diff --git a/encrypted-media-respec.html b/encrypted-media-respec.html index 80c372b7..b68e4c4d 100644 --- a/encrypted-media-respec.html +++ b/encrypted-media-respec.html @@ -1,8 +1,10 @@ - + - Encrypted Media Extensions + + Encrypted Media Extensions + - +
-

This specification extends {{HTMLMediaElement}} [[HTML]] providing APIs to control playback of encrypted content.

-

The API supports use cases ranging from simple clear key decryption to high value video (given an appropriate user agent implementation). - License/key exchange is controlled by the application, facilitating the development of robust playback applications supporting a range of content decryption and protection technologies.

-

This specification does not define a content protection or Digital Rights Management system. Rather, it defines a common API that may be used to discover, select and interact with - such systems as well as with simpler content encryption systems. Implementation of Digital Rights Management is not required for compliance with this specification: only the - [=Clear Key=] system is required to be implemented as a common baseline.

-

The common API supports a simple set of content encryption capabilities, leaving application functions such as authentication and authorization to page authors. This is achieved by - requiring content protection system-specific messaging to be mediated by the page rather than assuming out-of-band communication between the encryption system and a license - or other server.

-
- -
+

+ This specification extends {{HTMLMediaElement}} [[HTML]] providing APIs to control playback + of encrypted content. +

+

+ The API supports use cases ranging from simple clear key decryption to high value video + (given an appropriate user agent implementation). License/key exchange is controlled by the + application, facilitating the development of robust playback applications supporting a + range of content decryption and protection technologies. +

+

+ This specification does not define a content protection or Digital Rights Management + system. Rather, it defines a common API that may be used to discover, select and interact + with such systems as well as with simpler content encryption systems. Implementation of + Digital Rights Management is not required for compliance with this specification: only the + [=Clear Key=] system is required to be implemented as a common baseline. +

+

+ The common API supports a simple set of content encryption capabilities, leaving + application functions such as authentication and authorization to page authors. This is + achieved by requiring content protection system-specific messaging to be mediated by the + page rather than assuming out-of-band communication between the encryption system and a + license or other server. +

- +
-

Introduction

+

+ Introduction +

- This specification enables script to select content protection mechanisms, control license/key exchange, and - execute custom license management algorithms. - It supports a wide range of use cases without requiring client-side modifications in each user agent for each use case. - This enables content providers to develop a single application solution for all devices. + This specification enables script to select content protection mechanisms, control + license/key exchange, and execute custom license management algorithms. It supports a wide + range of use cases without requiring client-side modifications in each user agent for each + use case. This enables content providers to develop a single application solution for all + devices.

- Supported content is encrypted per container-specific "common encryption" specifications, enabling use across key systems. - Supported content has an unencrypted container, enabling metadata to be provided to the application and maintaining compatibility with other {{HTMLMediaElement}} features. + Supported content is encrypted per container-specific "common encryption" specifications, + enabling use across key systems. Supported content has an unencrypted container, enabling + metadata to be provided to the application and maintaining compatibility with other + {{HTMLMediaElement}} features.

- Implementers should pay attention to the mitigations for the security and privacy threats and concerns described in this specification. - In particular, the specification requirements for security and privacy cannot be met without knowledge of the security and privacy properties of the [=Key System=] and its implementation(s). - contains security and privacy provisions related to the integration and use of underlying [=Key System=] implementations. - focuses on external threats, such as input data or network attacks. - focuses on the handling of user-specific information and providing users with adequate control over their own privacy. + Implementers should pay attention to the mitigations for the security and privacy threats + and concerns described in this specification. In particular, the specification requirements + for security and privacy cannot be met without knowledge of the security and privacy + properties of the [=Key System=] and its implementation(s). contains security and privacy provisions related to the + integration and use of underlying [=Key System=] implementations. + focuses on external threats, such as input data or network attacks. + focuses on the handling of user-specific information and providing users with adequate + control over their own privacy.

- While this specification is independent of the source of the media data, authors should be aware that many implementations only support decrypting media data provided via Media Source Extensions [[MEDIA-SOURCE]]. + While this specification is independent of the source of the media data, authors should be + aware that many implementations only support decrypting media data provided via Media + Source Extensions [[MEDIA-SOURCE]].

- A generic stack implemented using the API is shown below. - This diagram shows an example flow; other combinations of API calls and events are possible. -

- A generic stack implemented using the proposed APIs + A generic stack implemented using the API is shown below. This diagram shows an example + flow; other combinations of API calls and events are possible. +

A generic stack implemented using the proposed APIs
-
-

Definitions

- +

+ Definitions +

-
Content Decryption Module (CDM)
+
+ Content Decryption Module (CDM) +
-

Content Decryption Module (CDM) is the client component that provides the functionality, including decryption, for one or more [=Key Systems=].

+

+ Content Decryption Module (CDM) is the client component that provides the + functionality, including decryption, for one or more [=Key Systems=]. +

- Implementations may or may not separate the implementations of CDMs or treat them as separate from the user agent. - This is transparent to the API and application. + Implementations may or may not separate the implementations of CDMs or treat them as + separate from the user agent. This is transparent to the API and application.

- -
Key System
+
+ Key System +
-

A Key System is a generic term for a decryption mechanism and/or content protection provider. - Key System strings provide unique identification of a Key System. - They are used by the user agent to select a [=CDM=] and identify the source of a key-related event. - User agents MUST support the [=Common Key Systems=]. - User agents MAY also provide additional [=CDMs=] with corresponding Key System strings. +

+ A Key System is a generic term for a decryption mechanism and/or content protection + provider. Key System strings provide unique identification of a Key System. They are + used by the user agent to select a [=CDM=] and identify the source of a key-related + event. User agents MUST support the [=Common Key Systems=]. User agents MAY also + provide additional [=CDMs=] with corresponding Key System strings. +

+

+ A Key System string is always a reverse domain name. Key System strings are compared + using case-sensitive matching. It is RECOMMENDED that [=CDMs=] use simple lower-case + ASCII key system strings. +

+

+ For example, "com.example.somesystem".

- -

A Key System string is always a reverse domain name. - Key System strings are compared using case-sensitive matching. It is RECOMMENDED that [=CDMs=] use simple lower-case ASCII key system strings.

-

For example, "com.example.somesystem".

-

- Within a given system ("somesystem" in the example), subsystems may be defined as determined by the key system provider. - For example, "com.example.somesystem.1" and "com.example.somesystem.1_5". - Key System providers should keep in mind that these will be used for comparison and discovery, so they should be easy to compare and the structure should remain reasonably simple. + Within a given system ("somesystem" in the example), subsystems may be defined as + determined by the key system provider. For example, "com.example.somesystem.1" and + "com.example.somesystem.1_5". Key System providers should keep in mind that these will + be used for comparison and discovery, so they should be easy to compare and the + structure should remain reasonably simple.

- -
Key Session
+
+ Key Session +
-

A Key Session, or simply Session, provides a context for message exchange with the [=CDM=] as a result of which key(s) are made available to the [=CDM=]. - Sessions are embodied as {{MediaKeySession}} objects. - Each Key session is associated with a single instance of [=Initialization Data=] provided in the {{MediaKeySession/generateRequest()}} call. +

+ A Key Session, or simply Session, provides a context for message exchange with the + [=CDM=] as a result of which key(s) are made available to the [=CDM=]. Sessions are + embodied as {{MediaKeySession}} objects. Each Key session is associated with a single + instance of [=Initialization Data=] provided in the + {{MediaKeySession/generateRequest()}} call. +

+

+ Each Key Session is associated with a single {{MediaKeys}} object, and only media + element(s) associated with that {{MediaKeys}} object may access key(s) associated with + the session. Other {{MediaKeys}} objects, [=CDM=] instances, and media elements MUST + NOT access the key session or use its key(s). Key sessions and the keys they contain + are no longer [=usable for decryption=] once the session has been closed, including + when the {{MediaKeySession}} object is destroyed.

-

Each Key Session is associated with a single {{MediaKeys}} object, and only media element(s) associated with that {{MediaKeys}} object may access key(s) associated with the session. - Other {{MediaKeys}} objects, [=CDM=] instances, and media elements MUST NOT access the key session or use its key(s). - Key sessions and the keys they contain are no longer [=usable for decryption=] once the session has been closed, including when the {{MediaKeySession}} object is destroyed. +

+ All license(s) and key(s) associated with a Key Session which have not been explicitly + stored MUST be destroyed when the Key Session is closed.

- All license(s) and key(s) associated with a Key Session which have not been explicitly stored MUST be destroyed when the Key Session is closed. + [=Key IDs=] MUST be unique within a session.

-

[=Key IDs=] MUST be unique within a session.

- -
Session ID
+
+ Session ID +
-

A Session ID is a unique string identifier generated by the [=CDM=] that can be used by the application to identify {{MediaKeySession}} objects.

- -

A new Session ID is generated each time the user agent and [=CDM=] successfully create a new session.

- -

Each Session ID SHALL be unique within the browsing context in which it was created. - For session types for which the [=Is persistent session type?=] algorithm returns true, Session IDs MUST be unique within the [=origin=] over time, including across browsing sessions. +

+ A Session ID is a unique string identifier generated by the [=CDM=] that can be used by + the application to identify {{MediaKeySession}} objects. +

+

+ A new Session ID is generated each time the user agent and [=CDM=] successfully create + a new session. +

+

+ Each Session ID SHALL be unique within the browsing context in which it was created. + For session types for which the [=Is persistent session type?=] algorithm returns + true, Session IDs MUST be unique within the [=origin=] over time, + including across browsing sessions. +

+

+ The underlying content protection protocol does not necessarily need to support Session + IDs.

- -

The underlying content protection protocol does not necessarily need to support Session IDs.

- -
Key
+
+ Key +
-

Unless otherwise stated, key refers to a decryption key that can be used to decrypt blocks within [=HTMLMediaElement/media data=]. - Each such key is uniquely identified by a [=key ID=]. - A key is associated with the [=key session|session=] used to provide it to the [=CDM=]. (The same key may be present in multiple sessions.) - Such keys MUST only be provided to the [=CDM=] via an {{MediaKeySession/update()}} call. (They may later be loaded by {{MediaKeySession/load()}} as part of the stored session data.) +

+ Unless otherwise stated, key refers to a decryption key that can be used to decrypt + blocks within [=HTMLMediaElement/media data=]. Each such key is uniquely identified by + a [=key ID=]. A key is associated with the [=key session|session=] used to provide it + to the [=CDM=]. (The same key may be present in multiple sessions.) Such keys MUST only + be provided to the [=CDM=] via an {{MediaKeySession/update()}} call. (They may later be + loaded by {{MediaKeySession/load()}} as part of the stored session data.)

- -

Authors SHOULD encrypt each set of stream(s) that requires enforcement of a meaningfully different policy with a distinct key (and key ID). - For example, if policies may differ between two video resolutions, stream(s) containing one resolution should not be encrypted with the key used to encrypt stream(s) containing the other resolution. - When encrypted, audio streams SHOULD NOT use the same key as any video stream. - This is the only way to ensure enforcement and compatibility across clients. +

+ Authors SHOULD encrypt each set of stream(s) that requires enforcement of a + meaningfully different policy with a distinct key (and key ID). For example, if + policies may differ between two video resolutions, stream(s) containing one resolution + should not be encrypted with the key used to encrypt stream(s) containing the other + resolution. When encrypted, audio streams SHOULD NOT use the same key as any video + stream. This is the only way to ensure enforcement and compatibility across clients.

- -
Usable For Decryption
+
+ Usable For Decryption +
-

A key is considered usable for decryption if the [=CDM=] is certain the key is currently usable to decrypt one or more blocks of [=HTMLMediaElement/media data=].

-

For example, a key is not usable for decryption if its license has expired. Even if its license has not expired, a key is not usable for decryption if other conditions (e.g., output protection) for its use are not currently satisfied.

+

+ A key is considered usable for decryption if the [=CDM=] is certain the key is + currently usable to decrypt one or more blocks of [=HTMLMediaElement/media data=]. +

+

+ For example, a key is not usable for decryption if its license has expired. Even if its + license has not expired, a key is not usable for decryption if other conditions (e.g., + output protection) for its use are not currently satisfied. +

- -
Key ID
+
+ Key ID +
-

A [=key=] is associated with a key ID that is a sequence of octets and which uniquely identifies the key. - The container specifies the ID of the key that can decrypt a block or set of blocks within the [=HTMLMediaElement/media data=]. - [=Initialization Data=] MAY contain key ID(s) to identify the keys that are needed to decrypt the media data. - However, there is no requirement that Initialization Data contain any or all key IDs used in the [=HTMLMediaElement/media data=] or media resource. - [=Licenses=] provided to the [=CDM=] associate each key with a key ID so the [=CDM=] can select the appropriate key when decrypting an encrypted block of media data. +

+ A [=key=] is associated with a key ID that is a sequence of octets and which uniquely + identifies the key. The container specifies the ID of the key that can decrypt a block + or set of blocks within the [=HTMLMediaElement/media data=]. [=Initialization Data=] + MAY contain key ID(s) to identify the keys that are needed to decrypt the media data. + However, there is no requirement that Initialization Data contain any or all key IDs + used in the [=HTMLMediaElement/media data=] or media + resource. [=Licenses=] provided to the [=CDM=] associate each key with a key ID so + the [=CDM=] can select the appropriate key when decrypting an encrypted block of media + data.

- -
Known Key
+
+ Known Key +
-

A key is considered to be known to a session if the [=CDM=]'s implementation of the session contains any information - specifically the [=key ID=] - about it, regardless of whether the actual [=key=] is usable or its value is known. - Known keys are exposed via the {{MediaKeySession/keyStatuses}} attribute. +

+ A key is considered to be known to a session if the [=CDM=]'s implementation of the + session contains any information - specifically the [=key ID=] - about it, regardless + of whether the actual [=key=] is usable or its value is known. Known keys are exposed + via the {{MediaKeySession/keyStatuses}} attribute.

- -

Keys are considered known even after they become unusable, such as due to [=expiration=] or if they are removed but a [=record of license destruction=] is available. - Keys only become unknown when they are explicitly removed from a session and any license release message is acknowledged. +

+ Keys are considered known even after they become unusable, such as due to + [=expiration=] or if they are removed but a [=record of license destruction=] is + available. Keys only become unknown when they are explicitly removed from a session and + any license release message is acknowledged. +

+

+ For example, a key could become unknown if an {{MediaKeySession/update()}} call + provides a new license that does not include the key and includes instructions to + replace the license(s) that previously contained the key.

- -

For example, a key could become unknown if an {{MediaKeySession/update()}} call provides a new license that does not include the key and includes instructions to replace the license(s) that previously contained the key.

- -
License
+
+ License +
-

A license is key system-specific state information that includes one or more [=key(s)=] - each associated with a [=key ID=] - and potentially other information about key usage.

+

+ A license is key system-specific state information that includes one or more [=key(s)=] + - each associated with a [=key ID=] - and potentially other information about key + usage. +

- -
Initialization Data
+
+ Initialization Data +

- [=Key Systems=] usually require a block of initialization data containing information about the stream to be decrypted before they can construct a license request message. - This block could be a simple key or content ID or a more complex structure containing such information. - It SHOULD always allow unique identification of the [=key(s)=] needed to decrypt the content. - This initialization information MAY be obtained in some application-specific way or provided with the [=HTMLMediaElement/media data=]. + [=Key Systems=] usually require a block of initialization data containing information + about the stream to be decrypted before they can construct a license request message. + This block could be a simple key or content ID or a more complex structure containing + such information. It SHOULD always allow unique identification of the [=key(s)=] needed + to decrypt the content. This initialization information MAY be obtained in some + application-specific way or provided with the [=HTMLMediaElement/media data=].

-

- Initialization Data is a generic term for container-specific data that is used by a [=CDM=] to generate a license request. + Initialization Data is a generic term for container-specific data that is used by a + [=CDM=] to generate a license request.

-

- The format of the initialization data depends upon the type of container, and containers MAY support more than one format - of initialization data. The Initialization Data Type is a string that indicates the - format of the accompanying Initialization Data. Initialization Data Type strings are always matched case-sensitively. It is - RECOMMENDED that Initialization Data Type strings are lower-case ASCII strings. + The format of the initialization data depends upon the type of container, and + containers MAY support more than one format of initialization data. The Initialization Data Type is a string that indicates the format of the + accompanying Initialization Data. Initialization Data Type strings are always matched + case-sensitively. It is RECOMMENDED that Initialization Data Type strings are + lower-case ASCII strings.

-

- The [[[EME-INITDATA-REGISTRY]]] [[EME-INITDATA-REGISTRY]] - provides the mapping from [=Initialization Data Type=] string to the specification for each format. + The [[[EME-INITDATA-REGISTRY]]] [[EME-INITDATA-REGISTRY]] provides the mapping from + [=Initialization Data Type=] string to the specification for each format.

-

- When the user agent encounters Initialization Data in the [=HTMLMediaElement/media data=], it provides that Initialization Data to the application in the {{MediaEncryptedEvent/initData}} attribute of the {{encrypted}} event. - The user agent MUST NOT store the Initialization Data or use its content at the time it is encountered. - The application provides [=Initialization Data=] to the [=CDM=] via {{MediaKeySession/generateRequest()}}. - The user agent MUST NOT provide [=Initialization Data=] to the [=CDM=] by other means. + When the user agent encounters Initialization Data in the [=HTMLMediaElement/media + data=], it provides that Initialization Data to the application in the + {{MediaEncryptedEvent/initData}} attribute of the {{encrypted}} event. The user agent + MUST NOT store the Initialization Data or use its content at the time it is + encountered. The application provides [=Initialization Data=] to the [=CDM=] via + {{MediaKeySession/generateRequest()}}. The user agent MUST NOT provide [=Initialization + Data=] to the [=CDM=] by other means.

- -

Initialization Data MUST be a fixed value for a given set of stream(s) or [=HTMLMediaElement/media data=]. - It MUST only contain information related to the keys required to play a given set of stream(s) or [=HTMLMediaElement/media data=]. - It MUST NOT contain application data, client-specific data, user-specific data, or executable code. +

+ Initialization Data MUST be a fixed value for a given set of stream(s) or + [=HTMLMediaElement/media data=]. It MUST only contain information related to the keys + required to play a given set of stream(s) or [=HTMLMediaElement/media data=]. It MUST + NOT contain application data, client-specific data, user-specific data, or executable + code.

- -

Initialization Data SHOULD NOT contain Key System-specific data or values. - Implementations MUST support the common formats defined in [[EME-INITDATA-REGISTRY]] for each [=Initialization Data Type=] they support. +

+ Initialization Data SHOULD NOT contain Key System-specific data or values. + Implementations MUST support the common formats defined in [[EME-INITDATA-REGISTRY]] + for each [=Initialization Data Type=] they support.

- Use of proprietary formats/contents is discouraged, and supporting or using only proprietary formats is strongly discouraged. - Proprietary formats should only be used with pre-existing content or on pre-existing client devices that do not support the common formats. + Use of proprietary formats/contents is discouraged, and supporting or using + only proprietary formats is strongly discouraged. Proprietary formats should + only be used with pre-existing content or on pre-existing client devices that do not + support the common formats.

- -
Associable Value
+
+ Associable Value +

- Two or more identifiers or other values are said to be associable if they are identical or it is possible - with a reasonable amount of time and effort - to correlate or associate them. - Otherwise, the values are non-associable. + Two or more identifiers or other values are said to be associable if they are identical + or it is possible - with a reasonable amount of time and effort - to correlate + or associate them. Otherwise, the values are non-associable.

-

For example, values created in the following ways are [=associable=]:

+

+ For example, values created in the following ways are [=associable=]: +

    -

  • Using a trivially-reversible hash function.

