ksm

README

ksm

Apple FairPlay Streaming (FPS) securely delivers keys to Apple mobile devices, Apple TV, and Safari on OS X, which will enable playback of encrypted video content.

This project is FairPlay Streaming Key Security Module written in Go (Golang).

Usage

Start using it

Download and install it:

$ go get github.com/easonlin404/ksm

Verify ckc

Perform verification utility verify_ckc to test KSM implementation.

testdata/verify_ckc -s testdata/FPS/spc1.bin -c testdata/FPS/ckc1.bin

Simple example

See example/basic.go

package main

import (
	"encoding/base64"
	"fmt"
	"math/rand"
	"net/http"

	"github.com/easonlin404/ksm"
	"github.com/easonlin404/ksm/d"
	"github.com/gin-gonic/gin"
	"github.com/gin-gonic/gin/binding"
)

func main() {

	r := gin.Default()

	type SpcMessage struct {
		Spc     string `json:"spc" binding:"required"`
		AssetId string `json:"assetId"`
	}

	r.POST("/fps/rest/getLicense", func(c *gin.Context) {
		var spcMessage SpcMessage
		if err := c.ShouldBindWith(&spcMessage, binding.JSON); err != nil {
			c.JSON(http.StatusBadRequest, gin.H{
				"err": err.Error(),
			})
			return
		}

		fmt.Printf("%v\n", spcMessage)

		playback, err := base64.StdEncoding.DecodeString(spcMessage.Spc)
		checkError(err)

		k := &ksm.Ksm{
			Pub:       pub,
			Pri:       pri,
			Rck:       RandomContentKey{},
			DFunction: d.AppleD{},
			Ask:       []byte{},
		}
		ckc, err2 := k.GenCKC(playback)
		checkError(err2)

		ckcBase64 := base64.StdEncoding.EncodeToString(ckc)
		c.JSON(http.StatusOK, gin.H{
			"ckc": ckcBase64,
		})
	})

	r.Run(":8080")

}

func checkError(err error) {
	if err != nil {
		panic(err)
	}
}

type RandomContentKey struct {
}

func (RandomContentKey) FetchContentKey(assetId []byte) ([]byte, []byte, error) {
	key := make([]byte, 16)
	iv := make([]byte, 16)
	rand.Read(key)
	rand.Read(iv)
	return key, iv, nil
}

func (RandomContentKey) FetchContentKeyDuration(assetId []byte) (*ksm.CkcContentKeyDurationBlock, error) {

	LeaseDuration := rand.Uint32()  // The duration of the lease, if any, in seconds.
	RentalDuration := rand.Uint32() // The duration of the rental, if any, in seconds.

	return ksm.NewCkcContentKeyDurationBlock(LeaseDuration, RentalDuration), nil
}

Documentation

Index

• func DebugCKC(ckcplayback []byte)
• type CKCContainer
  • func (c *CKCContainer) Serialize() []byte
• type CKCPayload
• type CkcContentKeyDurationBlock
  • func NewCkcContentKeyDurationBlock(LeaseDuration, RentalDuration uint32) *CkcContentKeyDurationBlock
• type CkcDataIv
• type CkcEncryptedPayload
• type CkcR1
• type ContentKey
• type DecryptedSKR1Payload
• type Ksm
  • func (k *Ksm) GenCKC(playback []byte) ([]byte, error)
• type RandomContentKey
  • func (RandomContentKey) FetchContentKey(assetId []byte) ([]byte, []byte, error)
  • func (RandomContentKey) FetchContentKeyDuration(assetId []byte) (*CkcContentKeyDurationBlock, error)
• type SKR1TLLVBlock
• type SPCContainer
  • func ParseSPCV1(playback []byte, pub, pri string) (*SPCContainer, error)
• type TLLVBlock
  • func NewTLLVBlock(tag uint64, value []byte) *TLLVBlock
  • func (t *TLLVBlock) Serialize() ([]byte, error)

Functions

func DebugCKC

func DebugCKC(ckcplayback []byte)

DebugCKC debbug ckcplayback content

Types

type CKCContainer

type CKCContainer struct {
	CKCVersion       uint32 //0x00000001
	Reserved         []byte
	CKCDataInitV     []byte //A random 16-byte initialization vector, generated by the KSM
	CKCPayload       []byte //A variable-length set of contiguous TLLV blocks
	CKCPayloadLength uint32 //The number of bytes in the encrypted CKC payload.
}

