to every moof, and their expectation was that since the default_KID/PSSH in moof overrides the one in the init-data/moov, the stream should play fine.

For the players/parsers - they have no way of knowing after downloading the init-data that they can or should ignore the PSSH in the init-data. Players will send out the license request as soon as they see the PSSH. A player cannot distinguish easily if the key resulting from the PSSH in the init-data may still be required (for example it may be required to decrypt content until the first in-band key rotation) or not (when the init-data is not updated by the packaging provider). Due to this, it will always issue a license request.

If packaging providers do not update the init-data for each key-rotation this will result in a request for a license that will never be used (which is inefficent and wasteful) and there is also burden on the license provider to provide a valid license response for a key that has already been rotated and no longer active, otherwise playback might fail.

DASH-IOP spec should provide some clarifications that the init-data needs to be updated at key-rotation, and that the same PSSH could be added to the moof segments that follow (until the next key rotation)

[markogle]

Updating the initialization segment on every key rotation requires a new period, which defeats the point of in-band signalling.

The added text in 5.1.0:

While not updating the default_KID value in the tenc box is a valid option and creates a compliant content, this can create unnecassry requests for licenses for devices joining when key rotation already occurred. Indeed, it is very likely that devices will make a license request based on the data provided in the initialization segment before looking at the KID value in a sgpd box with grouping_type ’seig’. This can be seen as a waste of ressources and potential errors, if, for example, the license server does not have access anymore to this content key. It is therefore recommended that, when in-band key rotation is applied, the default_KID value in the tenc box is updated with the KID that is currently valid.

Contradicts the previous paragraphs.

Perhaps a better alternative to avoid unnecessary license request would be to remove the requirement for signalling a pssh box in the init segment? In this way license requests will only be triggered when loading media segments.

[nicoweil]

Agreed that the best solution for inband key rotation is to make the signaling of pssh in init segments optional, as it will remove the unnecessary license requests. It will preserve the ability to NOT create new periods on key rotations just for the sake of signaling new init segments with the new pssh.

If pssh consistency between init files and media segments files is required for any reason, then in-manifest key rotation signaling is the only way to cleanly support it - at the expense of manifest verbosity, which is what the inband key rotation approach is trying to avoid in the first place.

[lpiron]

During the Oct 7 CPS call, we reviewed this. This is agreed that having the signaling of pssh in init segments optional is a good solution. The text will then be updated accordingly.