    • -

  • Sharing a prefix or other subset

    • -

  • Replacing random value N with N+10

    • -

  • XORing the origin with a fixed value (because it is trivially reversible)

    • +
  • +

    + Using a trivially-reversible hash function. +

    +
    • +
  • +

    + Sharing a prefix or other subset +

    +
    • +
  • +

    + Replacing random value N with N+10 +

    +
    • +
  • +

    + XORing the origin with a fixed value (because it is trivially reversible) +

    +
-

In contrast, two values that are completely unrelated or cryptographically distinct, such as via a cryptographically strong non-reversible hash function, are [=non-associable=]

+

+ In contrast, two values that are completely unrelated or cryptographically distinct, + such as via a cryptographically strong non-reversible hash function, are + [=non-associable=] +

-

Two or more identifiers or other values are said to be associable by an entity if it is possible - with a reasonable amount of time and effort - for the referenced entity or set of entities to correlate or associate them without participation of additional entity(ies). - Otherwise, the values are non-associable by an entity. +

+ Two or more identifiers or other values are said to be associable by an + entity if it is possible - with a reasonable amount of time and effort - for the + referenced entity or set of entities to correlate or associate them without + participation of additional entity(ies). Otherwise, the values are non-associable + by an entity.

-

Two or more identifiers or other values are said to be non-associable by the application if they are [=non-associable by an entity=] - where the entity is the set that includes the application, all other applications, and other entities such as servers that they use or with which they communicate. - Otherwise, the values would be considered associable by the application, which is forbidden. +

+ Two or more identifiers or other values are said to be non-associable by the application if they are + [=non-associable by an entity=] where the entity is the set that includes the + application, all other applications, and other entities such as servers that they use + or with which they communicate. Otherwise, the values would be considered + associable by the application, which is forbidden.

- -
Distinctive Value
+
+ Distinctive Value +

- A Distinctive Value is a value, piece of data, implication of the possession of a piece of data, or an observable behavior or timing that is not shared across a large population of users or client devices. - A Distinctive Value may be in memory or persisted. + A Distinctive Value is a value, piece of data, implication of the possession of a piece + of data, or an observable behavior or timing that is not shared across a large + population of users or client devices. A Distinctive Value may be in memory or + persisted.

-

Examples of Distinctive Values include but are not limited to:

+

+ Examples of Distinctive Values include but are not limited to: +

    -

  • [=Distinctive Identifiers=]

    • -

  • [=Distinctive Permanent Identifiers=]

    • -

  • Other identifiers

    • -

  • [=Session IDs=]

    • -

  • [=Licenses=]

    • -

  • Other session data

    • +
  • +

    + [=Distinctive Identifiers=] +

    +
    • +
  • +

    + [=Distinctive Permanent Identifiers=] +

    +
    • +
  • +

    + Other identifiers +

    +
    • +
  • +

    + [=Session IDs=] +

    +
    • +
  • +

    + [=Licenses=] +

    +
    • +
  • +

    + Other session data +

    +
-
-

While a Distinctive Value is typically unique to a user or client device, a value does not need to be strictly unique to be distinctive. - For example, a value shared among a small number of users could still be distinctive. -

+ +

+ While a Distinctive Value is typically unique to a user or client device, a value does + not need to be strictly unique to be distinctive. For example, a value shared among a + small number of users could still be distinctive. +

- -
Permanent Identifier
+
+ Permanent Identifier +

- A Permanent Identifier is a value, piece of data, implication of the possession of a piece of data, or an observable behavior or timing that is indelible in some way or otherwise non-trivial for the user to remove, reset, or change. - This includes but is not limited to: + A Permanent Identifier is a value, piece of data, implication of the possession of a + piece of data, or an observable behavior or timing that is indelible in some way or + otherwise non-trivial for the user to remove, reset, or change. This includes but is + not limited to:

    -

  • A hardware or hardware-based identifier

    • -

  • A value provisioned in the hardware device in the factory

    • -

  • A value associated with or derived from the operating system installation instance

    • -

  • A value associated with or derived from the user agent installation instance

    • -

  • A value associated with or derived from the [=CDM=] or other software component

    • -

  • A value in a configuration file or similar semi-permanent data, even if generated on the client

    • -

  • Client or other user account values

    • +
  • +

    + A hardware or hardware-based identifier +

    +
    • +
  • +

    + A value provisioned in the hardware device in the factory +

    +
    • +
  • +

    + A value associated with or derived from the operating system installation instance +

    +
    • +
  • +

    + A value associated with or derived from the user agent installation instance +

    +
    • +
  • +

    + A value associated with or derived from the [=CDM=] or other software component +

    +
    • +
  • +

    + A value in a configuration file or similar semi-permanent data, even if generated + on the client +

    +
    • +
  • +

    + Client or other user account values +

    +
-

- A Distinctive Permanent Identifier is a [=Permanent Identifier=] that is [=distinctive=]. + A Distinctive Permanent + Identifier is a [=Permanent Identifier=] that is [=distinctive=].

- When exposed outside the client, Distinctive Permanent Identifiers and values derived from or otherwise related to them MUST be encrypted. - Distinctive Permanent Identifiers MUST NOT ever be exposed to the application, even in encrypted form. + When exposed outside the client, Distinctive Permanent Identifiers and values derived + from or otherwise related to them MUST be encrypted. + Distinctive Permanent Identifiers MUST NOT ever be exposed to the application, even in + encrypted form.

-

While a Distinctive Permanent Identifier is typically unique to a user or client device, a Distinctive Permanent Identifier does not need to be strictly unique to be distinctive. - For example, a Distinctive Permanent Identifier shared among a small number of users could still be distinctive. +

+ While a Distinctive Permanent Identifier is typically unique to a user or client + device, a Distinctive Permanent Identifier does not need to be strictly unique to be + distinctive. For example, a Distinctive Permanent Identifier shared among a small + number of users could still be distinctive.

- A Distinctive Permanent Identifier is not a [=Distinctive Identifier=] because it is not derived or generated (within the scope of this specification). + A Distinctive Permanent Identifier is not a [=Distinctive Identifier=] because + it is not derived or generated (within the scope of this specification).

- {{MediaKeySystemConfiguration/distinctiveIdentifier}} controls whether Distinctive Permanent Identifiers may be used. - Specifically, Distinctive Permanent Identifiers may only be used when the value of the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of the {{MediaKeySystemAccess}} used to create the {{MediaKeys}} object is {{MediaKeysRequirement/"required"}}. + {{MediaKeySystemConfiguration/distinctiveIdentifier}} controls whether Distinctive + Permanent Identifiers may be used. Specifically, Distinctive Permanent Identifiers may + only be used when the value of the + {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of the + {{MediaKeySystemAccess}} used to create the {{MediaKeys}} object is + {{MediaKeysRequirement/"required"}}.

- -
Distinctive Identifier
+
+ Distinctive Identifier +

- A Distinctive Identifier is a value, including in opaque or encrypted form, for which it is possible for any entity external to the client to correlate or associate values beyond what a user may expect on the web platform (e.g., cookies and other site data). - For example, values that are [=associable by an entity|associable by an entity other than the application=] across - a) [=origins=], - b) [=browsing profiles=], - or c) browsing sessions even after the user has attempted to protect his or her privacy by clearing browsing data - or values for which it is not easy for a user to break such association. - In particular, a value is a Distinctive Identifier if it is possible for a [=associable by an entity|central server, such as an individualization server, to associate=] values across origins, such as because the [=individualization=] requests contained a common value, or because values provided in individualization requests are [=associable by an entity|associable by such a server=] even after attempts to clear browsing data. - Possible causes of this include use of [=Distinctive Permanent Identifier(s)=] in the individualization process. + A Distinctive Identifier is a value, including in opaque or encrypted form, for which + it is possible for any entity external to the client to correlate or associate values + beyond what a user may expect on the web platform (e.g., cookies and other site + data). For example, values that are [=associable by an entity|associable by an entity + other than the application=] across a) [=origins=], b) [=browsing profiles=], or c) + browsing sessions even after the user has attempted to protect his or her privacy by + clearing browsing data or values for which it is not easy for a user to break such + association. In particular, a value is a Distinctive Identifier if it is possible for + a [=associable by an entity|central server, such as an individualization server, to + associate=] values across origins, such as because the [=individualization=] requests + contained a common value, or because values provided in individualization requests + are [=associable by an entity|associable by such a server=] even after attempts to + clear browsing data. Possible causes of this include use of [=Distinctive Permanent + Identifier(s)=] in the individualization process.

- Distinctive Identifiers exposed to the application, even in encrypted form, MUST adhere to the identifier requirements, - including being encrypted, unique per origin and profile, and clearable. + Distinctive Identifiers exposed to the application, even in encrypted form, MUST + adhere to the identifier requirements, + including being encrypted, unique per origin and profile, and clearable.

- While the instantiation or use of a Distinctive Identifier is triggered by the application's use of the APIs defined in this specification, the identifier need not be provided to the application to trigger conditions related to Distinctive Identifiers. - (The [=Distinctive Permanent Identifier(s)=] MUST NOT ever be provided to the application, even in opaque or encrypted form.) + While the instantiation or use of a Distinctive Identifier is triggered by the + application's use of the APIs defined in this specification, the identifier need not + be provided to the application to trigger conditions related to Distinctive + Identifiers. (The [=Distinctive Permanent Identifier(s)=] MUST NOT ever be provided + to the application, even in opaque or encrypted form.)

- {{MediaKeySystemConfiguration/distinctiveIdentifier}} controls whether Distinctive Identifiers may be used. - Specifically, Distinctive Identifiers may only be used when the value of the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of the {{MediaKeySystemAccess}} used to create the {{MediaKeys}} object is {{MediaKeysRequirement/"required"}}. + {{MediaKeySystemConfiguration/distinctiveIdentifier}} controls whether Distinctive + Identifiers may be used. Specifically, Distinctive Identifiers may only be used when + the value of the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of the + {{MediaKeySystemAccess}} used to create the {{MediaKeys}} object is + {{MediaKeysRequirement/"required"}}. +

+

+ A Distinctive Identifier is a value, piece of data, implication of the possession of a + piece of data, or an observable behavior or timing for which all of the following + criteria hold:

-

A Distinctive Identifier is a value, piece of data, implication of the possession of a piece of data, or an observable behavior or timing for which all of the following criteria hold:

  • -

    It is [=distinctive=].

    -

    While a Distinctive Identifier is typically unique to a user or client device, an identifier does not need to be strictly unique to be distinctive. - For example, an identifier shared among a small number of users could still be distinctive. +

    + It is [=distinctive=]. +

    +

    + While a Distinctive Identifier is typically unique to a user or client device, an + identifier does not need to be strictly unique to be distinctive. For example, an + identifier shared among a small number of users could still be distinctive.

  • -

    It, information about it, or values derived from or otherwise related to it are exposed, even in encrypted form, outside the client. - This includes but is not limited to providing it to the application and/or license, [=individualization=], or other server. +

    + It, information about it, or values derived from or otherwise related to it are + exposed, even in encrypted form, outside the client. This includes but is not + limited to providing it to the application and/or license, [=individualization=], + or other server.

    • -

  • It has one or more the following properties:

    +
  • +

    + It has one or more the following properties: +

      -

    • It is derived from one or more [=Distinctive Permanent Identifier(s)=].

      • -

    • The generation, [=individualization=], provisioning or other process that produced the value involved, used, provided, derived from, or similarly involved one or more [=Distinctive Permanent Identifier(s)=] or another Distinctive Identifier.

    • -

      It is clearable but not along with cookies and other site data.

      -

      For example, via some mechanism external to the user agent, such as an OS-level mechanism.

      +

      + It is derived from one or more [=Distinctive Permanent Identifier(s)=]. +

      +
      • +
    • +

      + The generation, [=individualization=], provisioning or other process that + produced the value involved, used, provided, derived from, or similarly + involved one or more [=Distinctive Permanent Identifier(s)=] or another + Distinctive Identifier. +

      +
      • +
    • +

      + It is clearable but not along with cookies and other site + data. +

      +

      + For example, via some mechanism external to the user agent, such as an OS-level + mechanism. +

    -

    Other properties of concern that are normatively prohibited for values exposed to the application include:

    +

    + Other properties of concern that are normatively prohibited for values exposed to + the application include: +

      -

    • It is a [=Distinctive Permanent Identifier=].

      • -

    • It is not clearable.

      • -

    • Value(s) created after clearing identifier(s) may be [=associable by the application=] with previous value(s).

      • -

    • Values may not be unique per origin and profile.

      • -

    • Values for different origins may be [=associable by the application=].

      • +
    • +

      + It is a [=Distinctive Permanent Identifier=]. +

      +
      • +
    • +

      + It is not clearable. +

      +
      • +
    • +

      + Value(s) created after clearing + identifier(s) may be [=associable by the application=] with previous + value(s). +

      +
      • +
    • +

      + Values may not be unique per + origin and profile. +

      +
      • +
    • +

      + Values for different origins may be [=associable by the application=]. +

      +
    -

    Examples of such normatively prohibited values include but is not limited to:

    +

    + Examples of such normatively prohibited values include but is not limited to: +

      -

    • A single hardware-based value used for all origins.

      • -

    • A single random based value used for all origins.

      • -

    • A single value obtained from an [=individualization=] process that is used for all origins.

      • -

    • Values that include all or part of any of the above values.

      • -

    • A single value that is used for multiple but not all origins.

      • -

    • A single value that is used for all origins on a domain. (Identifiers must be per-[=origin=].)

      • -

    • A pre-provisioned origin-specific value.

      • -

    • Values generated by trivially-reversible means, which are thus [=associable by the application=], regardless of whether generated on the client or involving an [=individualization=] process. For example, XORing or otherwise integrating (part of) the origin with a fixed value.

      • +
    • +

      + A single hardware-based value used for all origins. +

      +
      • +
    • +

      + A single random based value used for all origins. +

      +
      • +
    • +

      + A single value obtained from an [=individualization=] process that is used + for all origins. +

      +
      • +
    • +

      + Values that include all or part of any of the above values. +

      +
      • +
    • +

      + A single value that is used for multiple but not all origins. +

      +
      • +
    • +

      + A single value that is used for all origins on a domain. (Identifiers must be + per-[=origin=].) +

      +
      • +
    • +

      + A pre-provisioned origin-specific value. +

      +
      • +
    • +

      + Values generated by trivially-reversible means, which are thus [=associable + by the application=], regardless of whether generated on the client or + involving an [=individualization=] process. For example, XORing or otherwise + integrating (part of) the origin with a fixed value. +

      +
-

- While Distinctive Identifier are usually [=associable by an entity|associable by the entity that generated them=] they MUST be [=non-associable by applications=]. - In other words, such correlation or association is only possible by the entity, such as an [=individualization=] server, that originally generated the Distinctive Identifier values. - Entities with access to the [=Distinctive Permanent Identifier(s)=] MUST NOT expose this capability to applications, as this would make resulting Distinctive Identifiers [=associable by the application=], and SHOULD take care to avoid exposing such correlation to other entities or third parties. + While Distinctive Identifier are usually [=associable by an entity|associable by the + entity that generated them=] they MUST be [=non-associable by applications=]. In other + words, such correlation or association is only possible by the entity, such as an + [=individualization=] server, that originally generated the Distinctive Identifier + values. Entities with access to the [=Distinctive Permanent Identifier(s)=] MUST NOT + expose this capability to applications, as this would make resulting Distinctive + Identifiers [=associable by the application=], and SHOULD take care to avoid exposing + such correlation to other entities or third parties.

-
-

Examples of Distinctive Identifiers include but are not limited to:

-
    -

  • A series of bytes that is included in key requests, different from the series of bytes included by other client devices, and based on or was acquired directly or indirectly using a [=Distinctive Permanent Identifier=].

    • -

  • A public key included in key requests that is different from the public keys included in the requests by other client devices and is based on or was acquired directly or indirectly using a [=Distinctive Permanent Identifier=].

    • -

  • Demonstration of possession of a private key (e.g., by signing some data) that other client devices do not have and is based on or was acquired directly or indirectly using a [=Distinctive Permanent Identifier=].

    • -

  • An identifier for such a key.

    • -

  • Such a value used to derive another value that is exposed even though the first value is not directly exposed.

    • -

  • A value derived from another Distinctive Identifier.

    • -

  • A random value that was reported to a (e.g., [=individualization=]) server along with a [=Distinctive Permanent Identifier=] or provided by such a server after providing a [=Distinctive Permanent Identifier=].

    • -

  • A value derived from a unique value provisioned in the hardware device in the factory.

    • -

  • A value derived from a unique hardware value (e.g., MAC address or serial number) or software value (e.g., operating system installation instance or operating system user account name) in the hardware device in the factory.

    • -

  • A value derived from a unique value embedded in the [=CDM=] binary or other file used by the [=CDM=].

    • -
-

Examples of things that are not Distinctive Identifiers:

+

+ Examples of Distinctive Identifiers include but are not limited to: +

    -

  • A public key shared among all copies of a given [=CDM=] version if the installed base is large.

    • -

  • A nonce or ephemeral key that is unique but used in only one session.

    • -

  • A value that is not exposed, even in derived or similar ways, outside the client, including via [=individualization=] or similar.

    • -

  • Device-unique keys used in attestations between, for example, the video pipeline and the [=CDM=] when the [=CDM=] does not let these attestations further flow to the application and instead makes a new attestation on its own using a key that does not constitute a Distinctive Identifier.

  • -

    A value that is fully cleared/clearable along with browsing data, such as cookies, after which it will be replaced by a value that is [=non-associable=]] (not just [=non-associable by applications=]), even by a central server such as an [=individualization=] server, AND one or more of the following:

    -
      -

    • No [=Distinctive Permanent Identifier=] or Distinctive Identifier was involved in the generation of the value.

      • -

    • It is a random value generated without inputs from the system.

      • -

    • It is a value provided by a server without the use of or knowledge of another Distinctive Identifier.

      • -
    +

    + A series of bytes that is included in key requests, different from the series of + bytes included by other client devices, and based on or was acquired directly or + indirectly using a [=Distinctive Permanent Identifier=]. +

    • -
-
-
- -
Use of Distinctive Identifiers and Distinctive Permanent Identifiers
-
-

- An implementation, configuration, instance, or object uses Distinctive Identifier(s) if, at any time during its lifetime or the lifetime of related such entities, - it exposes, even in encrypted form, one or more [=Distinctive Identifier(s)=], information about them, or values derived from or otherwise related to them outside the client. - This includes but is not limited to providing such a value to the application and/or license, [=individualization=], or other server. -

-

- An implementation, configuration, instance, or object uses Distinctive Permanent Identifier(s) if, at any time during its lifetime or the lifetime of related such entities, - it exposes, even in encrypted form, one or more [=Distinctive Permanent Identifier(s)=], information about them, or values derived from or otherwise related to them outside the client. - This includes but is not limited to providing such a value to an [=individualization=] server. - Such values MUST NOT be provided to the application. -

-

- An implementation, configuration, instance, or object uses Distinctive Identifier(s) or Distinctive Permanent Identifier(s) if it - [=uses Distinctive Identifier(s)=] and/or [=uses Distinctive Permanent Identifier(s)=]. -

-

- {{MediaKeySystemConfiguration/distinctiveIdentifier}} controls whether [=Distinctive Identifiers=] and [=Distinctive Permanent Identifiers=] may be used. - Specifically, such identifiers may only be used when the value of the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of the {{MediaKeySystemAccess}} used to create the {{MediaKeys}} object is {{MediaKeysRequirement/"required"}}. +

  • +

    + A public key included in key requests that is different from the public keys + included in the requests by other client devices and is based on or was acquired + directly or indirectly using a [=Distinctive Permanent Identifier=]. +

    +
    • +
  • +

    + Demonstration of possession of a private key (e.g., by signing some data) that + other client devices do not have and is based on or was acquired directly or + indirectly using a [=Distinctive Permanent Identifier=]. +

    +
    • +
  • +

    + An identifier for such a key. +

    +
    • +
  • +

    + Such a value used to derive another value that is exposed even though the first + value is not directly exposed. +

    +
    • +
  • +

    + A value derived from another Distinctive Identifier. +

    +
    • +
  • +

    + A random value that was reported to a (e.g., [=individualization=]) server along + with a [=Distinctive Permanent Identifier=] or provided by such a server after + providing a [=Distinctive Permanent Identifier=]. +

    +
    • +
  • +

    + A value derived from a unique value provisioned in the hardware device in the + factory. +

    +
    • +
  • +

    + A value derived from a unique hardware value (e.g., MAC address or serial number) + or software value (e.g., operating system installation instance or operating + system user account name) in the hardware device in the factory. +

    +
    • +
  • +

    + A value derived from a unique value embedded in the [=CDM=] binary or other file + used by the [=CDM=]. +

    +
    • + +

    + Examples of things that are not Distinctive Identifiers: +

    +
      +
    • +

      + A public key shared among all copies of a given [=CDM=] version if the installed + base is large. +

      +
      • +
    • +

      + A nonce or ephemeral key that is unique but used in only one session. +

      +
      • +
    • +

      + A value that is not exposed, even in derived or similar ways, outside the client, + including via [=individualization=] or similar. +

      +
      • +
    • +

      + Device-unique keys used in attestations between, for example, the video pipeline + and the [=CDM=] when the [=CDM=] does not let these attestations further flow to + the application and instead makes a new attestation on its own using a key that + does not constitute a Distinctive Identifier. +

      +
      • +
    • +

      + A value that is fully cleared/clearable along with browsing data, such as + cookies, after which it will be replaced by a value that is [=non-associable=]] + (not just [=non-associable by applications=]), even by a central server such as + an [=individualization=] server, AND one or more of the following: +

      +
        +
      • +

        + No [=Distinctive Permanent Identifier=] or Distinctive Identifier was + involved in the generation of the value. +

        +
        • +
      • +

        + It is a random value generated without inputs from the system. +

        +
        • +
      • +

        + It is a value provided by a server without the use of or knowledge of another + Distinctive Identifier. +

        +
        • +
      +
      • +
    + +
    +
    + Use of Distinctive Identifiers and Distinctive Permanent + Identifiers +
    +
    +

    + An implementation, configuration, instance, or object uses Distinctive + Identifier(s) if, at any time during its lifetime or the lifetime of related such + entities, it exposes, even in encrypted form, one or more [=Distinctive + Identifier(s)=], information about them, or values derived from or otherwise related to + them outside the client. This includes but is not limited to providing such a value to + the application and/or license, [=individualization=], or other server. +

    +

    + An implementation, configuration, instance, or object uses + Distinctive Permanent Identifier(s) if, at any time during its lifetime or the + lifetime of related such entities, it exposes, even in encrypted form, one or more + [=Distinctive Permanent Identifier(s)=], information about them, or values derived from + or otherwise related to them outside the client. This includes but is not limited to + providing such a value to an [=individualization=] server. Such values MUST NOT be + provided to the application. +

    +

    + An implementation, configuration, instance, or object + uses Distinctive Identifier(s) or Distinctive Permanent Identifier(s) if it + [=uses Distinctive Identifier(s)=] and/or [=uses Distinctive Permanent Identifier(s)=]. +

    +

    + {{MediaKeySystemConfiguration/distinctiveIdentifier}} controls whether [=Distinctive + Identifiers=] and [=Distinctive Permanent Identifiers=] may be used. Specifically, such + identifiers may only be used when the value of the + {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of the + {{MediaKeySystemAccess}} used to create the {{MediaKeys}} object is + {{MediaKeysRequirement/"required"}}.

