What a Key Delivery Message Lets One Cinema Screen Play, and for How Long

A feature film reaches a cinema as a set of encrypted files, and a second file decides whether the screen can open them. The Digital Cinema Package carries the film, and the Key Delivery Message, or KDM, carries the keys. Together they control which machine can play a title and for how long.

The system rests on two bodies of rules. Digital Cinema Initiatives, a consortium formed in March 2002 by major studios, issues the DCI specification, which sets the system requirements. SMPTE standards cover the file formats and messages that the specification relies on. The sections below follow the path from package to playback.

What the Digital Cinema Package Holds

According to Wikipedia, the DCI specification describes how a DCP is built from a Digital Cinema Distribution Master, and it covers content protection, encryption and forensic marking.

A 2011 article from 709 Media Room describes what is locked. Encryption covers the audio and video track files, which are MXF files, and uses 128-bit AES. The XML metadata is not encrypted. A hash check through the Packing List protects it instead.

Cinepedia says each essence file gets its own key, and that a track file may be split into essence files along time boundaries. A long feature could therefore use many keys. Cinepedia says each content key is encrypted and included in the KDM.

One Key Pair Per Server
According to 709 Media Room, each cinema server holds a private key in internal memory that is not accessible from outside the manufacturer, and its public key is unique to that server, so a KDM can be opened only by the server it was made for.

Why Each Cinema Server Gets Its Own Key

Every cinema receives the same encrypted package, so the KDM is what makes a copy playable. The 709 Media Room article says each DCI-compliant server holds a software private key in internal memory. It also says the manufacturer gives the server owner a public key that is unique to that server, and that the private key cannot be accessed or reprogrammed by anyone outside the manufacturer.

The article says the KDM is an XML file encrypted with RSA. It is generated with the public key of one server and holds the AES decryption key for the MXF files, also encrypted. Only the server with the matching private key can open it. A key that opens one server’s copy of a film does nothing for any other machine.

Cinepedia describes the same design from the KDM side. Each content key is encrypted with the target media block’s public key. Because the keys are encrypted, a KDM that reaches the wrong destination does not compromise the Composition. Trust is set when the KDM is created, so distribution is a logistics matter rather than a security one.

Keys also pass down the supply chain. Cinepedia says a studio creates a distribution KDM, or D-KDM, for a fulfilment entity. That message is targeted at a trusted device owned by the entity. The fulfilment entity uses the D-KDM, along with the Trusted Device List and booking information, to create exhibition KDMs for theatres. The two have identical structure and differ only in name and use.

What a KDM Specifies

Cinepedia lists the main contents. The message holds the encrypted content keys, a UUID copied from the Composition Playlist that ties it to one version of the film, forensic marking instructions, and a recipient identifier. The UUID follows RFC 4122.

The recipient identifier is a SHA-1 thumbprint of the target device’s public key, taken from its Digital Cinema Certificate. Cinepedia says SMPTE ST 430-2 places the thumbprint in the certificate’s dnQualifier attribute, and that the KDM must carry the certificate’s Subject Name. Theatre management systems can use the thumbprint to route KDMs, and media blocks can use it to pull their own.

The validity window is stated in clear text as not-valid-before and not-valid-after UTC times. Cinepedia says the times that playback equipment enforces are encrypted with each content key, and that the clear-text and encrypted values must match. According to Cinepedia, a window could run for hours, weeks or months.

The sources describe the validity period differently. The 2011 709 Media Room article says the KDM carries the contracted days for the film, along with its age rating. Cinepedia describes the UTC window instead. Cinepedia also says the KDM is digitally signed under W3C XML signature rules, with details in SMPTE ST 430-2 and ST 430-3.

Forensic Marking and the Limits of a Single Key

By default, a DCI-compliant media block marks picture and sound in real time, according to Cinepedia. A flag in the KDM can turn that marking off or apply it selectively. Cinepedia gives one reason for switching it off: honouring a director’s wish for no alteration at a premiere.

The selective option is commonly used to mark only audio channels. That leaves non-audio data unmodified, such as the motion seat data carried in the audio track file.

Cinepedia says a KDM targets one playback device, and that each version of a film is a separate Composition needing its own KDM. If a KDM reaches the wrong destination, the Composition is not compromised, and only the targeted device can play it under the KDM’s conditions.

Taken together, these details tie each KDM to one device, one version and one time window.

A key that opens one server’s copy of a film does nothing for any other machine.

Who Writes the Rules

Digital Cinema Initiatives, LLC is a consortium of major motion picture studios, headquartered in California. Wikipedia lists its founding members as Metro-Goldwyn-Mayer, Paramount Pictures, Sony Pictures, 20th Century Studios, Universal Studios, Walt Disney Studios and Warner Bros. Entertainment.

Wikipedia notes two withdrawals. Metro-Goldwyn-Mayer left in May 2005, before the DCI Specification was released. 20th Century Studios left in March 2019, after merging with The Walt Disney Company.

The DCI specification does not define how data inside a distribution package is formatted. Wikipedia says that job falls to SMPTE standards. It also says the specification is based on many SMPTE and ISO standards, including JPEG 2000 image compression and PCM/WAV sound.

The Standards and Revisions Behind the Message

Cinepedia names the standards for each part. SMPTE ST 430-1 covers the KDM, ST 430-2 covers the Digital Cinema Certificate, and ST 430-3 covers the Extra-Theater Message on which the KDM is built. ST 429-6 defines MXF track file essence encryption and its key identifier, which lets the media block match each key to its track file.

Cinepedia notes that in practice only the KDM uses the Extra-Theater Message. Wikipedia’s footnotes list ST 430-1:2017 for the Key Delivery Message, with Amendment 1 from 2019, and ST 430-9:2008 for the Key Delivery Bundle, with Amendment 1 from 2011.

Wikipedia gives a version history for the DCI specification. Version 1.0 was released July 20, 2005, and 1.1 on April 12, 2007. Version 1.3 was approved June 27, 2018, integrating 45 errata. Version 1.4 was issued July 20, 2020, followed by 1.4.1, approved October 13, 2021, and 1.4.2, dated June 15, 2022.

According to Wikipedia, 1.4.2 includes revisions and refinements for object-based audio essence, also called the Immersive Audio Bitstream, and adds post-show log record collection using SMPTE 430-17. Wikipedia’s footnotes list 62 SMPTE engineering guidelines, recommended practices, registered disclosure documents and standards adopted as of January 1, 2023.