Key rotation
Key rotation, in video streaming, is the practice of changing the encryption keys that protect a stream at regular intervals, instead of using one key for the whole video or event. If one key leaks, it only unlocks a short part of the content. Key rotation is most common in live streaming and long-running linear channels.
Why it matters
Live sports and premium channels run for hours, so a single leaked key could expose a whole event. Rotating keys limits the damage of any one leak and raises the cost of pirating a live stream. It also adds load on license and key systems, which must keep up during peak audiences.
How it works
- The packager encrypts the stream with one key for a set period, such as a few minutes or hours.
- At each rotation point, it switches to a new key and signals the change in the manifest.
- Players fetch the new key or license before they reach the segments that use it.
- Old keys cannot unlock new content, so a leaked key exposes only one period.
How often should encryption keys be rotated for live streams?
There is no single standard interval. Services rotate anywhere from every few minutes to every few hours, balancing security against load on license and key servers. Shorter periods limit leaks more but mean more key requests during peak audiences. For premium events, rights holder contracts sometimes set the interval.
Does key rotation affect playback?
Key rotation should not affect playback if it is set up well. Players need the next key before reaching the segments that use it, so manifests usually announce new keys in advance. If key delivery is slow or fails at a rotation point, viewers can see a stall or an error, so key servers must handle bursts of requests.
Where it's used
Live sports rights holders and OTT services running live channels use key rotation so that a single leaked key exposes only a short stretch of a premium event, not hours of content.
By the numbers
- In HLS, an EXT-X-KEY tag applies to every media segment that follows it until the next EXT-X-KEY tag, which is how a playlist switches to a new key. (IETF RFC 8216: HTTP Live Streaming)