    - -
    Cross Origin Limitations
    +
    + Cross Origin Limitations +
    -

    During playback, embedded media data is exposed to script in the embedding [=origin=]. - In order for the API to provide [=Initialization Data=] in the {{encrypted}} event, [=HTMLMediaElement/media data=] MUST be [=CORS-same-origin=] with the embedding page. - If [=HTMLMediaElement/media data=] is cross-origin with the embedding document, authors SHOULD use the {{HTMLMediaElement/crossOrigin}} attribute - on the {{HTMLMediaElement}} and CORS headers on the [=HTMLMediaElement/media data=] response to make it [=CORS-same-origin=]. +

    + During playback, embedded media data is exposed to script in the embedding [=origin=]. + In order for the API to provide [=Initialization Data=] in the {{encrypted}} event, + [=HTMLMediaElement/media data=] MUST be [=CORS-same-origin=] with the embedding page. + If [=HTMLMediaElement/media data=] is cross-origin with the embedding document, authors + SHOULD use the {{HTMLMediaElement/crossOrigin}} attribute on the {{HTMLMediaElement}} + and CORS headers on the [=HTMLMediaElement/media data=] response to make it + [=CORS-same-origin=].

    - -
    Mixed Content Limitations
    +
    + Mixed Content Limitations +
    -

    During playback, embedded media data is exposed to script in the embedding [=origin=]. - In order for the API to provide [=Initialization Data=] in the {{encrypted}} event, [=HTMLMediaElement/media data=] MUST NOT be [=Mixed Content=] [[MIXED-CONTENT]]. +

    + During playback, embedded media data is exposed to script in the embedding [=origin=]. + In order for the API to provide [=Initialization Data=] in the {{encrypted}} event, + [=HTMLMediaElement/media data=] MUST NOT be [=Mixed Content=] [[MIXED-CONTENT]].

    - -
    Time
    +
    + Time +
    -

    Time MUST be equivalent to that represented in ECMAScript Time Values and Time Range [[ECMA-262]]. +

    + Time MUST be equivalent to that represented in ECMAScript + Time Values and Time Range [[ECMA-262]].

    -

    Time will equal NaN if no such time exists or if the time is indeterminate. It should never have the value Infinity. +

    + Time will equal NaN if no such time exists or if the time is + indeterminate. It should never have the value Infinity.

    - Time generally represents an instant in time with millisecond accuracy; however, that alone is not a sufficient definition. The defined Time Values and Time Range reference adds other important requirements. + Time generally represents an instant in time with millisecond accuracy; however, that + alone is not a sufficient definition. The defined Time Values and Time Range reference + adds other important requirements.

    - -
    Expiration Time
    +
    + Expiration Time +

    The [=time=] after which key(s) will no longer be [=usable for decryption=].

    - -
    Browsing Profile
    +
    + Browsing Profile +

    - A User Agent on a given machine may support execution in a variety of different contexts or modes or temporary states that are expected to behave independently - with respect to application-visible state and data. - In particular, all stored data is expected to be independent. In this specification we refer to such independent contexts or modes as "Browsing Profiles". + A User Agent on a given machine may support execution in a variety of different + contexts or modes or temporary states that are expected to behave independently with + respect to application-visible state and data. In particular, all stored data is + expected to be independent. In this specification we refer to such independent contexts + or modes as "Browsing Profiles".

    - Examples of such independent contexts include if the user agent is running in different operating system user accounts or if the user agent provides the capability to define + Examples of such independent contexts include if the user agent is running in different + operating system user accounts or if the user agent provides the capability to define multiple independent profiles for a single account.

    -
    Valid Media MIME Type
    +
    + Valid Media MIME Type +

    - A valid media MIME type is a media MIME type that is also a [=valid MIME type string=] [[mimesniff]]. - When a MIME type includes parameters, such as `"codecs"` [[RFC6381]], such parameters MUST also be valid per the relevant specification. + A valid media MIME type is a media MIME type that is + also a [=valid MIME type string=] [[mimesniff]]. When a MIME type includes parameters, + such as `"codecs"` [[RFC6381]], such parameters MUST also be valid per the relevant + specification.

    - When used with the features defined in this specification, MIME type strings SHOULD explicitly specify codecs and codec constraints (e.g., per [[RFC6381]]) unless these are normatively implied by the container. + When used with the features defined in this specification, MIME type strings SHOULD + explicitly specify codecs and codec constraints (e.g., per [[RFC6381]]) unless these + are normatively implied by the container.

    -
    -

    Obtaining Access to Key Systems

    -

    This section defines the mechanism for obtaining access to a [=Key System=]. - The inclusion of capabilities in the request also enables feature detection. +

    + Obtaining Access to Key Systems +

    +

    + This section defines the mechanism for obtaining access to a [=Key System=]. The inclusion + of capabilities in the request also enables feature detection. +

    +

    + The steps of an algorithm are always aborted when rejecting a promise.

    -

    The steps of an algorithm are always aborted when rejecting a promise.

    -
    -

    Permissions Policy Integration

    +

    + Permissions Policy Integration +

    - {{Navigator/requestMediaKeySystemAccess()}} is a [=policy-controlled feature=] - identified by the string encrypted-media. Its - [=policy-controlled feature/default allowlist=] is 'self' - [[!PERMISSIONS-POLICY]]. + {{Navigator/requestMediaKeySystemAccess()}} is a [=policy-controlled feature=] identified + by the string encrypted-media. Its [=policy-controlled + feature/default allowlist=] is 'self' [[!PERMISSIONS-POLICY]].

    -
    -

    Navigator Extension: requestMediaKeySystemAccess()

    - +

    + Navigator Extension: requestMediaKeySystemAccess() + 

               [Exposed=Window]
           partial interface Navigator {
@@ -571,167 +1038,347 @@ 
    Navigator Extension: requestMediaKeySystemAccess()
         
    
-          
    Methods
    
+          
    
+            Methods
+          
    
           
    
-          
    requestMediaKeySystemAccess()
    
-          
    
-            
    Calling this method may have user-visible effects, including requests for user consent.
-            This method should only be called when the author intends to create and use a {{MediaKeys}} object with the provided configuration.
-            
    
-            
    Requests access to the specified [=Key System=].
-              When supportedConfigurations is specified, the configuration specified by at least one of its elements must be supported.
-              The resulting {{MediaKeySystemAccess}} will correspond to the first such element.
-            
    
-            
    Any permission checks or user interaction, such as a prompt for consent, MUST be performed before resolving the promise.
    
-            
    If the keySystem is not supported or not allowed (in at least one of the supportedConfigurations, if specified), the promise is rejected.
-              Otherwise, it is resolved with a new {{MediaKeySystemAccess}} object.
-            
    
-            
    
-              
    This method is only exposed to [=secure contexts=] as indicated by the [SecureContext] IDL attribute.
    
+            
    
+              requestMediaKeySystemAccess()
+            
    
+            
    
+              
    
+                Calling this method may have user-visible effects, including requests for
+                user consent. This method should only be called when the author intends to create
+                and use a {{MediaKeys}} object with the provided configuration.
+              
    
               
    
-                Requiring Secure Contexts is not a replacement for other security- and privacy-related requirements and recommendations.
-                Implementations MUST meet all related requirements and SHOULD follow related recommendations such that the risks on in an secure context would be similar.
+                Requests access to the specified [=Key System=]. When
+                supportedConfigurations is specified, the configuration specified by
+                at least one of its elements must be supported. The resulting
+                {{MediaKeySystemAccess}} will correspond to the first such element.
               
    
-            
-            
    When this method is invoked, the user agent MUST run the following steps:
    
-            
      
-              
-
-              
    1. If [=this=]'s [=relevant global object=]'s [=associated Document=]
-              is not allowed to use the encrypted-media feature, then throw a "{{SecurityError}}"
-              {{DOMException}} and abort these steps.
      2. 
-
-              
    2. If keySystem is the empty string, return a promise rejected with a newly created {{TypeError}}.
      3. 
-              
    3. If supportedConfigurations is empty, return a promise rejected with a newly created {{TypeError}}.
      4. 
-              
    4. Let document be the calling context's [=Document=].
      5. 
-              
    5. Let origin be the [=origin=] of document.
      6. 
-              
    6. Let promise be a new promise.
      7. 
-              
    7. Run the following steps in parallel:
      
-                
        
-                  
      1. If keySystem is not one of the [=Key Systems=] supported by the user agent, reject promise with a {{NotSupportedError}}. String comparison is case-sensitive.
        2. 
-                  
      2. Let implementation be the implementation of keySystem.
        3. 
-                  
      3. For each value in supportedConfigurations:
        
-                    
          
-                      
        1. Let candidate configuration be the value.
          2. 
-                      
        2. Let supported configuration be the result of executing the [=Get Supported Configuration=] algorithm on implementation, candidate configuration, and origin.
          3. 
-                      
        3. If supported configuration is not NotSupported, run the following steps:
          
-                        
            
-                          
          1. 
-                            
            Let access be a new {{MediaKeySystemAccess}} object, and initialize it as follows:
            
-                            
              
-                              
            1. Set the {{MediaKeySystemAccess/keySystem}} attribute to keySystem.
              2. 
-                              
            2. Let the configuration value be supported configuration.
              3. 
-                              
            3. Let the cdm implementation value be implementation.
              4. 
-                            
            
-                          
            2. 
-                          
          2. Resolve promise with access and abort the parallel steps of this algorithm.
            3. 
-                        
          
-                      
          4. 
-                    
        
-                  
        4. 
-                  
      4. Reject promise with a {{NotSupportedError}}.
        
-                    
        keySystem was not supported/allowed or none of the configurations in supportedConfigurations were supported/allowed.
        
-                  
        5. 
-                
      
-              
      8. 
-              
    8. Return promise.
      9. 
-            
    
-          
    
+              
    
+                Any permission checks or user interaction, such as a prompt for consent, MUST be
+                performed before resolving the promise.
+              
    
+              
    
+                If the keySystem is not supported or not allowed (in at least one of
+                the supportedConfigurations, if specified), the promise is rejected.
+                Otherwise, it is resolved with a new {{MediaKeySystemAccess}} object.
+              
    
+              
    
+                
    
+                  This method is only exposed to [=secure contexts=] as indicated by the
+                  [SecureContext] IDL attribute.
+                
    
+                
    
+                  Requiring Secure Contexts is not a replacement for other security- and
+                  privacy-related requirements and recommendations. Implementations MUST meet all
+                  related requirements and SHOULD follow related recommendations such that the
+                  risks on in an secure context would be similar.
+                
    
+              
    
+              
    
+                When this method is invoked, the user agent MUST run the following steps:
+              
    
+              
      
+                
+                
    1. 
+                  
      
+                    If [=this=]'s [=relevant global object=]'s [=associated Document=] is not
+                    allowed to use the encrypted-media feature, then
+                    throw a "{{SecurityError}}" {{DOMException}} and abort these steps.
+                  
      
+                
      2. 
+                
    2. 
+                  
      
+                    If keySystem is the empty string, return a promise rejected with a
+                    newly created {{TypeError}}.
+                  
      
+                
      3. 
+                
    3. 
+                  
      
+                    If supportedConfigurations is empty, return a promise rejected with
+                    a newly created {{TypeError}}.
+                  
      
+                
      4. 
+                
    4. 
+                  
      
+                    Let document be the calling context's [=Document=].
+                  
      
+                
      5. 
+                
    5. 
+                  
      
+                    Let origin be the [=origin=] of document.
+                  
      
+                
      6. 
+                
    6. 
+                  
      
+                    Let promise be a new promise.
+                  
      
+                
      7. 
+                
    7. 
+                  
      
+                    Run the following steps in parallel:
+                  
      
+                  
        
+                    
      1. 
+                      
        
+                        If keySystem is not one of the [=Key Systems=] supported by the
+                        user agent, reject promise with a {{NotSupportedError}}. String
+                        comparison is case-sensitive.
+                      
        
+                    
        2. 
+                    
      2. 
+                      
        
+                        Let implementation be the implementation of
+                        keySystem.
+                      
        
+                    
        3. 
+                    
      3. 
+                      
        
+                        For each value in supportedConfigurations:
+                      
        
+                      
          
+                        
        1. 
+                          
          
+                            Let candidate configuration be the value.
+                          
          
+                        
          2. 
+                        
        2. 
+                          
          
+                            Let supported configuration be the result of executing the
+                            [=Get Supported Configuration=] algorithm on implementation,
+                            candidate configuration, and origin.
+                          
          
+                        
          3. 
+                        
        3. 
+                          
          
+                            If supported configuration is not NotSupported,
+                            run the following steps:
+                          
          
+                          
            
+                            
          1. 
+                              
            
+                                Let access be a new {{MediaKeySystemAccess}} object, and
+                                initialize it as follows:
+                              
            
+                              
              
+                                
            1. 
+                                  
              
+                                    Set the {{MediaKeySystemAccess/keySystem}} attribute to
+                                    keySystem.
+                                  
              
+                                
              2. 
+                                
            2. 
+                                  
              
+                                    Let the configuration value be supported
+                                    configuration.
+                                  
              
+                                
              3. 
+                                
            3. 
+                                  
              
+                                    Let the cdm implementation value be
+                                    implementation.
+                                  
              
+                                
              4. 
+                              
            
+                            
            2. 
+                            
          2. 
+                              
            
+                                Resolve promise with access and abort the
+                                parallel steps of this algorithm.
+                              
            
+                            
            3. 
+                          
          
+                        
          4. 
+                      
        
+                    
        4. 
+                    
      4. 
+                      
        
+                        Reject promise with a {{NotSupportedError}}.
+                      
        
+                      
        
+                        keySystem was not supported/allowed or none of the
+                        configurations in supportedConfigurations were
+                        supported/allowed.
+                      
        
+                    
        5. 
+                  
      
+                
      8. 
+                
    8. 
+                  
      
+                    Return promise.
+                  
      
+                
      9. 
+              
    
+            
           
    
         
    
-
         
    
-          
    Algorithms
    
-
+          
    
+            Algorithms
+          
    
           
    
-            
    Get Supported Configuration
    
-            
    Given a [=Key Systems=] implementation implementation, {{MediaKeySystemConfiguration}} candidate configuration, and origin, this algorithm returns a supported configuration or NotSupported as appropriate.
    
-            
    Unrecognized dictionary members in candidate configuration are ignored per [[WEBIDL]] and will never reach this algorithm. Thus, they cannot be considered as part of the configuration.
+            
    
+              Get Supported Configuration
+            
    
+            
    
+              Given a [=Key Systems=] implementation implementation,
+              {{MediaKeySystemConfiguration}} candidate configuration, and
+              origin, this algorithm returns a supported configuration or
+              NotSupported as appropriate.
+            
    
+            
    
+              Unrecognized dictionary members in candidate configuration are ignored per
+              [[WEBIDL]] and will never reach this algorithm. Thus, they cannot be considered as
+              part of the configuration.
             
    
             
    
               
    
-              For certain configurations, it may be required to obtain user consent or inform the user. User Agents have some flexibility to determine
-              whether consent is required for a specific configuration and whether such consent may also apply to other configurations. For example,
-              consent to one configuration may also imply consent for less powerful, more restricted configurations. Equally, a denial of consent for
-              one configuration may imply denial of consent for more powerful, less restricted configurations.
+                For certain configurations, it may be required to obtain user consent or inform the
+                user. User Agents have some flexibility to determine whether consent is required
+                for a specific configuration and whether such consent may also apply to other
+                configurations. For example, consent to one configuration may also imply consent
+                for less powerful, more restricted configurations. Equally, a denial of consent for
+                one configuration may imply denial of consent for more powerful, less restricted
+                configurations.
               
    
               
    
-              Supported configurations, including supported audio and video codecs, may depend on availability of optional capabilities such as
-              [=Distinctive Identifier(s)=] and persistent state. The following algorithm iteratively tries to find a configuration
-              that is both supported and has user consent (or does not need consent).
+                Supported configurations, including supported audio and video codecs, may depend on
+                availability of optional capabilities such as [=Distinctive Identifier(s)=] and
+                persistent state. The following algorithm iteratively tries to find a configuration
+                that is both supported and has user consent (or does not need consent).
               
    
               
    
-              User Agents should reuse earlier consent responses, when appropriate, at least for the duration of the {{Navigator/requestMediaKeySystemAccess()}}
-              algorithm in order to avoid repeated requests to the user for similar configurations.
+                User Agents should reuse earlier consent responses, when appropriate, at least for
+                the duration of the {{Navigator/requestMediaKeySystemAccess()}} algorithm in order
+                to avoid repeated requests to the user for similar configurations.
               
    
               
    
-                The variable restrictions in the steps below represents the configurations for which consent has been denied during the
-                execution of this algorithm or based on persisted consent information for the origin. It is used to determine
-                whether user consent for a candidate configuration or accumulated configuration has been denied. Consent is denied for a accumulated configuration
-                if every derived configuration has already been denied. Internal representation of restrictions is implementation-specific.
+                The variable restrictions in the steps below represents the
+                configurations for which consent has been denied during the execution of this
+                algorithm or based on persisted consent information for the origin. It is used to
+                determine whether user consent for a candidate configuration or accumulated
+                configuration has been denied. Consent is denied for a accumulated configuration if
+                every derived configuration has already been denied. Internal representation of
+                restrictions is implementation-specific.
               
    
             
    
             
      
               
    1. 
-                
      Let supported configuration be ConsentDenied.
      
+                
      
+                  Let supported configuration be ConsentDenied.
+                
      
               
      2. 
               
    2. 
-                
      Initialize restrictions to indicate that no configurations have had user consent denied.
      
+                
      
+                  Initialize restrictions to indicate that no configurations have had
+                  user consent denied.
+                
      
               
      3. 
               