CKCContainer represents a container to contain CKC message filed.

func (*CKCContainer) Serialize

func (c *CKCContainer) Serialize() []byte

Serialize serializes CKCContainer message byte array.

type CKCPayload

type CKCPayload struct {
	SK             []byte //Session key
	HU             []byte
	R1             []byte
	IntegrityBytes []byte
}

CKCPayload is a object that store ckc payload.

type CkcContentKeyDurationBlock

type CkcContentKeyDurationBlock struct {
	*TLLVBlock

	LeaseDuration  uint32 // 16-19, The duration of the lease, if any, in seconds.
	RentalDuration uint32 // 20-23, The duration of the rental, if any, in seconds.
	KeyType        uint32 // 24-27,The key type.

}

CkcContentKeyDurationBlock represents a ckc content key duration block structure.

func NewCkcContentKeyDurationBlock

func NewCkcContentKeyDurationBlock(LeaseDuration, RentalDuration uint32) *CkcContentKeyDurationBlock

NewCkcContentKeyDurationBlock creates a new a ckc content key duration block object using the specified lease duration and rental duration.

type CkcDataIv

type CkcDataIv struct {
	IV []byte
}

CkcDataIv represents a ckc data iv structure.

type CkcEncryptedPayload

type CkcEncryptedPayload struct {
	Payload []byte
}

CkcEncryptedPayload represents a ckc encrypted payload structure.

type CkcR1

type CkcR1 struct {
	R1 []byte
}

CkcR1 represents a ckcR1 structure.

type ContentKey

type ContentKey interface {
	FetchContentKey(assetId []byte) ([]byte, []byte, error)
	FetchContentKeyDuration(assetId []byte) (*CkcContentKeyDurationBlock, error)
}

ContentKey is a interface that fetch asset content key and duration.

type DecryptedSKR1Payload

type DecryptedSKR1Payload struct {
	SK             []byte //Session key
	HU             []byte
	R1             []byte
	IntegrityBytes []byte
}

DecryptedSKR1Payload represents a decrypted SKR1 payload structure.

type Ksm

type Ksm struct {
	Pub       string
	Pri       string
	Rck       ContentKey
	Ask       []byte
	DFunction d.D
}

Ksm represents a ksm object.

func (*Ksm) GenCKC

func (k *Ksm) GenCKC(playback []byte) ([]byte, error)

GenCKC computes the incoming server playback context (SPC message) returned to client by the SKDServer library.

type RandomContentKey

type RandomContentKey struct {
}

CKCPayload is a object that implements ContentKey interface.

func (RandomContentKey) FetchContentKey

func (RandomContentKey) FetchContentKey(assetId []byte) ([]byte, []byte, error)

FetchContentKey returns content key and iv for the given assetId.

func (RandomContentKey) FetchContentKeyDuration

func (RandomContentKey) FetchContentKeyDuration(assetId []byte) (*CkcContentKeyDurationBlock, error)

FetchContentKeyDuration returns CkcContentKeyDurationBlock for the given assetId.

type SKR1TLLVBlock

type SKR1TLLVBlock struct {
	TLLVBlock
	IV      []byte
	Payload []byte
}

SKR1TLLVBlock represents a SKR1 TLLV block structure.

type SPCContainer

type SPCContainer struct {
	Version           uint32
	Reserved          []byte
	AesKeyIV          []byte
	EncryptedAesKey   []byte
	CertificateHash   []byte
	SPCPlayload       []byte
	SPCPlayloadLength uint32

	TTLVS map[uint64]TLLVBlock
}

SPCContainer represents a container to contain SPC message filed.

func ParseSPCV1

func ParseSPCV1(playback []byte, pub, pri string) (*SPCContainer, error)

ParseSPCV1 parses playback, public and private key pairs to new a SPCContainer instance. ParseSPCV1 returns an error if playback can't be parsed.

type TLLVBlock

type TLLVBlock struct {
	Tag         uint64
	BlockLength uint32
	ValueLength uint32 //The number of bytes in the value field. This number may be any amount, including 0x0000
	Value       []byte
}

TLLVBlock represents a TLLV block structure.

func NewTLLVBlock

func NewTLLVBlock(tag uint64, value []byte) *TLLVBlock

NewTLLVBlock creates a new TLLVBlock object using the specified tag and value.

func (*TLLVBlock) Serialize

func (t *TLLVBlock) Serialize() ([]byte, error)

Serialize returns serialize byte array.