Multiple PSSH boxes in init data

[Gilles Boccon-Gibod]

Using the the shaka player library on Chrome, with CENC-encrypted media, and widevine DRM, does not seem to support streams that have more than one PSSH box.

It is not 100% clear from the spec if this is something that the CDM should handle, or if the shaka player lib should.

When a stream with init segments that contain two PSSH boxes, one for Widevine and one for generic EME, Chrome fires a player error event. The same stream with *just* the Widevine PSSH box in the init segment plays correctly.

The relevant part of the spec says:

-------------

3. Initialization Data and Events

Common Encryption files may contain one or more protection system specific header ('pssh') boxes, each for a unique SystemID at each location where a 'pssh' box is necessary.

Initialization Data is always one or more concatenated 'pssh' boxes. An implementation (the user agent and/or CDM) must be able to examine multiple 'pssh' boxes in the Initialization Data to find a 'pssh' box that it supports. At least one of the concatenated 'pssh' boxes should contain the SystemID defined in the Common SystemID and PSSH Box Format section.

Each time one or more 'pssh' boxes are encountered, the Initialization Data encountered algorithm shall be invoked with initDataType = "cenc" and initData = the 'pssh' box(es). Multiple 'pssh' boxes must be provided together if and only if they appear directly next to each other in the file.

------------------------

The part about "An implementation (the user agent and/or CDM) must be able to examine multiple 'pssh' boxes" implies that this expected to work, but it isn't clear if the fault is with the Widevine CDM, or if the shaka library is supposed to dis-aggregate the two PSSH boxes, and only feed the Widevine box to the widevine CDM (which is the one used in my case).

The two PSSH boxes in my test case look like this:

[pssh] size=12+40, version=1
  system_id = [10 77 ef ec c0 b2 4d 02 ac e3 3c 1e 52 e2 fb 4b]
  data_size = 0
  kid 0 = [cf 78 c4 07 4c 10 5d 96 a8 65 54 d6 62 3c 69 94]

[pssh] size=12+63
  system_id = [ed ef 8b a9 79 d6 4a ce a3 c8 27 dc d5 1d 21 ed]
  data_size = 43

  data = [08 01 12 10 cf 78 c4 07 4c 10 5d 96 a8 65 54 d6 62 3c 69 94 1a 0d 77 69 64 65 76 69 6e 65 5f 74 65 73 74 22 06 00 11 22 33 44 55]

[Joey Parrish]

Hi Gilles,

The library doesn't do anything special in terms of parsing PSSHs.  It passes the init data directly from the 'encrypted' event to generateKeyRequest.

Can you please provide a multi-pssh sample that fails?

Thanks,
Joey

--
You received this message because you are subscribed to the Google Groups "Shaka Player Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to shaka-player-us...@googlegroups.com.
To post to this group, send email to shaka-pla...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/shaka-player-users/ad901ff2-d67f-403b-a2fe-92b852398237%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Gilles Boccon-Gibod]

Here's an mpd for a stream with two PSSH boxes (widevine and generic-cenc-eme) in the init segments (does not work with shaka-player on Chrome 40):

http://www.bok.net/tmp/dash/wv_test8/stream.mpd

-->  Player error CustomEvent {detail: Error: EME v0.1b key error, clipboardData: undefined, path: NodeList[0], cancelBubble: false, returnValue: true…}

Here's an mpd for the same stream with only the widevine PSSH box (this works with shaka-player on Chrome 40):

http://www.bok.net/tmp/dash/wv_test9/stream.mpd

To unsubscribe from this group and stop receiving emails from it, send an email to shaka-player-users+unsub...@googlegroups.com.

[Joey Parrish]

The problem appears to be that your generic CENC PSSH box is malformed.

size=52  'pssh'   v1

00000034 70737368 01000000

SystemID

1077efecc0b24d02ace33c1e52e2fb4b

DataSize=1

00000001

Data, actual size=20

880603df6d455f509a79c02014e0a14300000000

I expect that the Widevine CDM can't find the second (Widevine) PSSH box because the DataSize of the first one is incorrect.