    3. 
-                
      Repeat the following step while supported configuration is ConsentDenied:
      
+                
      
+                  Repeat the following step while supported configuration is
+                  ConsentDenied:
+                
      
                 
        
                   
      1. 
                     
        
-                    Let supported configuration and, if provided, restrictions be the result of executing the
-                    [=Get Supported Configuration and Consent=] algorithm
-                    with implementation, candidate configuration, restrictions and origin.
+                      Let supported configuration and, if provided,
+                      restrictions be the result of executing the [=Get Supported
+                      Configuration and Consent=] algorithm with implementation,
+                      candidate configuration, restrictions and
+                      origin.
                     
        
                   
        2. 
                 
      
               
      4. 
               
    4. 
-                
      Return supported configuration.
      
+                
      
+                  Return supported configuration.
+                
      
               
      5. 
             
    
           
    
           
    
-            
    Get Supported Configuration and Consent
    
-            
    Given a [=Key Systems=] implementation implementation, {{MediaKeySystemConfiguration}} candidate configuration,
-              restrictions and origin, this algorithm returns a supported configuration, NotSupported, or ConsentDenied as appropriate and, in the ConsentDenied case, restrictions.
+            
    
+              Get Supported Configuration and Consent
+            
    
+            
    
+              Given a [=Key Systems=] implementation implementation,
+              {{MediaKeySystemConfiguration}} candidate configuration,
+              restrictions and origin, this algorithm returns a supported
+              configuration, NotSupported, or ConsentDenied as
+              appropriate and, in the ConsentDenied case, restrictions.
             
    
             
      
-              
    1. Let accumulated configuration be a new {{MediaKeySystemConfiguration}} dictionary.
      2. 
-
               
    2. 
                 
      
-                  Set the {{MediaKeySystemConfiguration/label}} member of accumulated configuration to equal the {{MediaKeySystemConfiguration/label}} member of candidate configuration.
+                  Let accumulated configuration be a new {{MediaKeySystemConfiguration}}
+                  dictionary.
                 
      
               
      3. 
-
-              
    3. If the {{MediaKeySystemConfiguration/initDataTypes}} member of candidate configuration is non-empty, run the following steps:
      
+              
    4. 
+                
      
+                  Set the {{MediaKeySystemConfiguration/label}} member of accumulated
+                  configuration to equal the {{MediaKeySystemConfiguration/label}} member of
+                  candidate configuration.
+                
      
+              
      5. 
+              
    5. 
+                
      
+                  If the {{MediaKeySystemConfiguration/initDataTypes}} member of candidate
+                  configuration is non-empty, run the following steps:
+                
      
                 
        
-                  
      1. Let supported types be an empty sequence of {{DOMString}}s.
        2. 
-                  
      2. For each value in candidate configuration's {{MediaKeySystemConfiguration/initDataTypes}} member:
        
-                    
          
-                      
        1. Let initDataType be the value.
          2. 
+                  
        2. 
+                    
          
+                      Let supported types be an empty sequence of {{DOMString}}s.
+                    
          
+                  
          3. 
+                  
        3. 
+                    
          
+                      For each value in candidate configuration's
+                      {{MediaKeySystemConfiguration/initDataTypes}} member:
+                    
          
+                    
            
                       
          1. 
-                        
            If the implementation supports generating requests based on initDataType, add initDataType to supported types.
-                          String comparison is case-sensitive.
-                          The empty string is never supported.
+                        
            
+                          Let initDataType be the value.
+                        
            
+                      
            2. 
+                      
          2. 
+                        
            
+                          If the implementation supports generating requests based on
+                          initDataType, add initDataType to supported
+                          types. String comparison is case-sensitive. The empty string is
+                          never supported.
                         
            
-                        
            The initDataType MUST be supported independent of content types in order to avoid unexpectedly rejecting the configuration in later steps.
-                          Support for initDataType includes both license generation and, when appropriate, extraction from media data.
-                          See Initialization Data Type Support requirements.
+                        
            
+                          The initDataType MUST be supported independent of content
+                          types in order to avoid unexpectedly rejecting the configuration in later
+                          steps. Support for initDataType includes both license
+                          generation and, when appropriate, extraction from media data. See
+                          Initialization
+                          Data Type Support requirements.
                         
            
                       
            3. 
                     
          
                   
          4. 
-                  
        4. If supported types is empty, return NotSupported.
          5. 
-                  
        5. Set the {{MediaKeySystemConfiguration/initDataTypes}} member of accumulated configuration to supported types.
          6. 
+                  
        6. 
+                    
          
+                      If supported types is empty, return NotSupported.
+                    
          
+                  
          7. 
+                  
        7. 
+                    
          
+                      Set the {{MediaKeySystemConfiguration/initDataTypes}} member of
+                      accumulated configuration to supported types.
+                    
          
+                  
          8. 
                 
        
               
        3. 
-
               
               
      3. 
                 
        
-                  Let distinctive identifier requirement be the value of candidate configuration's {{MediaKeySystemConfiguration/distinctiveIdentifier}} member.
+                  Let distinctive identifier requirement be the value of candidate
+                  configuration's {{MediaKeySystemConfiguration/distinctiveIdentifier}}
+                  member.
                 
        
               
        4. 
               
      4. 
                 
        
-                  If distinctive identifier requirement is {{MediaKeysRequirement/"optional"}} and
-                  [=Distinctive Identifiers=] are not allowed according to restrictions, set distinctive identifier requirement
-                  to {{MediaKeysRequirement/"not-allowed"}}.
+                  If distinctive identifier requirement is
+                  {{MediaKeysRequirement/"optional"}} and [=Distinctive Identifiers=] are not
+                  allowed according to restrictions, set distinctive identifier
+                  requirement to {{MediaKeysRequirement/"not-allowed"}}.
                 
        
               
        5. 
               
      5. 
-                
        Follow the steps for distinctive identifier requirement from the following list:
        
+                
        
+                  Follow the steps for distinctive identifier requirement from the
+                  following list:
+                
        
                 
        
-                  
        {{MediaKeysRequirement/"required"}}
        
+                  
        
+                    {{MediaKeysRequirement/"required"}}
+                  
        
                   
        
-                    
        If the implementation does not support [=use of Distinctive Identifier(s)=] in combination with accumulated configuration and restrictions, return NotSupported.
        
-                    
                   
        
-                  
        {{MediaKeysRequirement/"optional"}}
        
+                  
        
+                    {{MediaKeysRequirement/"optional"}}
+                  
        
                   
        
-                    
        Continue with the following steps.
        
+                    
        
+                      Continue with the following steps.
+                    
        
                   
        
-                  
        {{MediaKeysRequirement/"not-allowed"}}
        
+                  
        
+                    {{MediaKeysRequirement/"not-allowed"}}
+                  
        
                   
        
-                    
        If the implementation requires [=use of Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=] in combination with accumulated configuration and restrictions, return NotSupported.
        
+                    
        
+                      If the implementation requires [=use of Distinctive Identifier(s)
+                      or Distinctive Permanent Identifier(s)=] in combination with accumulated
+                      configuration and restrictions, return
+                      NotSupported.
+                    
        
                   
        
                 
        
                 
        
                   
        
-                    The combination of accumulated configuration and restrictions means all the possible configurations that
-                    include everything in accumulated configuration and that are not denied according to restrictions.
+                    The combination of accumulated configuration and
+                    restrictions means all the possible configurations that include
+                    everything in accumulated configuration and that are not denied
+                    according to restrictions.
                   
        
                   
        
-                    A feature is supported by an implementation with this combination if the implementation supports at least one of the configurations
-                    in the combination with the feature.
+                    A feature is supported by an implementation with this combination if the
+                    implementation supports at least one of the configurations in the combination
+                    with the feature.
                   
        
                   
        
-                    A feature is required by an implementtion with this combination if all configurations in the combination that are suported by the implementation
+                    A feature is required by an implementtion with this combination if all
+                    configurations in the combination that are suported by the implementation
                     include the feature.
                   
        
                 
        
               
        6. 
               
      6. 
                 
        
-                  Set the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of accumulated configuration to equal distinctive identifier requirement.
+                  Set the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of
+                  accumulated configuration to equal distinctive identifier
+                  requirement.
                 
        
               
        7. 
               
      7. 
                 
        
-                  Let persistent state requirement be equal to the value of candidate configuration's {{MediaKeySystemConfiguration/persistentState}} member.
+                  Let persistent state requirement be equal to the value of
+                  candidate configuration's
+                  {{MediaKeySystemConfiguration/persistentState}} member.
                 
        
               
        8. 
               
      8. 
                 
        
-                  If persistent state requirement is {{MediaKeysRequirement/"optional"}} and persisting state is not allowed according to
-                  restrictions, set persistent state requirement to {{MediaKeysRequirement/"not-allowed"}}.
+                  If persistent state requirement is {{MediaKeysRequirement/"optional"}}
+                  and persisting state is not allowed according to restrictions, set
+                  persistent state requirement to
+                  {{MediaKeysRequirement/"not-allowed"}}.
                 
        
               
        9. 
-              
      9. Follow the steps for persistent state requirement from the following list:
        
+              
      10. 
+                
        
+                  Follow the steps for persistent state requirement from the following
+                  list:
+                
        
                 
        
-                  
        {{MediaKeysRequirement/"required"}}
        
+                  
        
+                    {{MediaKeysRequirement/"required"}}
+                  
        
                   
        
-                    
        If the implementation does not support persisting state in combination with accumulated configuration and restrictions, return NotSupported.
        
+                    
        
+                      If the implementation does not support persisting state in
+                      combination with accumulated configuration and
+                      restrictions, return NotSupported.
+                    
        
                   
        
-                  
        {{MediaKeysRequirement/"optional"}}
        
+                  
        
+                    {{MediaKeysRequirement/"optional"}}
+                  
        
                   
        
                     
        
                       Continue with the following steps.
                     
        
                   
        
-                  
        {{MediaKeysRequirement/"not-allowed"}}
        
+                  
        
+                    {{MediaKeysRequirement/"not-allowed"}}
+                  
        
                   
        
-                    
        If the implementation requires persisting state in combination with accumulated configuration and restrictions, return NotSupported.
        
+                    
        
+                      If the implementation requires persisting state in combination
+                      with accumulated configuration and restrictions, return
+                      NotSupported.
+                    
        
                   
        
                 
        
               
        11. 
               
      11. 
                 
        
-                  Set the {{MediaKeySystemConfiguration/persistentState}} member of accumulated configuration to equal the value of persistent state requirement.
+                  Set the {{MediaKeySystemConfiguration/persistentState}} member of
+                  accumulated configuration to equal the value of persistent state
+                  requirement.
                 
        
               
        12. 
-              
      12. Follow the steps for the first matching condition from the following list:
        
+              
      13. 
+                
        
+                  Follow the steps for the first matching condition from the following list:
+                
        
                 
        
-                  
        If the {{MediaKeySystemConfiguration/sessionTypes}} member is [=map/exist|present=] [[Infra]] in candidate configuration
        
+                  
        
+                    If the {{MediaKeySystemConfiguration/sessionTypes}} member is
+                    [=map/exist|present=] [[Infra]] in candidate configuration
+                  
        
                   
        
-                    
        Let session types be candidate configuration's {{MediaKeySystemConfiguration/sessionTypes}} member.
        
+                    
        
+                      Let session types be candidate configuration's
+                      {{MediaKeySystemConfiguration/sessionTypes}} member.
+                    
        
                   
        
-                  
        Otherwise
        
+                  
        
+                    Otherwise
+                  
        
                   
        
-                    
        Let session types be [ {{MediaKeySessionType/"temporary"}} ].
        
+                    
        
+                      Let session types be [ {{MediaKeySessionType/"temporary"}}
+                      ].
+                    
        
                   
        
                 
        
               
        14. 
-              
      14. For each value in session types:
        
+              
      15. 
+                
        
+                  For each value in session types:
+                
        
                 
          
-                  
        1. Let session type be the value.
          2. 
                   
        2. 
                     
          
-                      If accumulated configuration's {{MediaKeySystemConfiguration/persistentState}} value is {{MediaKeysRequirement/"not-allowed"}} and the [=Is persistent session type?=] algorithm returns true for session type return NotSupported.
+                      Let session type be the value.
                     
          
                   
          3. 
                   
        3. 
-                    
          If the implementation does not support session type in combination with accumulated configuration and restrictions for other reasons, return NotSupported.
          
+                    
          
+                      If accumulated configuration's
+                      {{MediaKeySystemConfiguration/persistentState}} value is
+                      {{MediaKeysRequirement/"not-allowed"}} and the [=Is persistent session
+                      type?=] algorithm returns true for session type
+                      return NotSupported.
+                    
          
+                  
          4. 
+                  
        4. 
+                    
          
+                      If the implementation does not support session type in
+                      combination with accumulated configuration and
+                      restrictions for other reasons, return NotSupported.
+                    
          
+                  
          5. 
+                  
        5. 
+                    
          
+                      If accumulated configuration's
+                      {{MediaKeySystemConfiguration/persistentState}} value is
+                      {{MediaKeysRequirement/"optional"}} and the result of running the [=Is
+                      persistent session type?=] algorithm on session type is
+                      true, change accumulated configuration's
+                      {{MediaKeySystemConfiguration/persistentState}} value to
+                      {{MediaKeysRequirement/"required"}}.
+                    
          
                   
          6. 
-                  
        6. If accumulated configuration's {{MediaKeySystemConfiguration/persistentState}} value is {{MediaKeysRequirement/"optional"}} and the result of running the [=Is persistent session type?=] algorithm on session type is true, change accumulated configuration's {{MediaKeySystemConfiguration/persistentState}} value to {{MediaKeysRequirement/"required"}}.
          7. 
                 
        
               
        16. 
-              
      16. Set the {{MediaKeySystemConfiguration/sessionTypes}} member of accumulated configuration to session types.
        17. 
-
               
      17. 
                 
        
-                  If the {{MediaKeySystemConfiguration/videoCapabilities}} and {{MediaKeySystemConfiguration/audioCapabilities}} members in candidate configuration
-                  are both empty, return NotSupported.
+                  Set the {{MediaKeySystemConfiguration/sessionTypes}} member of accumulated
+                  configuration to session types.
+                
        
+              
        18. 
+              
      18. 
+                
        
+                  If the {{MediaKeySystemConfiguration/videoCapabilities}} and
+                  {{MediaKeySystemConfiguration/audioCapabilities}} members in candidate
+                  configuration are both empty, return NotSupported.
                 
        
               
        19. 
-
               
      19. 
                 
        
-                  
        If the {{MediaKeySystemConfiguration/videoCapabilities}} member in candidate configuration is non-empty:
        
+                  
        
+                    If the {{MediaKeySystemConfiguration/videoCapabilities}} member in
+                    candidate configuration is non-empty:
+                  
        
                   
        
                     
          
-                      
        1. Let video capabilities be the result of executing the [=Get Supported Capabilities for Audio\/Video Type=] algorithm on Video, candidate configuration's {{MediaKeySystemConfiguration/videoCapabilities}} member, accumulated configuration, and restrictions.
          2. 
-                      
        2. If video capabilities is null, return NotSupported.
          3. 
-                      
        3. Set the {{MediaKeySystemConfiguration/videoCapabilities}} member of accumulated configuration to video capabilities.
          4. 
+                      
        4. 
+                        
          
+                          Let video capabilities be the result of executing the [=Get
+                          Supported Capabilities for Audio\/Video Type=] algorithm on Video,
+                          candidate configuration's
+                          {{MediaKeySystemConfiguration/videoCapabilities}} member,
+                          accumulated configuration, and restrictions.
+                        
          
+                      
          5. 
+                      
        5. 
+                        
          
+                          If video capabilities is null, return
+                          NotSupported.
+                        
          
+                      
          6. 
+                      
        6. 
+                        
          
+                          Set the {{MediaKeySystemConfiguration/videoCapabilities}} member of
+                          accumulated configuration to video capabilities.
+                        
          
+                      
          7. 
                     
        
                   
        
-                  
        Otherwise:
        
-                  
        Set the {{MediaKeySystemConfiguration/videoCapabilities}} member of accumulated configuration to an empty sequence.
        
+                  
        
+                    Otherwise:
+                  
        
+                  
        
+                    
        
+                      Set the {{MediaKeySystemConfiguration/videoCapabilities}} member of
+                      accumulated configuration to an empty sequence.
+                    
        
+                  
        
                 
        
               
        20. 
-
               
      20. 
                 
        
-                  
        If the {{MediaKeySystemConfiguration/audioCapabilities}} member in candidate configuration is non-empty:
        
+                  
        
+                    If the {{MediaKeySystemConfiguration/audioCapabilities}} member in
+                    candidate configuration is non-empty:
+                  
        
                   
        
                     
          
-                      
        1. Let audio capabilities be the result of executing the [=Get Supported Capabilities for Audio\/Video Type=] algorithm on Audio, candidate configuration's {{MediaKeySystemConfiguration/audioCapabilities}} member, accumulated configuration, and restrictions.
          2. 
-                      
        2. If audio capabilities is null, return NotSupported.
          3. 
-                      
        3. Set the {{MediaKeySystemConfiguration/audioCapabilities}} member of accumulated configuration to audio capabilities.
          4. 
+                      
        4. 
+                        
          
+                          Let audio capabilities be the result of executing the [=Get
+                          Supported Capabilities for Audio\/Video Type=] algorithm on Audio,
+                          candidate configuration's
+                          {{MediaKeySystemConfiguration/audioCapabilities}} member,
+                          accumulated configuration, and restrictions.
+                        
          
+                      
          5. 
+                      
        5. 
+                        
          
+                          If audio capabilities is null, return
+                          NotSupported.
+                        
          
+                      
          6. 
+                      
        6. 
+                        
          
+                          Set the {{MediaKeySystemConfiguration/audioCapabilities}} member of
+                          accumulated configuration to audio capabilities.
+                        
          
+                      
          7. 
                     
        
                   
        
-                  
        Otherwise:
        
-                  
        Set the {{MediaKeySystemConfiguration/audioCapabilities}} member of accumulated configuration to an empty sequence.
        
+                  
        
+                    Otherwise:
+                  
        
+                  
        
+                    
        
+                      Set the {{MediaKeySystemConfiguration/audioCapabilities}} member of
+                      accumulated configuration to an empty sequence.
+                    
        
+                  
        
                 
        
               
        21. 
-
               
-              
      21. If accumulated configuration's {{MediaKeySystemConfiguration/distinctiveIdentifier}} value is {{MediaKeysRequirement/"optional"}}, follow the steps for the first matching condition from the following list:
        
+              
      22. 
+                
        
+                  If accumulated configuration's
+                  {{MediaKeySystemConfiguration/distinctiveIdentifier}} value is
+                  {{MediaKeysRequirement/"optional"}}, follow the steps for the first matching
+                  condition from the following list:
+                
        
                 
        
-                  
        If the implementation requires [=use of Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=] for any of the combinations in accumulated configuration:
        
+                  
        
+                    If the implementation requires [=use of Distinctive Identifier(s) or
+                    Distinctive Permanent Identifier(s)=] for any of the combinations in
+                    accumulated configuration:
+                  
        
                   
        
-                    
        Change accumulated configuration's {{MediaKeySystemConfiguration/distinctiveIdentifier}} value to {{MediaKeysRequirement/"required"}}.
        
+                    
        
+                      Change accumulated configuration's
+                      {{MediaKeySystemConfiguration/distinctiveIdentifier}} value to
+                      {{MediaKeysRequirement/"required"}}.
+                    
        
                   
        
-                  
        Otherwise
        
+                  
        
+                    Otherwise
+                  
        
                   
        
-                    
        Change accumulated configuration's {{MediaKeySystemConfiguration/distinctiveIdentifier}} value to {{MediaKeysRequirement/"not-allowed"}}.
        
