blindcast encrypt

blindcast encrypt takes a directory of plain HLS segments (.ts files + .m3u8 manifest), encrypts each segment with AES-128-CBC, and rewrites the manifest with EXT-X-KEY tags pointing at your key server.

Usage

blindcast encrypt <directory> --content-id <id> [flags]

Example

blindcast encrypt ./segments --content-id my-video-001

Encrypting 12 segments in ./segments...
  [100%] 12/12 segments encrypted
Manifest rewritten with EXT-X-KEY tags.

Output: ./segments/encrypted/
├── manifest.m3u8     (rewritten with EXT-X-KEY)
├── seg-0.ts          (encrypted)
├── seg-1.ts          (encrypted)
└── ...

Flags

Flag	Default	Description
`--content-id <id>`	(required)	Unique identifier for this content. Used for key derivation. Alphanumeric, hyphens, underscores only.
`--key <hex>`	`$BLINDCAST_MASTER_KEY`	Master key as hex string
`--salt <hex>`	`$BLINDCAST_SALT`	Salt as hex string
`--out <directory>`	`<input>/encrypted`	Output directory for encrypted files
`--key-server-url <url>`	`http://localhost:4100/keys`	Key server URL written into the manifest’s `EXT-X-KEY` tags
`--json`	—	Output results as JSON to stdout

What happens

Reads the .m3u8 manifest and all .ts segments from the input directory
Derives a content key from the master key using HKDF-SHA-256 with the content ID as info
Encrypts each segment with AES-128-CBC using the content key and a derived IV
Rewrites the manifest, adding EXT-X-KEY tags with METHOD=AES-128, the key server URL, and per-segment IVs
Writes encrypted segments and the rewritten manifest to the output directory

IVs

Each segment gets a deterministic IV derived from SHA-256(contentId + ":" + segmentIndex), truncated to 16 bytes. This prevents chosen-plaintext attacks while keeping IVs reproducible (no random state to store).

Content ID rules

The --content-id value:

Must be 1–256 characters
Only alphanumeric characters, hyphens (-), and underscores (_)
Is used as the HKDF info parameter — different content IDs produce different keys from the same master key

Preparing HLS segments

The CLI encrypts pre-existing HLS segments. To create HLS segments from a video file, use FFmpeg:

ffmpeg -i input.mp4 \
  -codec: copy \
  -start_number 0 \
  -hls_time 6 \
  -hls_list_size 0 \
  -f hls \
  segments/manifest.m3u8

This creates segments/manifest.m3u8 with seg-0.ts, seg-1.ts, etc. Then encrypt them with blindcast encrypt ./segments --content-id my-video.

Introduction

Getting Started

Server

Player

CLI

Uploader

Key Server

Serverless

Going to Production

Reference

Usage

Example

Flags

What happens

IVs

Content ID rules

Preparing HLS segments

​Usage

​Example

​Flags

​What happens

​IVs

​Content ID rules

​Preparing HLS segments

Usage

Example

Flags

What happens

IVs

Content ID rules

Preparing HLS segments