DRM player <\/a>associated with the video infrastructure handler (step 1-4) will carry the next parts.<\/p>\nNow the player receives a request to play the encrypted video.<\/p>\n
Step 6: Process m3u8<\/h3>\n
The player will first go to the m3u8 file to check what files are there. Since the video segments will first need a decryption and for that they will require the content-key to decrypt. It will find video file segments and License server url for the key.<\/p>\n
Step 7: Create SPC (Server Playback Context) Package<\/h3>\n
This is where the FairPlay Module<\/b> comes into play. The player\/application will now request the FairPlay module which can be present in the Apple device kernel or CDM to make the SPC. The application obtains or uses the FairPlay application certificate \/ public-key-related material and content identifier, then asks the OS\/FairPlay stack to generate the SPC. If verification is successful, the module will make a new session key, and encrypt the session key as well as all other information related to the video with the RSA public key.\u00a0 This encrypted package is called SPC and this will be now sent to the license server. The SPC includes protected cryptographic context such as the session key, anti-replay seed, integrity information, and authentication materials.<\/p>\nStep 8: Create CKC (Content Key Context) Package<\/h3>\n
Now the license server will receive this encrypted package and will decrypt it with the private key file (.pem) and provisioning data file. From there it will get the session key and other information. It will match the information and if successful, it will then encrypt the content-key and other information with the session key and will prepare an encrypted package called CKC and will send it back to the FairPlay module.<\/p>\n
Step 9: Read CKC and Decrypt<\/h3>\n
Once the CKC is received, FairPlay unwraps the protected content key and IV, creates the play context, and decryption proceeds in the protected playback path. The resulting frames\/samples are passed to the decoder rather than exposing the raw content key or fully decrypted media to normal app logic.<\/p>\n
Step 10: Video Plays<\/h3>\n
When the decrypted segment is passed to the player, the user will start seeing the playback. The whole process is so fast that the user does not even realize how many steps have been performed to ensure this authorized playback.<\/p>\n
FairPlay DRM Streaming Terminologies<\/b><\/h2>\n
While understanding Apple FairPlay Streaming (FPS) or DRM on Apple devices you would have found several critical terminologies like in the above steps. Here\u2019s a simple explanation of these terminologies and how they interact to protect your streaming content:<\/p>\n
FairPlay Streaming (FPS)<\/b><\/h3>\n
Apple\u2019s DRM system used to protect video delivered over HLS<\/b> on Apple devices and Safari. It handles secure key exchange and protected playback.<\/p>\nHLS (HTTP Live Streaming)<\/b><\/h3>\n
Apple\u2019s streaming protocol used for video delivery. It works through .m3u8<\/b> playlists<\/b> and media segments such as TS<\/b> or fMP4\/CMAF<\/b>. FairPlay works with HLS.<\/p>\nContent ID<\/b><\/h3>\n
A unique identifier for a video asset. The license server\/KSM uses it to find the correct content key<\/b> and IV<\/b> for that video.<\/p>\nContent Key<\/b><\/h3>\n
The AES key<\/b> used to encrypt and decrypt the actual video\/audio content. This is the key that finally unlocks the media segments during playback.<\/p>\nIV (Initialization Vector)<\/b><\/h3>\n
An additional cryptographic value used along with the content key during encryption\/decryption. It helps make the encryption secure and non-repetitive.<\/p>\n
KSM (Key Security Module)<\/b><\/h3>\n
The backend server component on the content provider\u2019s side that handles FairPlay key exchange<\/b>. It receives the SPC<\/b>, validates it, looks up the correct content key and IV, creates the CKC<\/b>, and sends it back. In simple terms, KSM is the actual FairPlay key server logic.<\/p>\nLicense Server<\/b><\/h3>\n
A broader and easier term often used for the server that delivers playback authorization and keys. In FairPlay context, this is usually the KSM<\/b> or the server endpoint backed by KSM logic.<\/p>\nClient Application<\/b><\/h3>\n
The app, website player, or playback application that starts the FairPlay flow. It does not manually generate raw keys. It asks Apple\u2019s FairPlay system to create the SPC<\/b>, sends it to the license server, receives the CKC<\/b>, and passes it back to FairPlay.<\/p>\nFairPlay Module<\/b><\/h3>\n
Apple\u2019s protected DRM component on the client side. It creates the SPC<\/b>, consumes the CKC<\/b>, unwraps the protected content key, and enables secure playback. On iOS and Apple TV, Apple says key handling and content decryption occur in the kernel<\/b>.<\/p>\nApplication Certificate \/ FairPlay Certificate<\/b><\/h3>\n
Certificate material used in the FairPlay flow so the client-side FairPlay system can create a valid SPC<\/b> for the provider\u2019s server-side setup.<\/p>\nSPC (Server Playback Context)<\/b><\/h3>\n
The encrypted request blob created by FairPlay on the client side. It is sent to the KSM\/license server. It contains protected cryptographic\/session context needed by the server to prepare the playback response.<\/p>\n
CKC (Content Key Context)<\/b><\/h3>\n
The encrypted response blob created by the KSM\/license server and returned to the client. It contains the protected content key context that FairPlay consumes to enable playback.<\/p>\n
Session Key<\/b><\/h3>\n
A temporary cryptographic key\/session context used during the SPC <> CKC<\/b> exchange. It is not the same as the content key. It helps securely deliver the content key for that playback transaction.<\/p>\nAnti-Replay<\/b><\/h3>\n
A protection mechanism that helps prevent reusing the same captured license request\/response again and again. It makes the FairPlay transaction tied to a valid playback session rather than being endlessly reusable.<\/p>\n
Private Key File (.pem)<\/b><\/h3>\n
The KSM\u2019s RSA private key file used on the server side to handle SPC processing and FairPlay key delivery. It must match the correct FairPlay certificate pair.<\/p>\n
Packaging\/Encryption Backend<\/b><\/h3>\n
The provider-side backend that encrypts the HLS media during ingest\/package time and stores the mapping of content ID >> content key + IV + policy<\/b>. It prepares the assets that the KSM later serves securely through FairPlay playback.<\/p>\nMaster Playlist (<\/b>master.m3u8<\/b>)<\/b><\/h3>\n
The top-level HLS playlist that lists multiple bitrate\/resolution variants such as 1080p, 720p, and 480p.<\/p>\n
Media Playlist<\/b><\/h3>\n
A lower-level HLS playlist for one specific rendition. It contains references to the actual media segments.<\/p>\n
Segments (<\/b>.ts<\/b>, <\/b>.m4s<\/b>, etc.)<\/b><\/h3>\n
The small chunked media files that actually contain the encrypted video\/audio data. These are what get decrypted during playback.<\/p>\n
EXT-X-KEY<\/b><\/h3>\n
The HLS playlist tag used to signal how the stream is protected and how key delivery should happen. In FairPlay, this carries FairPlay-specific key-delivery signaling rather than exposing a plain reusable key file.<\/p>\n
Protected Playback Path<\/b><\/h3>\n
The secure playback flow where FairPlay handles the protected key material and decryption without exposing the raw key to normal app logic. On iOS and Apple TV, Apple says this handling occurs in the kernel<\/b>.<\/p>\nDecoder<\/b><\/h3>\n
The media component that finally receives the decrypted frames\/samples for playback after FairPlay has enabled secure decryption.<\/p>\n
Explainer Video<\/h2>\n
![\"\"](\"https:\/\/www.vdocipher.com\/blog\/wp-content\/uploads\/2026\/03\/fairplay-drm-working-explained.png\")
<\/p>\n