+                    
        
+                      Change accumulated configuration's
+                      {{MediaKeySystemConfiguration/distinctiveIdentifier}} value to
+                      {{MediaKeysRequirement/"not-allowed"}}.
+                    
        
                   
        
                 
        
               
        23. 
-
-              
      23. If accumulated configuration's {{MediaKeySystemConfiguration/persistentState}} value is {{MediaKeysRequirement/"optional"}}, follow the steps for the first matching condition from the following list:
        
+              
      24. 
+                
        
+                  If accumulated configuration's
+                  {{MediaKeySystemConfiguration/persistentState}} value is
+                  {{MediaKeysRequirement/"optional"}}, follow the steps for the first matching
+                  condition from the following list:
+                
        
                 
        
-                  
        If the implementation requires persisting state for any of the combinations in accumulated configuration
        
+                  
        
+                    If the implementation requires persisting state for any of the
+                    combinations in accumulated configuration
+                  
        
                   
        
-                    
        Change accumulated configuration's {{MediaKeySystemConfiguration/persistentState}} value to {{MediaKeysRequirement/"required"}}.
        
+                    
        
+                      Change accumulated configuration's
+                      {{MediaKeySystemConfiguration/persistentState}} value to
+                      {{MediaKeysRequirement/"required"}}.
+                    
        
                   
        
-                  
        Otherwise
        
+                  
        
+                    Otherwise
+                  
        
                   
        
-                    
        Change accumulated configuration's {{MediaKeySystemConfiguration/persistentState}} value to {{MediaKeysRequirement/"not-allowed"}}.
        
+                    
        
+                      Change accumulated configuration's
+                      {{MediaKeySystemConfiguration/persistentState}} value to
+                      {{MediaKeysRequirement/"not-allowed"}}.
+                    
        
                   
        
                 
        
               
        25. 
-
-              
      25. If implementation in the configuration specified by the combination of the values in accumulated configuration is not supported or not allowed in the origin, return NotSupported.
        
-                
        In this step, "supported" includes the implementation being available for use when this algorithm returns, not just user agent support for such an implementation.
        
+              
      26. 
+                
        
+                  If implementation in the configuration specified by the combination of
+                  the values in accumulated configuration is not supported or not
+                  allowed in the origin, return NotSupported.
+                
        
+                
        
+                  In this step, "supported" includes the implementation being available for use
+                  when this algorithm returns, not just user agent support for such an
+                  implementation.
+                
        
               
        27. 
-
               
      27. 
                 
        
-                  If accumulated configuration's {{MediaKeySystemConfiguration/distinctiveIdentifier}} value is {{MediaKeysRequirement/"required"}} and
-                  the [=Distinctive Identifier(s)=] associated with accumulated configuration are not unique per origin and profile and
+                  If accumulated configuration's
+                  {{MediaKeySystemConfiguration/distinctiveIdentifier}} value is
+                  {{MediaKeysRequirement/"required"}} and the [=Distinctive Identifier(s)=]
+                  associated with accumulated configuration are not unique per origin and profile and
                   clearable:
                 
        
                 
          
                   
        1. 
                     
          
-                      Update restrictions to reflect that all configurations described by accumulated configuration
-                      do not have user consent.
+                      Update restrictions to reflect that all configurations described
+                      by accumulated configuration do not have user consent.
                     
          
                   
          2. 
                   
        2. 
-                    
          Return ConsentDenied and restrictions.
          
+                    
          
+                      Return ConsentDenied and restrictions.
+                    
          
                   
          3. 
                 
        
                 
        
                   
        
-                  The "unique per origin and profile" and "clearable" conditions cannot be false in a compliant implementation because implementations MUST use per-origin per-profile identifiers and allow the user to clear identifier.
+                    The "unique per origin and profile" and "clearable" conditions cannot be false
+                    in a compliant implementation because implementations MUST use per-origin per-profile
+                    identifiers and allow the user to
+                    clear identifier.
                   
        
                 
        
               
        28. 
               
      28. 
                 
        
-                  Let consent status and updated restrictions be the result of running the [=Get Consent Status=] algorithm on accumulated configuration, restrictions and origin and follow the steps for the value of consent status from the following list:
+                  Let consent status and updated restrictions be the result
+                  of running the [=Get Consent Status=] algorithm on accumulated
+                  configuration, restrictions and origin and follow the
+                  steps for the value of consent status from the following list:
                 
        
-
                 
        
-                  
        ConsentDenied:
        
+                  
        
+                    ConsentDenied:
+                  
        
                   
        
                     
        
                       Return ConsentDenied and updated restrictions.
                     
        
-                  
        InformUser:
        
+                  
+                  
        
+                    InformUser:
+                  
        
                   
        
                     
        
-                      Inform the user that accumulated configuration is in use in the origin including, specifically, the information
-                      that [=Distinctive Identifier(s)=] and/or [=Distinctive Permanent Identifier(s)=] as appropriate will be used if the {{MediaKeySystemConfiguration/distinctiveIdentifier}}
-                      member of accumulated configuration is {{MediaKeysRequirement/"required"}}. Continue to the next step.
+                      Inform the user that accumulated configuration is in use in the
+                      origin including, specifically, the information that [=Distinctive
+                      Identifier(s)=] and/or [=Distinctive Permanent Identifier(s)=] as appropriate
+                      will be used if the {{MediaKeySystemConfiguration/distinctiveIdentifier}}
+                      member of accumulated configuration is
+                      {{MediaKeysRequirement/"required"}}. Continue to the next step.
                     
        
                   
        
-                  
        Allowed:
        
+                  
        
+                    Allowed:
+                  
        
                   
        
                     
        
                       Continue to the next step.
@@ -970,45 +1832,129 @@ 
        Get Supported Configuration and Consent
        
                   
        
                 
        
               
        29. 
-
-              
      29. Return accumulated configuration.
        30. 
+              
      30. 
+                
        
+                  Return accumulated configuration.
+                
        
+              
        31. 
             
      
           
    
-
           
    
-            
    Get Supported Capabilities for Audio/Video Type
    
-            
    Given an audio/video type, {{MediaKeySystemMediaCapability}} sequence requested media capabilities, {{MediaKeySystemConfiguration}} accumulated configuration, and restrictions, this algorithm returns a sequence of supported {{MediaKeySystemMediaCapability}} values for this audio/video type or null as appropriate.
    
+            
    
+              Get Supported Capabilities for Audio/Video Type
+            
    
+            
    
+              Given an audio/video type, {{MediaKeySystemMediaCapability}} sequence
+              requested media capabilities, {{MediaKeySystemConfiguration}}
+              accumulated configuration, and restrictions, this algorithm
+              returns a sequence of supported {{MediaKeySystemMediaCapability}} values for this
+              audio/video type or null as appropriate.
+            
    
             
      
-              
    1. Let local accumulated configuration be a local copy of accumulated configuration.
      2. 
-              
    2. Let supported media capabilities be an empty sequence of {{MediaKeySystemMediaCapability}} dictionaries.
      3. 
-              
    3. For each requested media capability in requested media capabilities:
      
+              
    4. 
+                
      
+                  Let local accumulated configuration be a local copy of
+                  accumulated configuration.
+                
      
+              
      5. 
+              
    5. 
+                
      
+                  Let supported media capabilities be an empty sequence of
+                  {{MediaKeySystemMediaCapability}} dictionaries.
+                
      
+              
      6. 
+              
    6. 
+                
      
+                  For each requested media capability in requested media
+                  capabilities:
+                
      
                 
        
-                  
      1. Let content type be requested media capability's {{MediaKeySystemMediaCapability/contentType}} member.
        2. 
-                  
      2. Let encryption scheme be requested media capability’s {{MediaKeySystemMediaCapability/encryptionScheme}} member.
        3. 
-                  
      3. Let robustness be requested media capability's {{MediaKeySystemMediaCapability/robustness}} member.
        4. 
-                  
      4. If content type is the empty string, return null.
        5. 
-                  
      5. If content type is not a [=valid media MIME type=] or is unrecognized, continue to the next iteration.
        6. 
-                  
      6. Let container be the container type specified by content type.
        7. 
-                  
      7. If the user agent does not support container, continue to the next iteration. The case-sensitivity of string comparisons is determined by the appropriate RFC.
        
-                    
        Per RFC 6838 [[RFC6838]], "Both top-level type and subtype names are case-insensitive."
        
+                  
      8. 
+                    
        
+                      Let content type be requested media capability's
+                      {{MediaKeySystemMediaCapability/contentType}} member.
+                    
        
+                  
        9. 
+                  
      9. 
+                    
        
+                      Let encryption scheme be requested media capability’s
+                      {{MediaKeySystemMediaCapability/encryptionScheme}} member.
+                    
        
+                  
        10. 
+                  
      10. 
+                    
        
+                      Let robustness be requested media capability's
+                      {{MediaKeySystemMediaCapability/robustness}} member.
+                    
        
+                  
        11. 
+                  
      11. 
+                    
        
+                      If content type is the empty string, return null.
+                    
        
+                  
        12. 
+                  
      12. 
+                    
        
+                      If content type is not a [=valid media MIME type=] or is
+                      unrecognized, continue to the next iteration.
+                    
        
+                  
        13. 
+                  
      13. 
+                    
        
+                      Let container be the container type specified by content
+                      type.
+                    
        
+                  
        14. 
+                  
      14. 
+                    
        
+                      If the user agent does not support container, continue to the next
+                      iteration. The case-sensitivity of string comparisons is determined by the
+                      appropriate RFC.
+                    
        
+                    
        
+                      Per RFC 6838 [[RFC6838]], "Both top-level type and subtype names are
+                      case-insensitive."
+                    
        
+                  
        15. 
+                  
      15. 
+                    
        
+                      Let parameters be the RFC 6381 [[RFC6381]] parameters, if any,
+                      specified by content type.
+                    
        
+                  
        16. 
+                  
      16. 
+                    
        
+                      If the user agent does not recognize one or more parameters,
+                      continue to the next iteration.
+                    
        
                   
        17. 
-                  
      17. Let parameters be the RFC 6381 [[RFC6381]] parameters, if any, specified by content type.
        18. 
-                  
      18. If the user agent does not recognize one or more parameters, continue to the next iteration.
        19. 
-                  
      19. Let media types be the set of codecs and codec constraints specified by parameters. The case-sensitivity of string comparisons is determined by the appropriate RFC or other specification.
        
-                    
        Case-sensitive string comparison is RECOMMENDED because RFC 6381 [[RFC6381]] says, "Values are case sensitive" for some formats.
        
+                  
      20. 
+                    
        
+                      Let media types be the set of codecs and codec constraints
+                      specified by parameters. The case-sensitivity of string
+                      comparisons is determined by the appropriate RFC or other specification.
+                    
        
+                    
        
+                      Case-sensitive string comparison is RECOMMENDED because RFC 6381 [[RFC6381]]
+                      says, "Values are case sensitive" for some formats.
+                    
        
                   
        21. 
                   
      21. 
                     
        
                       If media types is empty:
                     
        
                     
        
-                      
        If container normatively implies a specific set of codecs and codec constraints:
        
+                      
        
+                        If container normatively implies a specific set of codecs and
+                        codec constraints:
+                      
        
                       
        
                         
        
                           Let parameters be that set.
                         
        
                       
        
-                      
        Otherwise:
        
+                      
        
+                        Otherwise:
+                      
        
                       
        
                         
        
                           Continue to the next iteration.
@@ -1016,89 +1962,155 @@ 
        Get Supported Capabilities for Audio/Video Type
        
                       
        
                     
        
                   
        22. 
-                  
      22. If content type is not strictly a audio/video type, continue to the next iteration.
        
-                    
        For example, if audio/video type is Video and the top-level type is not "video" or media types contains non-video codecs.
        
+                  
      23. 
+                    
        
+                      If content type is not strictly a audio/video type,
+                      continue to the next iteration.
+                    
        
+                    
        
+                      For example, if audio/video type is Video and the top-level type
+                      is not "video" or media types contains non-video codecs.
+                    
        
+                  
        24. 
+                  
      24. 
+                    
        
+                      If encryption scheme is non-null and is not recognized or not
+                      supported by implementation, continue to the next iteration.
+                    
        
+                  
        25. 
+                  
      25. 
+                    
        
+                      If robustness is not the empty string and contains an unrecognized
+                      value or a value not supported by implementation, continue to the
+                      next iteration. String comparison is case-sensitive.
+                    
        
                   
        26. 
-                  
      26. If encryption scheme is non-null and is not recognized or not supported by implementation, continue to the next iteration.
        27. 
-                  
      27. If robustness is not the empty string and contains an unrecognized value or a value not supported by implementation, continue to the next iteration. String comparison is case-sensitive.
        28. 
-                  
      28. If the user agent and implementation definitely support playback of encrypted [=HTMLMediaElement/media data=] for the combination of container, media types, encryption scheme, robustness and local accumulated configuration in combination with restrictions:
        
-                    
        requested media capability (content type and robustness) must be supported when used together with all previously added requested media capabilities.
        
+                  
      29. 
+                    
        
+                      If the user agent and implementation definitely support playback
+                      of encrypted [=HTMLMediaElement/media data=] for the combination of
+                      container, media types, encryption scheme,
+                      robustness and local accumulated configuration in
+                      combination with restrictions:
+                    
        
+                    
        
+                      requested media capability (content type and robustness) must be
+                      supported when used together with all previously added requested media
+                      capabilities.
+                    
        
                     
          
                       
        1. 
                         
          
-                          Add requested media capability to supported media capabilities.
+                          Add requested media capability to supported media
+                          capabilities.
                         
          
                         
          
-                          This step ensures that the values of the members of entries in supported media capabilities are exactly the strings supplied in
-                          requested media capability without modification by the User Agent.
+                          This step ensures that the values of the members of entries in
+                          supported media capabilities are exactly the strings supplied
+                          in requested media capability without modification by the User
+                          Agent.
                         
          
                       
          2. 
                       
        2. 
                         
          
-                          
          If audio/video type is Video:
          
+                          
          
+                            If audio/video type is Video:
+                          
          
                           
          
                             
          
-                              Add requested media capability to the {{MediaKeySystemConfiguration/videoCapabilities}} member of local accumulated configuration.
+                              Add requested media capability to the
+                              {{MediaKeySystemConfiguration/videoCapabilities}} member of
+                              local accumulated configuration.
                             
          
                           
          
-                          
          If audio/video type is Audio:
          
+                          
          
+                            If audio/video type is Audio:
+                          
          
                           
          
                             
          
-                              Add requested media capability to the {{MediaKeySystemConfiguration/audioCapabilities}} member of local accumulated configuration.
+                              Add requested media capability to the
+                              {{MediaKeySystemConfiguration/audioCapabilities}} member of
+                              local accumulated configuration.
                             
          
                           
          
                         
          
                         
          
-                          This step ensures that configurations are always checked with configurations from previous iterations, including from previous calls to this algorithm.
-                          Otherwise, only configurations from previous calls to this algorithm would be checked in subsequent calls.
+                          This step ensures that configurations are always checked with
+                          configurations from previous iterations, including from previous calls to
+                          this algorithm. Otherwise, only configurations from previous calls to
+                          this algorithm would be checked in subsequent calls.
                         
          
                       
          3. 
                     
        
                   
        30. 
                 
      
               
      7. 
-              
    7. If supported media capabilities is empty, return null.
      
-                
      None of the {{MediaKeySystemMediaCapability}} elements in requested media capabilities is supported in combination with accumulated configuration.
      
+              
    8. 
+                
      
+                  If supported media capabilities is empty, return null.
+                
      
+                
      
+                  None of the {{MediaKeySystemMediaCapability}} elements in requested media
+                  capabilities is supported in combination with accumulated
+                  configuration.
+                
      
+              
      9. 
+              
    9. 
+                
      
+                  Return supported media capabilities.
+                
      
               
      10. 
-              
    10. Return supported media capabilities.
      11. 
             
    
           
    
-
           
    
-            
    Get Consent Status
    
+            
    
+              Get Consent Status
+            
    
             
    
-              Given an accumulated configuration, restrictions and origin, this algorithm returns the consent status for
-              accumulated configuration and origin as one of ConsentDenied, InformUser or Allowed,
-              together with an updated value for restrictions in the ConsentDenied case.
+              Given an accumulated configuration, restrictions and
+              origin, this algorithm returns the consent status for accumulated
+              configuration and origin as one of ConsentDenied,
+              InformUser or Allowed, together with an updated value for
+              restrictions in the ConsentDenied case.
             
    
             
    
               
    
-                Consent status for accumulated configuration depends at least on the value of the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of
+                Consent status for accumulated configuration depends at least on the
+                value of the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of
                 accumulated configuration.
               
    
               
    
-                Previous consent for accumulated configuration with {{MediaKeySystemConfiguration/distinctiveIdentifier}}
-                set to {{MediaKeysRequirement/"not-allowed"}} does not imply consent for the same configuration with {{MediaKeySystemConfiguration/distinctiveIdentifier}}
-                set to {{MediaKeysRequirement/"optional"}} or {{MediaKeysRequirement/"required"}}.
+                Previous consent for accumulated configuration with
+                {{MediaKeySystemConfiguration/distinctiveIdentifier}} set to
+                {{MediaKeysRequirement/"not-allowed"}} does not imply consent for the same
+                configuration with {{MediaKeySystemConfiguration/distinctiveIdentifier}} set to
+                {{MediaKeysRequirement/"optional"}} or {{MediaKeysRequirement/"required"}}.
               
    
             
    
             
      
               
    1. 
                 
      
-                  If there is persisted denial for origin indicating that accumulated configuration is not allowed, run the following steps:
+                  If there is persisted denial for origin indicating that
+                  accumulated configuration is not allowed, run the following steps:
                 
      
                 
        
                   
      1. 
-                    
        Update restrictions to reflect the configurations for which consent has been denied.
        
+                    
        
+                      Update restrictions to reflect the configurations for which
+                      consent has been denied.
+                    
        
                   
        2. 
                   
      2. 
-                    
        Return ConsentDenied and restrictions.
        
+                    
        
+                      Return ConsentDenied and restrictions.
+                    
        
                   
        3. 
                 
      
               
      2. 
               
    2. 
                 
      
-                  If there is persisted consent for origin indicating accumulated configuration is allowed, return Allowed.
+                  If there is persisted consent for origin indicating accumulated
+                  configuration is allowed, return Allowed.
                 
      
               
      3. 
               
    3. 
@@ -1108,34 +2120,48 @@ 
      Get Consent Status
      
                 
        
                   
      • 
                     
        
-                      The {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of accumulated configuration is not
-                      {{MediaKeysRequirement/"not-allowed"}} and the combination of the User Agent, implementation
-                      and accumulated configuration does not follow all the recommendations of
-                      Allow Persistent Data to Be Cleared with respect to
-                      [=Distinctive Identifier(s)=].
+                      The {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of
+                      accumulated configuration is not
+                      {{MediaKeysRequirement/"not-allowed"}} and the combination of the User Agent,
+                      implementation and accumulated configuration does not
+                      follow all the recommendations of Allow Persistent Data to Be Cleared with
+                      respect to [=Distinctive Identifier(s)=].
                     
        
                   
        • 
                   
      • 
                     
        
-                      The user agent requires explicit user consent for the accumulated configuration for other reasons.
+                      The user agent requires explicit user consent for the accumulated
+                      configuration for other reasons.
                     
        
                     
        
-                      Another reason for requiring explicit user consent may be due to the security properties of the [=CDM=] implementation.
+                      Another reason for requiring explicit user consent may be due to the security
+                      properties of the [=CDM=] implementation.
                     
        
                   
        • 
                 
      
-                
      then run the following steps:
      
+                
      
+                  then run the following steps:
+                
      
                 
        
                   
      1. 
                     
        
-                      Request user consent to use accumulated configuration in the origin and wait for the user response.
+                      Request user consent to use accumulated configuration in the
+                      origin and wait for the user response.
                     
        
                     
        
-                      The consent MUST include consent to use a [=Distinctive Identifier(s)=] and/or [=Distinctive Permanent Identifier(s)=] as appropriate if
-                      accumulated configuration's {{MediaKeySystemConfiguration/distinctiveIdentifier}} member is {{MediaKeysRequirement/"required"}}.
+                      The consent MUST include consent to use a [=Distinctive Identifier(s)=]
+                      and/or [=Distinctive Permanent Identifier(s)=] as appropriate if
+                      accumulated configuration's
+                      {{MediaKeySystemConfiguration/distinctiveIdentifier}} member is
+                      {{MediaKeysRequirement/"required"}}.
                     
        
                     
        
-                      
        User consent to use accumulated configuration is specific to the origin and may be limited to configurations sharing certain properties with accumulated configuration.
        
+                      
        
+                        User consent to use accumulated configuration is specific to the
+                        origin and may be limited to configurations sharing certain
+                        properties with accumulated configuration.
+                      
        
                     
        
                   
        2. 
                   
