What is FairPlay DRM and how it works

What is FairPlay DRM?

FairPlay is Apple's DRM technology. FairPlay Streaming (FPS) securely delivers encryption keys for HTTP Live Streaming (HLS) content and protects playback on iOS, iPadOS, tvOS, macOS, and visionOS devices and in Safari. (Ref. 1) This lesson covers FairPlay Streaming.

A short history

FairPlay first protected music on the iTunes Store in the early 2000s. Because purchased music played only on Apple devices, Steve Jobs's 2007 "Thoughts on Music" letter led to DRM-free music on iTunes by 2009, while movies stayed protected. At WWDC 2015 Apple announced FairPlay Streaming and published its integration specification so that other services could use it. (Ref. 2)

Components and how they work

Key server and Key Security Module (KSM)

The key server manages the keys used to encrypt and decrypt content. DRM vendors or content services implement an FPS Key Security Module (KSM) on their key server, based on the reference in Apple's FPS Server SDK. The KSM validates the key request from the client and securely returns the content key.

The current release is FPS Server SDK 26. It adds stronger key protection for cbcs content, SPC v3 with integrity protection, and support for multiple certificate bundles. (Ref. 1)

Client application

The FPS client runs on Apple platforms, requests the content key from the key server, and passes the response to the system. Content services can build it from Apple's sample code or use an FPS SDK from a DRM vendor.

FPS content

FPS content is HLS content with these properties (Ref. 3):

• The playlist's key tag uses METHOD=SAMPLE-AES and KEYFORMAT="com.apple.streamingkeydelivery".
• fMP4/CMAF segments must use the cbcs scheme with a 1:9 pattern; the ctr (cenc) scheme isn't allowed.
• MPEG-TS segments use SAMPLE-AES.

Cipher-block chaining (CBC) uses the encryption result of the previous block as the initialization vector (IV) of the next block. cbcs encrypts only part of each video sample in a repeating pattern (1 of every 10 blocks), which lowers the decryption load. Note that HLS METHOD=AES-128 is a different method that encrypts whole segments, and it isn't FairPlay.

FPS key request flow

Apple's recommended client API is AVContentKeySession. On iOS, iPadOS, tvOS, and macOS apps the flow works like this (Ref. 4):

1. The app creates an AVContentKeySession and attaches it to the content.
2. When playback needs a key (from the skd:// URI in the playlist, or requested in advance by the app), the session sends a content key request to the app's delegate.
3. The app fetches the FPS certificate and asks the request to generate Server Playback Context (SPC) data.
4. The app sends the SPC to the key server.
5. The key server reads the SPC through the KSM and retrieves the content key.
6. The key server returns the key to the app as Content Key Context (CKC) data.
7. The app passes the CKC back to the session as a content key response.
8. The system decrypts and plays the content securely using the key in the CKC.

In Safari the steps are the same, but the web player handles them through the standard Encrypted Media Extensions (EME) API with the com.apple.fps key system.

Features and benefits

Hardware-level security

Every FPS client platform is secured at the hardware level. FPS is a must for content that needs a high level of security, such as early-window Hollywood movies. The HLS playlist can also require HDCP on the output (HDCP-LEVEL TYPE-0 for HD, TYPE-1 above HD).

Apple AirPlay support

FPS natively supports AirPlay, so FPS content can play on Apple TV without extra code. Key delivery and decryption happen on the Apple TV itself, at the same security level as on the original device.

Download and offline playback

FPS supports downloading HLS content and playing it offline with persistable content keys.

FPS credentials

With a multi-DRM vendor, you can use Widevine and PlayReady right away. FPS is different: the content service must request its own FPS credentials from Apple. The Account Holder of the service's Apple Developer Program team submits the request, and Apple approves only teams that provide a streaming service to consumers. DRM vendors can't request credentials on a customer's behalf, so the customer requests them and shares them with the vendor. (Ref. 1)

Credentials now come as a certificate bundle with both RSA-1024 and RSA-2048 certificates, plus a provisioning_data file that replaces the earlier Application Secret key (ASk).

Use cases

Besides basic streaming, FPS content keys support:

• Rental: keys with an expiry, including dual-expiry keys that set both a storage window and a playback window after first play.
• Lease and renewal: by renewing content keys periodically during playback, you can check and limit how many devices play at the same time on one account.
• Offline: persistable keys stored on the device for downloaded content.

Supported platforms and content formats

• Apple platforms: iOS, iPadOS, tvOS, macOS, visionOS, and Mac Catalyst apps; watchOS for audio
• Browsers: Safari on macOS, iOS, and iPadOS. Since iOS 17.1, Safari on iPhone supports Managed Media Source, so MSE-based web players can play FPS content there too.

See DoveRunner's supported environments for current per-platform details.

Content formats

• Streaming formats: HLS, CMAF (Apple's native players are HLS-only)
• Containers: MPEG-TS (SAMPLE-AES), fMP4 (cbcs)
• Video codecs: AVC (H.264), HEVC (H.265), Dolby Vision, AV1 (fMP4 only, on devices with AV1 hardware decoding)
• Audio codecs: AAC, AC3, E-AC-3 (including Dolby Atmos)

DoveRunner Multi-DRM is a cloud-based SaaS that manages PlayReady, Widevine, and FairPlay licenses through one integration.