What is HLSe?
HLSe commonly refers to encrypted HLS, where media segments are protected with a cipher such as AES. The playlist specifies the encryption method and how an authorized player locates the key.
How HLSe works
HLSe is an informal name for HLS presentations whose media is encrypted according to playlist signaling. The playlist’s key directive identifies a protection method, key resource, and potentially an initialization vector that determines segment decryption. Encryption protects distributed bytes, while authorization and key-service policy determine who can obtain usable keys. The feature belongs at the packaging and playback boundary and should not be confused automatically with a full digital-rights-management system.
Key facts
- 1AES-128 HLS encrypts complete media segments with CBC mode, while SAMPLE-AES encrypts selected media samples; players and packagers must agree on the declared method and media structure.
- 2If no explicit initialization vector is supplied for AES-128, the media-sequence number is used to derive it, so incorrect sequence handling can make otherwise valid ciphertext undecodable.
- 3Serving the key over an unrestricted URL provides little access control beyond obscuring segment contents; authentication, transport security, rotation, and cache policy belong to the key service.
When HLSe matters
Developers configure HLSe when HLS segments require basic protection during distribution. Playback fails if key delivery, initialization vectors, cross-origin policy, or player support is misconfigured.