      2. 
@@ -1143,34 +2169,47 @@ 
        Get Consent Status
        
                       If consent was denied, run the following steps:
                     
        
                     
          
-                      
        1. Update restrictions to reflect the configurations for which consent was denied.
          2. 
-                      
        2. Return ConsentDenied and restrictions.
          3. 
+                      
        3. 
+                        
          
+                          Update restrictions to reflect the configurations for which
+                          consent was denied.
+                        
          
+                      
          4. 
+                      
        4. 
+                        
          
+                          Return ConsentDenied and restrictions.
+                        
          
+                      
          5. 
                     
        
                   
        3. 
                 
      
               
      4. 
               
    4. 
                 
      
-                  If the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of accumulated configuration is not
+                  If the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of
+                  accumulated configuration is not
                   {{MediaKeysRequirement/"not-allowed"}}, return InformUser.
                 
      
               
      5. 
               
    5. 
                 
      
-                  If the user agent requires informing the user for the accumulated configuration for other reasons, return InformUser.
+                  If the user agent requires informing the user for the accumulated
+                  configuration for other reasons, return InformUser.
                 
      
               
      6. 
               
    6. 
-                
      Return Allowed.
      
+                
      
+                  Return Allowed.
+                
      
               
      7.
    -
    -

    MediaKeySystemConfiguration dictionary

    - +

    + MediaKeySystemConfiguration dictionary + 

               enum MediaKeysRequirement {
             "required",
@@ -1178,190 +2217,337 @@ 
    MediaKeySystemConfiguration dictionary
    
             "not-allowed"
           };
    -

    -The MediaKeysRequirement enumeration is defined as follows: -

    - - - - -
    Enumeration description
    required -
    -
    When used in a call to {{Navigator/requestMediaKeySystemAccess()}}
    -
    The returned object MUST support this feature.
    -
    When returned by a {{MediaKeySystemAccess}} object
    -
    [=CDM=] instances created by the object MAY use this feature.
    -
    -
    optional -
    -
    When used in a call to {{Navigator/requestMediaKeySystemAccess()}}
    -
    The returned object MAY support and use this feature.
    -
    When returned by a {{MediaKeySystemAccess}} object
    -
    This value cannot and MUST NOT be present in such an object.
    -
    -
    not-allowed -
    -
    When used in a call to {{Navigator/requestMediaKeySystemAccess()}}
    -
    The returned object MUST function without using this feature and MUST NOT use it at any time.
    -
    When returned by a {{MediaKeySystemAccess}} object
    -
    [=CDM=] instances created by the object MUST NOT use this feature.
    -
    -
    - - 
    -          dictionary MediaKeySystemConfiguration {
-            DOMString                               label = "";
-            sequence<DOMString>                     initDataTypes = [];
-            sequence<MediaKeySystemMediaCapability> audioCapabilities = [];
-            sequence<MediaKeySystemMediaCapability> videoCapabilities = [];
-            MediaKeysRequirement                    distinctiveIdentifier = "optional";
-            MediaKeysRequirement                    persistentState = "optional";
-            sequence<DOMString>                     sessionTypes;
-          };
-
    -

    - The dictionary {{MediaKeySystemConfiguration}} contains the following members: -

    -
    label of type {{DOMString}}, defaulting to ""
    - An optional label that will be preserved in the {{MediaKeySystemConfiguration}} returned from the {{MediaKeySystemAccess/getConfiguration()}} method of {{MediaKeySystemAccess}}. -
    initDataTypes of type sequence<{{DOMString}}>, defaulting to []
    - A list of supported [=Initialization Data Type=] names. - The [=Initialization Data Type=] capability of this object is considered supported if the list is empty or contains one or more values that are supported with all other members (as determined by the algorithm). - Values in the sequence MUST not be the empty string. -
    audioCapabilities of type sequence<{{MediaKeySystemMediaCapability}}>, defaulting to []
    - A list of supported audio type and capability pairs. - The audio capability of this object is considered supported if the list is empty or contains one or more values that are supported with all other members (as determined by the algorithm). - When there is a conflict between values, the earlier value will be selected. An empty list indicates that no audio capabilities are supported. - In this case, the {{MediaKeySystemConfiguration/videoCapabilities}} element must not be empty. -
    videoCapabilities of type sequence<{{MediaKeySystemMediaCapability}}>, defaulting to []
    - A list of supported video type and capability pairs. - The video capability of this object is considered supported if the list is empty or contains one or more values that are supported with all other members (as determined by the algorithm). - When there is a conflict between values, the earlier value will be selected. An empty list indicates that no video capabilities are supported. - In this case, the {{MediaKeySystemConfiguration/audioCapabilities}} element must not be empty. -
    distinctiveIdentifier of type {{MediaKeysRequirement}}, defaulting to "optional"
    - Whether use of a [=Distinctive Identifier(s)=] is required. -

    When this member is {{MediaKeysRequirement/"not-allowed"}}, the implementation MUST NOT [=use Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=] for any operations associated with any object created from this configuration. -

    -
    persistentState of type {{MediaKeysRequirement}}, defaulting to "optional"
    - Whether the ability to persist state is required. This includes session data and any other type of state. -

    The [=CDM=] MUST NOT persist any state related to the application or [=origin=] of this object's [=Document=] when this member is {{MediaKeysRequirement/"not-allowed"}}.

    -

    For the purposes of this member, persistent state does not include persistent unique identifiers ([=Distinctive Identifiers=]) controlled by the [=Key System=] implementation. {{MediaKeySystemConfiguration/distinctiveIdentifier}} independently reflects this requirement.

    -

    Only {{MediaKeySessionType/"temporary"}} sessions may be created when persistent state is not supported.

    -

    For {{MediaKeySessionType/"temporary"}} sessions, the need and ability to store state is [=Key System=] implementation-specific and may vary by feature used.

    -

    Applications intending to create non-{{MediaKeySessionType/"temporary"}} sessions, should set this member to {{MediaKeysRequirement/"required"}} when calling {{Navigator/requestMediaKeySystemAccess()}}.

    -
    sessionTypes of type sequence<{{DOMString}}>
    - A list of {{MediaKeySessionType}}s that must be supported. All values must be supported. -

    If this member is [=map/exist|not present=] [[Infra]] when the dictionary is passed to {{Navigator/requestMediaKeySystemAccess()}}, the dictionary will be treated as if this member is set to [ {{MediaKeySessionType/"temporary"}} ].

    -
    - -

    Implementations SHOULD NOT add members to this dictionary. - Should member(s) be added, they MUST be of type {{MediaKeysRequirement}}, and it is RECOMMENDED that they have default values of {{MediaKeysRequirement/"optional"}} to support the widest range of application and client combinations. -

    -

    Dictionary members not recognized by a user agent implementation are ignored per [[WEBIDL]] and will not be considered in the {{Navigator/requestMediaKeySystemAccess()}} algorithm. - Should an application use non-standard dictionary member(s), it MUST NOT rely on user agent implementations rejecting a configuration that includes such dictionary members. +

    + The MediaKeysRequirement enumeration is defined as follows:

    -

    This dictionary MUST NOT be used to pass state or data to the [=CDM=].

    - -
    - -
    -

    MediaKeySystemMediaCapability dictionary

    - 
    -            dictionary MediaKeySystemMediaCapability {
-              DOMString contentType = "";
-              DOMString? encryptionScheme = null;
+        
+          
+            
+              
+            
+            
+              
+              
+            
+            
+              
+              
+            
+            
+              
+              
+            
+          
+        
    
+                Enumeration description
+              
    
+                required
+              
+                
    
+                  
    
+                    When used in a call to {{Navigator/requestMediaKeySystemAccess()}}
+                  
    
+                  
    
+                    The returned object MUST support this feature.
+                  
    
+                  
    
+                    When returned by a {{MediaKeySystemAccess}} object
+                  
    
+                  
    
+                    [=CDM=] instances created by the object MAY use this feature.
+                  
    
+                
    
+              
    
+                optional
+              
+                
    
+                  
    
+                    When used in a call to {{Navigator/requestMediaKeySystemAccess()}}
+                  
    
+                  
    
+                    The returned object MAY support and use this feature.
+                  
    
+                  
    
+                    When returned by a {{MediaKeySystemAccess}} object
+                  
    
+                  
    
+                    This value cannot and MUST NOT be present in such an object.
+                  
    
+                
    
+              
    
+                not-allowed
+              
+                
    
+                  
    
+                    When used in a call to {{Navigator/requestMediaKeySystemAccess()}}
+                  
    
+                  
    
+                    The returned object MUST function without using this feature and MUST NOT use
+                    it at any time.
+                  
    
+                  
    
+                    When returned by a {{MediaKeySystemAccess}} object
+                  
    
+                  
    
+                    [=CDM=] instances created by the object MUST NOT use this feature.
+                  
    
+                
    
+              
    
+        
    +          dictionary MediaKeySystemConfiguration {
+            DOMString                               label = "";
+            sequence<DOMString>                     initDataTypes = [];
+            sequence<MediaKeySystemMediaCapability> audioCapabilities = [];
+            sequence<MediaKeySystemMediaCapability> videoCapabilities = [];
+            MediaKeysRequirement                    distinctiveIdentifier = "optional";
+            MediaKeysRequirement                    persistentState = "optional";
+            sequence<DOMString>                     sessionTypes;
+          };
+        
    
+        
    
+          The dictionary {{MediaKeySystemConfiguration}} contains the following members:
+        
    
+        
    
+          
    
+            label of type {{DOMString}}, defaulting to ""
+          
    
+          
    
+            An optional label that will be preserved in the {{MediaKeySystemConfiguration}}
+            returned from the {{MediaKeySystemAccess/getConfiguration()}} method of
+            {{MediaKeySystemAccess}}.
+          
    
+          
    
+            initDataTypes of type sequence<{{DOMString}}>, defaulting to []
+          
    
+          
    
+            A list of supported [=Initialization Data Type=] names. The [=Initialization Data
+            Type=] capability of this object is considered supported if the list is empty or
+            contains one or more values that are supported with all other members (as determined by
+            the algorithm). Values in the sequence MUST not be the empty string.
+          
    
+          
    
+            audioCapabilities of type sequence<{{MediaKeySystemMediaCapability}}>, defaulting to
+            []
+          
    
+          
    
+            A list of supported audio type and capability pairs. The audio capability of this
+            object is considered supported if the list is empty or contains one or more values that
+            are supported with all other members (as determined by the algorithm). When there is a
+            conflict between values, the earlier value will be selected. An empty list indicates
+            that no audio capabilities are supported. In this case, the
+            {{MediaKeySystemConfiguration/videoCapabilities}} element must not be empty.
+          
    
+          
    
+            videoCapabilities of type sequence<{{MediaKeySystemMediaCapability}}>, defaulting to
+            []
+          
    
+          
    
+            A list of supported video type and capability pairs. The video capability of this
+            object is considered supported if the list is empty or contains one or more values that
+            are supported with all other members (as determined by the algorithm). When there is a
+            conflict between values, the earlier value will be selected. An empty list indicates
+            that no video capabilities are supported. In this case, the
+            {{MediaKeySystemConfiguration/audioCapabilities}} element must not be empty.
+          
    
+          
    
+            distinctiveIdentifier of type {{MediaKeysRequirement}},
+            defaulting to "optional"
+          
    
+          
    
+            Whether use of a [=Distinctive Identifier(s)=] is required.
+            
    
+              When this member is {{MediaKeysRequirement/"not-allowed"}}, the implementation MUST
+              NOT [=use Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=] for any
+              operations associated with any object created from this configuration.
+            
    
+          
    
+          
    
+            persistentState of type {{MediaKeysRequirement}}, defaulting to
+            "optional"
+          
    
+          
    
+            Whether the ability to persist state is required. This includes session data and any
+            other type of state.
+            
    
+              The [=CDM=] MUST NOT persist any state related to the application or [=origin=] of
+              this object's [=Document=] when this member is
+              {{MediaKeysRequirement/"not-allowed"}}.
+            
    
+            
    
+              For the purposes of this member, persistent state does not include persistent unique
+              identifiers ([=Distinctive Identifiers=]) controlled by the [=Key System=]
+              implementation. {{MediaKeySystemConfiguration/distinctiveIdentifier}} independently
+              reflects this requirement.
+            
    
+            
    
+              Only {{MediaKeySessionType/"temporary"}} sessions may be created when persistent
+              state is not supported.
+            
    
+            
    
+              For {{MediaKeySessionType/"temporary"}} sessions, the need and ability to store state
+              is [=Key System=] implementation-specific and may vary by feature used.
+            
    
+            
    
+              Applications intending to create non-{{MediaKeySessionType/"temporary"}} sessions,
+              should set this member to {{MediaKeysRequirement/"required"}} when calling
+              {{Navigator/requestMediaKeySystemAccess()}}.
+            
    
+          
    
+          
    
+            sessionTypes of type sequence<{{DOMString}}>
+          
    
+          
    
+            A list of {{MediaKeySessionType}}s that must be supported. All values must be
+            supported.
+            
    
+              If this member is [=map/exist|not present=] [[Infra]] when the dictionary is passed
+              to {{Navigator/requestMediaKeySystemAccess()}}, the dictionary will be treated as if
+              this member is set to [ {{MediaKeySessionType/"temporary"}} ].
+            
    
+          
    
+        
    
+        
    
+          Implementations SHOULD NOT add members to this dictionary. Should member(s) be added,
+          they MUST be of type {{MediaKeysRequirement}}, and it is RECOMMENDED that they have
+          default values of {{MediaKeysRequirement/"optional"}} to support the widest range of
+          application and client combinations.
+        
    
+        
    
+          Dictionary members not recognized by a user agent implementation are ignored per
+          [[WEBIDL]] and will not be considered in the {{Navigator/requestMediaKeySystemAccess()}}
+          algorithm. Should an application use non-standard dictionary member(s), it MUST NOT rely
+          on user agent implementations rejecting a configuration that includes such dictionary
+          members.
+        
    
+        
    
+          This dictionary MUST NOT be used to pass state or data to the [=CDM=].
+        
    
+
    +
    +

    + MediaKeySystemMediaCapability dictionary +

    + 
    +            dictionary MediaKeySystemMediaCapability {
+              DOMString contentType = "";
+              DOMString? encryptionScheme = null;
               DOMString robustness = "";
             };
    -

    Dictionary MediaKeySystemMediaCapability Members

    +

    + Dictionary MediaKeySystemMediaCapability Members +

    -
    contentType of type {{DOMString}}, defaulting to ""
    +
    + contentType of type {{DOMString}}, defaulting to + "" +

    - The type of the media resource. - Its value must be a [=valid media MIME type=]. - The empty string is invalid. + The type of the media resource. Its value + must be a [=valid media MIME type=]. The empty string is invalid.

    -
    encryptionScheme of type {{DOMString}}, defaulting to null
    +
    + encryptionScheme of type {{DOMString}}, defaulting to + null +

    - The encryption scheme associated with the content type. - A value which is null or not present indicates to the user agent - that no specific encryption scheme is required by the - application, and therefore any encryption scheme is acceptable. + The encryption scheme associated with the content type. A value which is null or + not present indicates to the user agent that no specific encryption scheme is + required by the application, and therefore any encryption scheme is acceptable.

    - Applications that are aware of this field SHOULD specify the - encryption schemes they require, since different encryption - schemes are generally incompatible with one another. It is - unrealistic for an application to be accepting of "any" - encryption scheme, but the default of null and the - interpretation of null as "any" provide backward - compatibility for unaware applications and a path to a + Applications that are aware of this field SHOULD specify the encryption schemes + they require, since different encryption schemes are generally incompatible with + one another. It is unrealistic for an application to be accepting of "any" + encryption scheme, but the default of null and the interpretation of null as + "any" provide backward compatibility for unaware applications and a path to a polyfill for older user agents.

    - The empty string is distinct from null or not present, - and so would be treated as an unrecognized encryption scheme. + The empty string is distinct from null or not present, and so would be treated as + an unrecognized encryption scheme.

    Well-known values for encryptionScheme are:

    -
      -
    • cenc: - The "cenc" mode, defined in [[CENC]], section 4.2a. AES-CTR - mode full sample and video NAL subsample encryption. -
      • -
    • cbcs: - The "cbcs" mode, defined in [[CENC]], section 4.2d. AES-CBC - mode partial video NAL pattern encryption. For video, the - spec allows various encryption patterns. -
      • -
    • cbcs-1-9: - The same as [="cbcs"=] mode, but with a - specific encrypt:skip pattern of 1:9 for video, as - recommended in [[CENC]], section 10.4.2. -
      • -
    +
      +
    • + cenc: The "cenc" + mode, defined in [[CENC]], section 4.2a. AES-CTR mode full sample and video NAL + subsample encryption. +
      • +
    • + cbcs: The "cbcs" + mode, defined in [[CENC]], section 4.2d. AES-CBC mode partial video NAL pattern + encryption. For video, the spec allows various encryption patterns. +
      • +
    • + cbcs-1-9: The same as [="cbcs"=] + mode, but with a specific encrypt:skip pattern of 1:9 for video, as recommended + in [[CENC]], section 10.4.2. +
      • +
    -
    robustness of type {{DOMString}}, defaulting to ""
    +
    + robustness of type {{DOMString}}, defaulting to + "" +

    - The robustness level associated with the content type. - The empty string indicates that any ability to decrypt and decode the content type is acceptable. + The robustness level associated with the content type. The empty string indicates + that any ability to decrypt and decode the content type is acceptable.

    - Implementations MUST configure the [=CDM=] to support at least the robustness levels specified in the configuration of the {{MediaKeySystemAccess}} object used to create the {{MediaKeys}} object. - Exact configuration of the [=CDM=] is implementation-specific, and implementations MAY configure the [=CDM=] to use the highest robustness level in the configuration even if a higher robustness level is available. - If only the empty string is specified, implementations MAY be configured to use the lowest robustness level the implementation supports. + Implementations MUST configure the [=CDM=] to support at least the robustness + levels specified in the configuration of the {{MediaKeySystemAccess}} object used + to create the {{MediaKeys}} object. Exact configuration of the [=CDM=] is + implementation-specific, and implementations MAY configure the [=CDM=] to use the + highest robustness level in the configuration even if a higher robustness level + is available. If only the empty string is specified, implementations MAY be + configured to use the lowest robustness level the implementation supports.

    - Applications SHOULD specify the robustness level(s) they require to avoid unexpected client incompatibilities. + Applications SHOULD specify the robustness level(s) they require to avoid + unexpected client incompatibilities.

    - -

    In order for the capability represented by this object to be considered supported, {{MediaKeySystemMediaCapability/contentType}} MUST NOT be the empty string and its entire value, including all codecs, MUST be supported with {{MediaKeySystemMediaCapability/robustness}}.

    -

    If any of a set of codecs is acceptable, use a separate instances of this dictionary for each codec.

    +

    + In order for the capability represented by this object to be considered supported, + {{MediaKeySystemMediaCapability/contentType}} MUST NOT be the empty string and its entire + value, including all codecs, MUST be supported with + {{MediaKeySystemMediaCapability/robustness}}. +

    +

    + If any of a set of codecs is acceptable, use a separate instances of this dictionary for + each codec. +

    - -
    -

    MediaKeySystemAccess Interface

    -

    The {{MediaKeySystemAccess}} object provides access to a [=Key System=].