Here's the relevant part of the spec, ISO 23001-7:2012, sections 8.1.2 and 8.1.3:

8.1.2 Syntax 

aligned(8) class ProtectionSystemSpecificHeaderBox extends FullBox(‘pssh’, 

version=0, flags=0) 

{ 

 unsigned int(8)[16] SystemID; 

 unsigned int(32) DataSize; 

 unsigned int(8)[DataSize] Data; 

} 

8.1.3 Semantics 

SystemID specifies a UUID that uniquely identifies the content protection system that this header belongs to. 

DataSize specifies the size in bytes of the Data member. 

Data holds the content protection system specific data.

To work this out, I wrote a python script which will parse PSSH-type init data.  It reports on system IDs and warns if the data size and box size do not agree.  The script is attached, and I hope it is helpful.

How did you package your content?  Could this be a bug in your packager?

Thanks,

Joey

[Gilles Boccon-Gibod]

I think the PSSH box generated by my packager is correct, but that the PSSH parser in the CDM isn't paying attention to the box version (neither is your python script).

The 8.1.2 paragraph you're citing only shows the data structure for box version = 0. When version > 0, the data structure is different (I know, it is a pain to deal with when data structures change, that's why parsers should always refuse to deal with version numbers higher than what they have the spec for).

From ISO 23001-7 2nd edition:

aligned(8) class ProtectionSystemSpecificHeaderBox extends FullBox(‘pssh’, version, flags=0)

{

  unsigned int(8)[16] SystemID;

  if (version > 0) {

    unsigned int(32) KID_count;

    {

      unsigned int(8)[16] KID; 

    } [KID_count];

  }

  unsigned int(32) DataSize;

  unsigned int(8)[DataSize] Data; 

}

The generic CENC PSSH box is specified as requiring version=1 (see http://www.w3.org/TR/encrypted-media/cenc-format.html section 4)

[Joey Parrish]

Ah, I see!  Thanks for the pointers.  I need to update my spec documents.

I will update my script, which will probably make it into Shaka Player sources as a debugging tool at some point.  There's a JS-based parser in Shaka Player that needs to be updated, too, although it is currently only used for PSSH data that appears in an MPD.  I filed that one on github as issue #19.

It sounds like the Widevine CDM is making the same mistake I did in my parser.  I suggest you file a bug on chromium about the CDM ignoring the PSSH box version and throwing a key error.  If you CC me, I can do my best to make sure it gets to the right people.

In the mean time, as a work-around, you could try putting the v0 boxes before the v1 boxes.  That might give the CDM what it is looking for and resolve the key error.

Thanks,

Joey

--
You received this message because you are subscribed to the Google Groups "Shaka Player Users" group.

To unsubscribe from this group and stop receiving emails from it, send an email to shaka-player-us...@googlegroups.com.

To post to this group, send email to shaka-pla...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/shaka-player-users/e353731f-54d1-4cda-b453-21f03e44ad80%40googlegroups.com.

[Gilles Boccon-Gibod]

For a simple DASH stream, generated from a fragmented MP4 file:

Example 1: using existing PSSH data (obtained from a key server for example)

mp4-dash.py --widevine-header "#CAESEIgGA99tRV9QmnnAIBTgoUMaDXdpZGV2aW5lX3Rlc3QiBAEjRWcqAkhEMgA=" --encryption-key 880603df6d455f509a79c02014e0a143:6f0b0f06e536e4d71613974afac1c2ab  video.mp4

Example 2: generating the PSSH data from name:value pairs

mp4-dash --widevine-header provider:widevine_test#content_id:01234567 --encryption-key 880603df6d455f509a79c02014e0a143:6f0b0f06e536e4d71613974afac1c2ab  video.mp4

-- Gilles

On February 13, 2015 at 9:08:10 AM, Andrew Sinclair (ajsin...@gmail.com) wrote:

Hi Gilles,

Do you have a sample of using bento to generate a widevine CDM compatible DASH stream?

Thanks

To unsubscribe from this group and stop receiving emails from it, send an email to shaka-player-users+unsub...@googlegroups.com.

To post to this group, send email to shaka-pla...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/shaka-player-users/e353731f-54d1-4cda-b453-21f03e44ad80%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Shaka Player Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to shaka-player-us...@googlegroups.com.
To post to this group, send email to shaka-pla...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/shaka-player-users/2178d792-cf46-483c-b35a-d9ea7242bfb0%40googlegroups.com.