    - +

    + MediaKeySystemAccess Interface +

    +

    + The {{MediaKeySystemAccess}} object provides access to a [=Key System=]. + 

             [Exposed=Window, SecureContext] interface MediaKeySystemAccess {
           readonly attribute DOMString keySystem;
@@ -1370,132 +2556,289 @@ 
    MediaKeySystemAccess Interface
    
         };
    -

    Attributes

    +

    + Attributes +

    -
    keySystem of type {{DOMString}}, readonly
    -
    Identifies the [=Key System=] being used.
    +
    + keySystem of type {{DOMString}}, readonly +
    +
    + Identifies the [=Key System=] being used. +
    -

    Methods

    +

    + Methods +

    -
    getConfiguration()
    +
    + getConfiguration() +
    -

    Returns the supported combination of configuration options selected by the {{Navigator/requestMediaKeySystemAccess()}} algorithm. -

    -

    The returned object is a non-strict subset (plus any implied defaults) of the first satisfiable {{MediaKeySystemConfiguration}} configuration passed to the {{Navigator/requestMediaKeySystemAccess()}} call that returned the promise that was resolved with this object. - It does not contain values capabilities not specified in that single configuration (other than implied defaults) and thus may not reflect all capabilities of the [=Key System=] implementation. - All values in the configuration may be used in any combination. - Members of type {{MediaKeysRequirement}} reflect whether the capability is required for any combination. They will not have the value {{MediaKeysRequirement/"optional"}}. -

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      -
    1. -

      - Return this object's configuration value. -

      -

      - This results in a new object being created and initialized from configuration each time this method is called. -

      -

      - If {{MediaKeySystemMediaCapability/encryptionScheme}} was not given by the application, the accumulated configuration MUST still contain an {{MediaKeySystemMediaCapability/encryptionScheme}} field with a value of null, so that polyfills can detect the user agent's support for the field without specifying specific values. -

      -
      2. -
    -
    -
    createMediaKeys()
    -
    -

    Creates a new {{MediaKeys}} object for keySystem.

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      -

    1. Let promise be a new promise.

      2. -

    2. Run the following steps in parallel:

      -
        -

      1. Let configuration be the value of this object's configuration value.

        2. -
      2. -

        - Let use distinctive identifier be true if the value of configuration's {{MediaKeySystemConfiguration/distinctiveIdentifier}} - member is {{MediaKeysRequirement/"required"}} and false otherwise. -

        -
        3. -
      3. -

        - Let persistent state allowed be true if the value of configuration's {{MediaKeySystemConfiguration/persistentState}} - member is {{MediaKeysRequirement/"required"}} and false otherwise. -

        -
        4. -

      4. Load and initialize the [=Key System=] implementation represented by this object's cdm implementation value if necessary.

        5. -

      5. Let instance be a new instance of the [=Key System=] implementation represented by this object's cdm implementation value.

        6. -

      6. Initialize instance to enable, disable and/or select [=Key System=] features using configuration.

        7. -

      7. If use distinctive identifier is false, prevent instance from [=uses Distinctive Identifier(s) or Distinctive Permanent Identifier(s)|using Distinctive Identifier(s) and Distinctive Permanent Identifier(s)=].

        8. -

      8. If persistent state allowed is false, prevent instance from persisting any state related to the application or [=origin=] of this object's [=Document=].

        9. -

      9. If any of the preceding steps failed, reject promise with a new {{DOMException}} whose name is the appropriate error name.

        10. -

      10. Let media keys be a new {{MediaKeys}} object, and initialize it as follows:

        -
          -

        1. Let the use distinctive identifier value be use distinctive identifier.

          2. -

        2. Let the persistent state allowed value be persistent state allowed.

          3. -

        3. Let the supported session types value be be the value of configuration's {{MediaKeySystemConfiguration/sessionTypes}} member.

          4. -

        4. Let the cdm implementation value be this object's cdm implementation value.

          5. -

        5. Let the cdm instance value be instance.

          6. -
        -
        11. -

      11. Resolve promise with media keys.

        12. -
      -
      3. -

    3. Return promise.

      4. -
    -
    -
    +

    + Returns the supported combination of configuration options selected by the + {{Navigator/requestMediaKeySystemAccess()}} algorithm. +

    +

    + The returned object is a non-strict subset (plus any implied defaults) of the first + satisfiable {{MediaKeySystemConfiguration}} configuration passed to the + {{Navigator/requestMediaKeySystemAccess()}} call that returned the promise that was + resolved with this object. It does not contain values capabilities not specified in + that single configuration (other than implied defaults) and thus may not reflect all + capabilities of the [=Key System=] implementation. All values in the configuration + may be used in any combination. Members of type {{MediaKeysRequirement}} reflect + whether the capability is required for any combination. They will not have the value + {{MediaKeysRequirement/"optional"}}. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. +

      + Return this object's configuration value. +

      +

      + This results in a new object being created and initialized from + configuration each time this method is called. +

      +

      + If {{MediaKeySystemMediaCapability/encryptionScheme}} was not given by the + application, the accumulated configuration MUST still contain an + {{MediaKeySystemMediaCapability/encryptionScheme}} field with a value of + null, so that polyfills can detect the user agent's support for the + field without specifying specific values. +

      +
      2. +
    + +
    + createMediaKeys() +
    +
    +

    + Creates a new {{MediaKeys}} object for keySystem. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. +

      + Let promise be a new promise. +

      +
      2. +
    2. +

      + Run the following steps in parallel: +

      +
        +
      1. +

        + Let configuration be the value of this object's + configuration value. +

        +
        2. +
      2. +

        + Let use distinctive identifier be true if the value + of configuration's + {{MediaKeySystemConfiguration/distinctiveIdentifier}} member is + {{MediaKeysRequirement/"required"}} and false otherwise. +

        +
        3. +
      3. +

        + Let persistent state allowed be true if the value of + configuration's {{MediaKeySystemConfiguration/persistentState}} + member is {{MediaKeysRequirement/"required"}} and false + otherwise. +

        +
        4. +
      4. +

        + Load and initialize the [=Key System=] implementation represented by this + object's cdm implementation value if necessary. +

        +
        5. +
      5. +

        + Let instance be a new instance of the [=Key System=] + implementation represented by this object's cdm implementation + value. +

        +
        6. +
      6. +

        + Initialize instance to enable, disable and/or select [=Key + System=] features using configuration. +

        +
        7. +
      7. +

        + If use distinctive identifier is false, prevent + instance from [=uses Distinctive Identifier(s) or Distinctive + Permanent Identifier(s)|using Distinctive Identifier(s) and Distinctive + Permanent Identifier(s)=]. +

        +
        8. +
      8. +

        + If persistent state allowed is false, prevent + instance from persisting any state related to the application or + [=origin=] of this object's [=Document=]. +

        +
        9. +
      9. +

        + If any of the preceding steps failed, reject promise with a new + {{DOMException}} whose name is the appropriate error + name. +

        +
        10. +
      10. +

        + Let media keys be a new {{MediaKeys}} object, and initialize it as + follows: +

        +
          +
        1. +

          + Let the use distinctive identifier value be use + distinctive identifier. +

          +
          2. +
        2. +

          + Let the persistent state allowed value be persistent + state allowed. +

          +
          3. +
        3. +

          + Let the supported session types value be be the value of + configuration's {{MediaKeySystemConfiguration/sessionTypes}} + member. +

          +
          4. +
        4. +

          + Let the cdm implementation value be this object's cdm + implementation value. +

          +
          5. +
        5. +

          + Let the cdm instance value be instance. +

          +
          6. +
        +
        11. +
      11. +

        + Resolve promise with media keys. +

        +
        12. +
      +
      3. +
    3. +

      + Return promise. +

      +
      4. +
    +
    +
    -
    -

    MediaKeys Interface

    -

    The {{MediaKeys}} object represents a set of keys that an associated {{HTMLMediaElement}} can use for decryption of [=HTMLMediaElement/media data=] during playback. - It also represents a [=CDM=] instance. +

    + MediaKeys Interface +

    +

    + The {{MediaKeys}} object represents a set of keys that an associated {{HTMLMediaElement}} + can use for decryption of [=HTMLMediaElement/media data=] during playback. It also + represents a [=CDM=] instance.

    -

    A {{MediaKeys}} object may be destroyed by the user agent when it is no longer accessible

    -

    For example, when there are no script references and no attached media element.

    -

    For methods that return a promise, all errors are reported asynchronously by rejecting the returned Promise. This includes [[WEBIDL]] type mapping errors.

    -

    The steps of an algorithm are always aborted when rejecting a promise.

    - - 
    -        enum MediaKeySessionType {
-          "temporary",
-          "persistent-license"
-        };
-
    -

    The MediaKeySessionType enumeration is defined as follows:

    - - - - -
    Enumeration description
    temporary -

    - A session for which the license, key(s) and record of or data related to the session are not persisted. -

    -

    - The application need not worry about managing such storage. - Support for this session type is REQUIRED. -

    -
    persistent-license -

    - A session for which the license (and potentially other data related to the session) will be persisted. - A [=record of license destruction=] SHALL be persisted when the license and key(s) it contains are destroyed. - The record of license destruction is a [=Key System=]-specific attestation that the license and key(s) it contains are no longer usable by the client. - Support for this session type is OPTIONAL. -

    -

    - Sessions of this type can only be created if the configuration associated with the {{MediaKeySystemAccess}} object that created this object has a {{MediaKeySystemConfiguration/persistentState}} value of {{MediaKeysRequirement/"required"}}. - The session MUST be loadable via its [=Session ID=] once {{MediaKeySession/update()}} is called successfully. - A {{message}} of type {{MediaKeyMessageType/"license-release"}} containing the [=record of license destruction=] will be generated when {{MediaKeySession/remove()}} is called until the record is acknowledged by a response passed to {{MediaKeySession/update()}}. -

    -

    - The application is responsible for ensuring that data persisted for such sessions is removed when the application no longer needs it. - See Session Storage and Persistence. -

    -
    - +

    + A {{MediaKeys}} object may be destroyed by the user agent when it is no longer accessible +

    +

    + For example, when there are no script references and no attached media element. +

    +

    + For methods that return a promise, all errors are reported asynchronously by rejecting the + returned Promise. This includes [[WEBIDL]] type mapping errors. +

    +

    + The steps of an algorithm are always aborted when rejecting a promise. +

    + 
    +        enum MediaKeySessionType {
+          "temporary",
+          "persistent-license"
+        };
+
    +

    + The MediaKeySessionType enumeration is defined as follows: +

    + + + + + + + + + + + + + + +
    + Enumeration description +
    + temporary + +

    + A session for which the license, key(s) and record of or data related to the + session are not persisted. +

    +

    + The application need not worry about managing such storage. Support for this + session type is REQUIRED. +

    +
    + persistent-license + +

    + A session for which the license (and potentially other data related to the session) + will be persisted. A [=record of license destruction=] SHALL be persisted when the + license and key(s) it contains are destroyed. The record of license + destruction is a [=Key System=]-specific attestation that the license and + key(s) it contains are no longer usable by the client. Support for this session + type is OPTIONAL. +

    +

    + Sessions of this type can only be created if the configuration associated with the + {{MediaKeySystemAccess}} object that created this object has a + {{MediaKeySystemConfiguration/persistentState}} value of + {{MediaKeysRequirement/"required"}}. The session MUST be loadable via its [=Session + ID=] once {{MediaKeySession/update()}} is called successfully. A {{message}} of + type {{MediaKeyMessageType/"license-release"}} containing the [=record of license + destruction=] will be generated when {{MediaKeySession/remove()}} is called until + the record is acknowledged by a response passed to {{MediaKeySession/update()}}. +

    +

    + The application is responsible for ensuring that data persisted for such sessions + is removed when the application no longer needs it. See Session Storage and Persistence. +

    + 
             [Exposed=Window, SecureContext] interface MediaKeys {
             MediaKeySession createSession (optional MediaKeySessionType sessionType = "temporary");
@@ -1503,63 +2846,151 @@ 
    MediaKeys Interface
    
             Promise<boolean> setServerCertificate (BufferSource serverCertificate);
         };
    - -
    -

    Methods

    -
    -
    createSession()
    +
    +

    + Methods +

    +
    +
    + createSession() +
    -

    Returns a new {{MediaKeySession}} object.

    -

    The sessionType parameter affects the behavior of the returned object.

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      -

    1. If this object's supported session types value does not contain sessionType, [=exception/throw=] - [[WEBIDL]] a {{NotSupportedError}}.

      -

      sessionType values for which the [=Is persistent session type?=] algorithm returns true will fail if this object's persistent state allowed value is false.

      -
      2. -

    2. If the implementation does not support {{MediaKeySession}} operations in the current state, [=exception/throw=] - [[WEBIDL]] an {{InvalidStateError}}.

      -

      Some implementations are unable to execute {{MediaKeySession}} algorithms until this {{MediaKeys}} object is associated with a media element using {{HTMLMediaElement/setMediaKeys()}}. - This step enables applications to detect this uncommon behavior before attempting to perform such operations. -

      -
      3. -

    3. Let session be a new {{MediaKeySession}} object, and initialize it as follows:

      -
        -

      1. Let the {{MediaKeySession/sessionId}} attribute be the empty string.

        2. -

      2. Let the {{MediaKeySession/expiration}} attribute be NaN.

        3. -

      3. Let the {{MediaKeySession/closed}} attribute be a new promise.

        4. -

      4. Let key status be a new empty {{MediaKeyStatusMap}} object, and initialize it as follows:

        -
          -

        1. Let the {{MediaKeyStatusMap/size}} attribute be 0.

          2. -
        -
        5. -

      5. Let the session type value be sessionType.

        6. -

      6. Let the uninitialized value be true.

        7. -

      7. Let the callable value be false.

        8. -

      8. Let the closing or closed value be false.

        9. -

      9. Let the use distinctive identifier value be this object's use distinctive identifier value.

        10. -

      10. Let the cdm implementation value be this object's cdm implementation.

        11. -

      11. Let the cdm instance value be this object's cdm instance.

        12. -
      -
      4. -

    4. Return session.

      5. -
    +

    + Returns a new {{MediaKeySession}} object. +

    +

    + The sessionType parameter affects the behavior of the returned object. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. +

      + If this object's supported session types value does not contain + sessionType, [=exception/throw=] [[WEBIDL]] a {{NotSupportedError}}. +

      +

      + sessionType values for which the [=Is persistent session type?=] + algorithm returns true will fail if this object's persistent + state allowed value is false. +

      +
      2. +
    2. +

      + If the implementation does not support {{MediaKeySession}} operations in the + current state, [=exception/throw=] [[WEBIDL]] an {{InvalidStateError}}. +

      +

      + Some implementations are unable to execute {{MediaKeySession}} algorithms until + this {{MediaKeys}} object is associated with a media element using + {{HTMLMediaElement/setMediaKeys()}}. This step enables applications to detect + this uncommon behavior before attempting to perform such operations. +

      +
      3. +
    3. +

      + Let session be a new {{MediaKeySession}} object, and initialize it as + follows: +

      +
        +
      1. +

        + Let the {{MediaKeySession/sessionId}} attribute be the empty string. +

        +
        2. +
      2. +

        + Let the {{MediaKeySession/expiration}} attribute be NaN. +

        +
        3. +
      3. +

        + Let the {{MediaKeySession/closed}} attribute be a new promise. +

        +
        4. +
      4. +

        + Let key status be a new empty {{MediaKeyStatusMap}} object, and + initialize it as follows: +

        +
          +
        1. +

          + Let the {{MediaKeyStatusMap/size}} attribute be 0. +

          +
          2. +
        +
        5. +
      5. +

        + Let the session type value be sessionType. +

        +
        6. +
      6. +

        + Let the uninitialized value be true. +

        +
        7. +
      7. +

        + Let the callable value be false. +

        +
        8. +
      8. +

        + Let the closing or closed value be false. +

        +
        9. +
      9. +

        + Let the use distinctive identifier value be this object's use + distinctive identifier value. +

        +
        10. +
      10. +

        + Let the cdm implementation value be this object's cdm + implementation. +

        +
        11. +
      11. +

        + Let the cdm instance value be this object's cdm + instance. +

        +
        12. +
      +
      4. +
    4. +

      + Return session. +

      +
      5. +
    -
    getStatusForPolicy()
    -
    -

    Returns the {{MediaKeyStatus}} for a given {{MediaKeysPolicy}}.

    -
    - 
    +          
    
+            getStatusForPolicy()
+          
    
+          
    
+            
    
+              Returns the {{MediaKeyStatus}} for a given {{MediaKeysPolicy}}.
+            
    
+            
    
+              
                       dictionary MediaKeysPolicy {
                       HDCPVersion minHdcpVersion;
                   };
                 
    
-                
    The {{MediaKeysPolicy}} dictionary is an object consisting of only optional properties. Each property represents a
-                  policy requirement. A policy is said to be fulfilled if the [=CDM=] would allow presentation of decrypted
-                  media data based on all of the requirements.
    
-              
    
-              
    
-                
    +              
    
+                The {{MediaKeysPolicy}} dictionary is an object consisting of only optional
+                properties. Each property represents a policy requirement. A policy is said to be
+                fulfilled if the [=CDM=] would allow presentation of decrypted media data based on
+                all of the requirements.
+              
    
+            
    
+            
    
+              
                       enum HDCPVersion {
                       "1.0",
                       "1.1",
@@ -1572,161 +3003,319 @@ 
    Methods
    
                       "2.3",
                   };
                 
    
-                
    The HDCP Policy is represented by {{MediaKeysPolicy/minHdcpVersion}}. When set, the policy requirement will be fulfilled if the system
-                  supports {{MediaKeysPolicy/minHdcpVersion}} on the current display.
    
-                  
    The determination of HDCP status should be done in the same way that the [=CDM=] would enforce such a
-                    restriction during playback. In this way, application developers can get a reasonable hint to allow them to
-                    optimize what content they fetch to start playback.
    
-                
    
-                
    When this method is invoked, the user agent MUST run the following steps:
    
-                
      
-                  
    1. If policy has no [=map/exist|present=] [=dictionary members=], return a promise rejected with a newly created {{TypeError}}.
      2. 
-                  
    2. Let promise be a new promise.
      
+              
      
+                The HDCP Policy is represented by {{MediaKeysPolicy/minHdcpVersion}}. When set, the
+                policy requirement will be fulfilled if the system supports
+                {{MediaKeysPolicy/minHdcpVersion}} on the current display.
+              
      
+              
      
+                The determination of HDCP status should be done in the same way that the [=CDM=]
+                would enforce such a restriction during playback. In this way, application
+                developers can get a reasonable hint to allow them to optimize what content they
+                fetch to start playback.
+              
      
+
    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. If policy has no [=map/exist|present=] [=dictionary members=], return + a promise rejected with a newly created {{TypeError}}. +
      2. +
    2. +

      + Let promise be a new promise. +

      +
        +
      1. +

        + For each [=dictionary member=] of policy, run the following steps: +

          -

        1. For each [=dictionary member=] of policy, run the following steps:

          -
            -

          1. If the [=CDM=] cannot determine the {{MediaKeyStatus}} for the [=dictionary member=], then reject promise with {{NotSupportedError}} and abort these steps.

            2. -
          +
        2. +

          + If the [=CDM=] cannot determine the {{MediaKeyStatus}} for the + [=dictionary member=], then reject promise with + {{NotSupportedError}} and abort these steps. +

          3. -

        3. For each [=dictionary member=] of policy, run the following steps:

          -
            -

          1. If the [=CDM=] would block presentation of decrypted media data for the [=dictionary member=], then resolve promise with {{MediaKeyStatus/"output-restricted"}}.

            2. -
          +
        +
        2. +
      2. +

        + For each [=dictionary member=] of policy, run the following steps: +

        +
          +
        1. +

          + If the [=CDM=] would block presentation of decrypted media data for the + [=dictionary member=], then resolve promise with + {{MediaKeyStatus/"output-restricted"}}. +

          2. -

        2. Resolve promise with {{MediaKeyStatus/"usable"}}.

        3. -

      3. Return promise.

        4. +
      4. +

        + Resolve promise with {{MediaKeyStatus/"usable"}}. +

        +
      -
    -
    setServerCertificate()
    -
    -

    Provides a server certificate to be used to encrypt messages to the license server.

    -

    [=Key Systems=] that use such certificates MUST also support requesting the certificate from the server via the [=Queue a "message" Event=] algorithm.

    -

    This method allows an application to proactively provide a server certificate to implementations that support it to avoid the additional round trip should the [=CDM=] request it. - It is intended as an optimization, and applications are not required to use it. -

    -

    The server certificate contents are [=Key System=]-specific. It MUST NOT contain executable code.

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      -

    1. If the [=Key System=] implementation represented by this object's cdm implementation value does not support server certificates, return a promise resolved with false.

      2. -

    2. If serverCertificate is an empty array, return a promise rejected with a new a newly created {{TypeError}}.

      3. - -

    3. Let certificate be a copy of the contents of the serverCertificate parameter.

      4. -

    4. Let promise be a new promise.

      5. -

    5. Run the following steps in parallel:

      -
        -

      1. Let sanitized certificate be a validated and/or sanitized version of certificate.

        -

        The user agent should thoroughly validate the certificate before passing it to the [=CDM=]. - This may include verifying values are within reasonable limits, stripping irrelevant data or fields, pre-parsing it, sanitizing it, and/or generating a fully sanitized version. - The user agent should check that the length and values of fields are reasonable. - Unknown fields should be rejected or removed. -

        -
        2. -

      2. Use this object's cdm instance to process sanitized certificate.

        3. -

      3. If the preceding step failed, reject promise with a new {{DOMException}} whose name is the appropriate error name.

        4. -

      4. Resolve promise with true.

        5. -
      -
      6. -

    6. Return promise.

      7. -
    + +
  • +

    + Return promise. +

    +
    • +
    -
    -
    - +
    + setServerCertificate() +
    +
    +

    + Provides a server certificate to be used to encrypt messages to the license server. +

    +

    + [=Key Systems=] that use such certificates MUST also support requesting the + certificate from the server via the [=Queue a "message" Event=] algorithm. +

    +

    + This method allows an application to proactively provide a server certificate to + implementations that support it to avoid the additional round trip should the [=CDM=] + request it. It is intended as an optimization, and applications are not required to + use it. +

    +

    + The server certificate contents are [=Key System=]-specific. It MUST NOT contain + executable code. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. +

      + If the [=Key System=] implementation represented by this object's cdm + implementation value does not support server certificates, return a promise + resolved with false. +

      +
      2. +
    2. +

      + If serverCertificate is an empty array, return a promise rejected with + a new a newly created {{TypeError}}. +

      +
      3. +
    3. +

      + Let certificate be a copy of the contents of the + serverCertificate parameter. +

      +
      4. +
    4. +

      + Let promise be a new promise. +

      +
      5. +
    5. +

      + Run the following steps in parallel: +

      +
        +
      1. +

        + Let sanitized certificate be a validated and/or sanitized version + of certificate. +

        +

        + The user agent should thoroughly validate the certificate before passing it + to the [=CDM=]. This may include verifying values are within reasonable + limits, stripping irrelevant data or fields, pre-parsing it, sanitizing it, + and/or generating a fully sanitized version. The user agent should check that + the length and values of fields are reasonable. Unknown fields should be + rejected or removed. +

        +
        2. +
      2. +

        + Use this object's cdm instance to process sanitized + certificate. +

        +
        3. +
      3. +

        + If the preceding step failed, reject promise with a new + {{DOMException}} whose name is the appropriate error + name. +

        +
        4. +
      4. +

        + Resolve promise with true. +

        +
        5. +
      +
      6. +
    6. +

      + Return promise. +

      +
      7. +
    +
    +
    +
    -

    Algorithms

    +

    + Algorithms +

    -

    Is persistent session type?

    -

    The Is persistent session type? algorithm is run to determine whether the specified session type supports persistence of any kind. - Requests to run this algorithm include a {{MediaKeySessionType}} value. +

    + Is persistent session type? +

    +

    + The Is persistent session type? algorithm is run to determine whether the specified + session type supports persistence of any kind. Requests to run this algorithm include a + {{MediaKeySessionType}} value. +

    +

    + The following steps are run:

    -

    The following steps are run:

      -

    1. Let the session type be the specified {{MediaKeySessionType}} value.

      2. -

    2. Follow the steps for the value of session type from the following list:

      -
      -
      {{MediaKeySessionType/"temporary"}}
      -
      Return false.
      -
      {{MediaKeySessionType/"persistent-license"}}
      -
      Return true.
      -
      -
      3. -
    +
  • +

    + Let the session type be the specified {{MediaKeySessionType}} value. +

    +
    • +
  • +

    + Follow the steps for the value of session type from the following list: +

    +
    +
    + {{MediaKeySessionType/"temporary"}} +
    +
    + Return false. +
    +
    + {{MediaKeySessionType/"persistent-license"}} +
    +
    + Return true. +
    +
    +
    • +
    -
    -

    CDM Unavailable

    +

    + CDM Unavailable +

    - The CDM unavailable algorithm is run to close all {{MediaKeySession}} objects associated with a {{MediaKeys}} object, media keys - when the [=CDM=] instance becomes unavailable. + The CDM unavailable algorithm is run to close all {{MediaKeySession}} objects + associated with a {{MediaKeys}} object, media keys when the [=CDM=] instance + becomes unavailable. +

    +

    + The following step is run:

    -

    The following step is run:

    1. -

      For each {{MediaKeySession}} created by the media keys that is not [=media key session/closed=], [=queue a task=] to run the [=Session Closed=] algorithm on the session with reason {{MediaKeyStatus/"internal-error"}}.

      +

      + For each {{MediaKeySession}} created by the media keys that is not + [=media key session/closed=], [=queue a task=] to run the [=Session Closed=] + algorithm on the session with reason {{MediaKeyStatus/"internal-error"}}. +

    -

    Storage and Persistence

    -

    This section describes general requirements related to storage and persistence.

    - +

    + Storage and Persistence +

    - If a {{MediaKeys}} object's persistent state allowed value is false then the object's cdm instance - SHALL NOT persist state or access previously persisted state as a result of operations on this object or any sessions that it creates. + This section describes general requirements related to storage and persistence.

    - If a {{MediaKeys}} object's persistent state allowed value is true then the object's cdm instance - MAY persist state or access previously persisted state as a result of operations on this object or any sessions that it creates. + If a {{MediaKeys}} object's persistent state allowed value is + false then the object's cdm instance SHALL NOT persist state or + access previously persisted state as a result of operations on this object or any + sessions that it creates.

    - -

    Persisted data MUST always be stored such that only the [=origin=] of this object's [=Document=] can access it. - In addition, the data MUST only be accessible by the current [=browsing profile=]; other browsing profiles, user agents, and applications MUST NOT be able to access the stored data. - See Information Stored on User Devices. +

    + If a {{MediaKeys}} object's persistent state allowed value is + true then the object's cdm instance MAY persist state or access + previously persisted state as a result of operations on this object or any sessions that + it creates. +

    +

    + Persisted data MUST always be stored such that only the [=origin=] of this object's + [=Document=] can access it. In addition, the data MUST only be accessible by the current + [=browsing profile=]; other browsing profiles, user agents, and applications MUST NOT be + able to access the stored data. See Information Stored on + User Devices. +

    +

    + See and for additional considerations + when supporting persistent storage.

    - -

    See and for additional considerations when supporting persistent storage.

    -
    - -
    -

    MediaKeySession Interface

    -

    The {{MediaKeySession}} object represents a [=key session=].

    +

    + MediaKeySession Interface +

    +

    + The {{MediaKeySession}} object represents a [=key session=]. +

    - A {{MediaKeySession}} object is closed if and only if the object's {{MediaKeySession/closed}} attribute has been resolved. + A {{MediaKeySession}} object is closed if and + only if the object's {{MediaKeySession/closed}} attribute has been resolved.

    - The User Agent SHALL execute the [=Monitor for CDM State Changes=] algorithm continuously for each {{MediaKeySession}} object - that is not [=media key session/closed=]. - The [=Monitor for CDM State Changes=] algorithm MUST be run in parallel to the main event loop but not in parallel to other procedures defined - in this specification that are also defined to be run in parallel. + The User Agent SHALL execute the [=Monitor for CDM State Changes=] algorithm continuously + for each {{MediaKeySession}} object that is not [=media key session/closed=]. The [=Monitor + for CDM State Changes=] algorithm MUST be run in parallel to the main event loop but not in + parallel to other procedures defined in this specification that are also defined to be run + in parallel.

    - A {{MediaKeySession}} object SHALL NOT be destroyed and SHALL continue to receive events if it is - not [=media key session/closed=] and the {{MediaKeys}} object that created it remains accessible. - Otherwise, a {{MediaKeySession}} object that is no longer accessible SHALL NOT receive further - events and MAY be destroyed. + A {{MediaKeySession}} object SHALL NOT be destroyed and SHALL continue to receive events if + it is not [=media key session/closed=] and the {{MediaKeys}} object that created it remains + accessible. Otherwise, a {{MediaKeySession}} object that is no longer accessible SHALL NOT + receive further events and MAY be destroyed.

    - The above rule implies that the [=CDM=] instance must not be destroyed until all {{MediaKeys}} - objects and all {{MediaKeySession}} objects associated with the [=CDM=] instance are destroyed. + The above rule implies that the [=CDM=] instance must not be destroyed until all + {{MediaKeys}} objects and all {{MediaKeySession}} objects associated with the [=CDM=] + instance are destroyed.

    - If a {{MediaKeySession}} object is not [=media key session/closed=] when it becomes inaccessible to the page, the [=CDM=] SHALL close the [=key session=] associated with the object. + If a {{MediaKeySession}} object is not [=media key session/closed=] when it becomes + inaccessible to the page, the [=CDM=] SHALL close the [=key session=] associated with the + object. +

    +

    + Closing the key session results in the destruction of any license(s) and key(s) that have + not been explicitly stored.

    -

    Closing the key session results in the destruction of any license(s) and key(s) that have not been explicitly stored.

    - Exactly when the key session is closed is an implementation detail, and applications SHOULD NOT rely on specific timing. + Exactly when the key session is closed is an implementation detail, and applications SHOULD + NOT rely on specific timing. - Applications that want to ensure a session is closed before taking some other action SHOULD call {{MediaKeySession/close()}} and wait for the returned promise to be resolved. + Applications that want to ensure a session is closed before taking some other action + SHOULD call {{MediaKeySession/close()}} and wait for the returned promise to be resolved. +

    +

    + For methods that return a promise, all errors are reported asynchronously by rejecting the + returned Promise. This includes [[WEBIDL]] type mapping errors. +

    +

    + The following steps of an algorithm are always aborted when rejecting a promise.

    -

    For methods that return a promise, all errors are reported asynchronously by rejecting the returned Promise. This includes [[WEBIDL]] type mapping errors.

    -

    The following steps of an algorithm are always aborted when rejecting a promise.

    - 
             enum MediaKeySessionClosedReason {
           "internal-error",
@@ -1736,40 +3325,79 @@ 
    MediaKeySession Interface
    
           "resource-evicted"
         };
    -

    -The MediaKeySessionClosedReason enumeration is defined as follows: -

    - - - - - -
    Enumeration description
    internal-error - The session was closed because of an unrecoverable error in the [=CDM=]. - When this occurs, applications MUST NOT create new sessions on this {{MediaKeys}} instance. -
    closed-by-application - The session was closed by the application calling the {{MediaKeySession/close()}} method of the session explicitly. -
    release-acknowledged - The session was closed because the [=CDM=] received a [=record of license destruction=] acknowledgement. -
    hardware-context-reset - The session was closed because the [=CDM=]'s original hardware context was reset. - When this occurs, the User Agent MUST allow the application to create new sessions on this {{MediaKeys}} instance. -
    -

    - This could occur for many reasons, including device hibernation, monitor configuration change, etc. - The exact reasons for a hardware context reset are implementation-dependent. -

    -
    -
    resource-evicted - The session was closed because the system needed to reclaim resources to allow the creation of other sessions. -
    -

    - This would imply that the application is running into a device-specific limit on session resources. - If the closed session is still needed for some reason, the application developer should consider some strategy to reduce the number of sessions needed or proactively close unneeded sessions. -

    -
    -
    - +

    + The MediaKeySessionClosedReason enumeration is defined as follows: +

    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    + Enumeration description +
    + internal-error + + The session was closed because of an unrecoverable error in the [=CDM=]. When this + occurs, applications MUST NOT create new sessions on this {{MediaKeys}} instance. +
    + closed-by-application + + The session was closed by the application calling the {{MediaKeySession/close()}} + method of the session explicitly. +
    + release-acknowledged + + The session was closed because the [=CDM=] received a [=record of license + destruction=] acknowledgement. +
    + hardware-context-reset + + The session was closed because the [=CDM=]'s original hardware context was reset. + When this occurs, the User Agent MUST allow the application to create new sessions on + this {{MediaKeys}} instance. +
    +

    + This could occur for many reasons, including device hibernation, monitor + configuration change, etc. The exact reasons for a hardware context reset are + implementation-dependent. +

    +
    +
    + resource-evicted + + The session was closed because the system needed to reclaim resources to allow the + creation of other sessions. +
    +

    + This would imply that the application is running into a device-specific limit on + session resources. If the closed session is still needed for some reason, the + application developer should consider some strategy to reduce the number of + sessions needed or proactively close unneeded sessions. +

    +
    + 
             [Exposed=Window, SecureContext] interface MediaKeySession : EventTarget {
           readonly        attribute DOMString                            sessionId;
@@ -1786,494 +3414,1257 @@ 
    MediaKeySession Interface
    
         };
    -

    Attributes

    +

    + Attributes +

    -
    sessionId of type {{DOMString}}, readonly
    -

    The [=Session ID=] for this object and the associated key(s) or license(s).

    -
    expiration of type {{unrestricted double}}, readonly
    +
    + sessionId of type {{DOMString}}, readonly +
    -

    The [=expiration time=] for all key(s) in the session, or NaN if no such time exists or if the license explicitly never expires, as determined by the [=CDM=].

    -

    This value MAY change during the session lifetime, such as when an action triggers the start of a window.

    +

    + The [=Session ID=] for this object and the associated key(s) or license(s). +

    -
    closed of type Promise<{{MediaKeySessionClosedReason}}>, readonly
    +
    + expiration of type {{unrestricted double}}, readonly +
    -

    Signals when the object becomes [=media key session/closed=] as a result of the [=Session Closed=] algorithm being run. - This promise can only be fulfilled and is never rejected.

    +

    + The [=expiration time=] for all key(s) in the session, or NaN if no such + time exists or if the license explicitly never expires, as determined by the [=CDM=]. +

    +

    + This value MAY change during the session lifetime, such as when an action triggers + the start of a window. +

    -
    keyStatuses of type {{MediaKeyStatusMap}}, readonly
    +
    + closed of type Promise<{{MediaKeySessionClosedReason}}>, readonly +
    -

    A reference to a read-only map of [=key IDs=] [=known=] to the session to the current status of the associated key. - Each entry MUST have a unique key ID. -

    -

    The map entries and their values may be updated whenever the event loop spins. - The map MUST NOT ever be inconsistent or partially updated, but it may change between accesses if the event loop spins in between the accesses. - Key IDs may be added as the result of a {{MediaKeySession/load()}} or {{MediaKeySession/update()}} call. - Key IDs may be removed as the result of a {{MediaKeySession/update()}} call that removes knowledge of existing keys (or replaces the existing set of keys with a new set). - Key IDs MUST NOT be removed because they became unusable, such as due to expiration. Instead, such keys MUST be given an appropriate status, such as {{MediaKeyStatus/"expired"}}. -

    -

    - Some older platforms may contain [=Key System=] implementations that do not expose key IDs, making it impossible to provide a compliant user agent implementation. - To maximize interoperability, user agent implementations exposing such [=CDMs=] SHOULD implement this member as follows: - Whenever a non-empty list is appropriate, such as when the [=key session=] represented by this object may contain [=key(s)=], populate the map with a single pair containing - the one-byte key ID 0 and the {{MediaKeyStatus}} most appropriate for the aggregated status of this object. -

    +

    + Signals when the object becomes [=media key session/closed=] as a result of the + [=Session Closed=] algorithm being run. This promise can only be fulfilled and is + never rejected. +

    -
    onkeystatuseschange of type {{EventHandler}}
    -

    Event handler for the {{keystatuseschange}} event.

    -
    onmessage of type {{EventHandler}}
    -

    Event handler for the {{message}} event.

    -
    -
    -
    -

    Methods

    -
    -
    generateRequest()
    +
    + keyStatuses of type {{MediaKeyStatusMap}}, readonly +
    -

    Generates a license request based on the initData. - A {{message}} of type {{MediaKeyMessageType/"license-request"}} or {{MediaKeyMessageType/"individualization-request"}} will always be queued if the algorithm succeeds and the promise is resolved. -

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      -

    1. If this object's closing or closed value is true, return a promise rejected with an {{InvalidStateError}}.

      2. -

    2. If this object's uninitialized value is false, return a promise rejected with an {{InvalidStateError}}.

      3. -

    3. Let this object's uninitialized value be false.

      4. -

    4. If initDataType is the empty string, return a promise rejected with a newly created {{TypeError}}.

      5. -

    5. If initData is an empty array, return a promise rejected with a newly created {{TypeError}}.

      6. -

    6. If the [=Key System=] implementation represented by this object's cdm implementation value does not support initDataType as an [=Initialization Data Type=], return a promise rejected with a {{NotSupportedError}}. String comparison is case-sensitive.

      7. -

    7. Let init data be a copy of the contents of the initData parameter.

      8. -

    8. Let session type be this object's session type.

      9. -

    9. Let promise be a new promise.

      10. -

    10. Run the following steps in parallel:

      -
        -

      1. If the init data is not valid for initDataType, reject promise with a newly created {{TypeError}}.

        2. -

      2. Let sanitized init data be a validated and sanitized version of init data.

        -

        The user agent MUST thoroughly validate the [=Initialization Data=] before passing it to the [=CDM=]. - This includes verifying that the length and values of fields are reasonable, verifying that values are within reasonable limits, and stripping irrelevant, unsupported, or unknown data or fields. - It is RECOMMENDED that user agents pre-parse, sanitize, and/or generate a fully sanitized version of the [=Initialization Data=]. - If the [=Initialization Data=] format specified by initDataType supports multiple entries, the user agent SHOULD remove entries that are not needed by the [=CDM=]. The user agent MUST NOT re-order entries within the [=Initialization Data=]. -

        -
        3. -

      3. If the preceding step failed, reject promise with a newly created {{TypeError}}.

        4. -

      4. If sanitized init data is empty, reject promise with a {{NotSupportedError}}.

        5. -

      5. Let session id be the empty string.

        6. -

      6. Let message be null.

        7. -

      7. Let message type be null.

        8. -

      8. Let cdm be the [=CDM=] instance represented by this object's cdm instance value.

        9. -

      9. Use the cdm to execute the following steps:

        -
          -

        1. If the sanitized init data is not supported by the cdm, reject promise with a {{NotSupportedError}}.

          2. -

        2. Follow the steps for the value of session type from the following list:

          -
          -
          {{MediaKeySessionType/"temporary"}}
          -
          -

          Let requested license type be a temporary non-persistable license.

          -

          The returned license must not be persistable or require persisting information related to it.

          -
          -
          {{MediaKeySessionType/"persistent-license"}}
          -
          -

          Let requested license type be a persistable license.

          -
          -
          -
          3. - -

        3. Let session id be a unique [=Session ID=] string.

          -

          If the result of running the [=Is persistent session type?=] algorithm on session type is true, the ID MUST be unique within the [=origin=] of this object's [=Document=] over time, including across Documents and browsing sessions.

          -
          4. -
        4. -
          -
          If a license request for the requested license type can be generated based on the sanitized init data:
          -
          -
            -
          1. -

            - Let message be a license request for the requested license type generated based on the sanitized init data - interpreted per initDataType. -

            -

            - The cdm MUST NOT use any stream-specific data, including [=HTMLMediaElement/media data=], not provided via the - sanitized init data. -

            -

            The cdm SHOULD NOT store session data, including the session ID, at this point. See Session Storage and Persistence.

            -
            2. -
          2. -

            - Let message type be {{MediaKeyMessageType/"license-request"}}. -

            -
            3. -
          -
          -
          Otherwise:
          -
          -
            -
          1. -

            - Let message be the request that needs to be processed before a license request request - for the requested license type can be generated based on the sanitized init data. -

            -

            - In a subsequent call to {{MediaKeySession/update()}} the [=CDM=] MUST generate a license request for the requested license type - based on the sanitized init data, which is interpreted per initDataType. -

            -
            2. -
          2. -

            - Let message type reflect the type of message, either {{MediaKeyMessageType/"license-request"}} or {{MediaKeyMessageType/"individualization-request"}}. -

            -
            3. -
          -
          -
          -
          5. -
        -
        10. -
      10. -

        [=Queue a task=] to run the following steps:

        -
          -

        1. If any of the preceding steps failed due to a lack of resources, reject promise with {{QuotaExceededError}}.

          2. -

        2. If any of the preceding steps failed for any other reason, reject promise with a new {{DOMException}} whose name is the appropriate error name.

          3. -

        3. Set the {{MediaKeySession/sessionId}} attribute to session id.

          4. -

        4. Set this object's callable value to true.

          5. -

        5. Run the [=Queue a "message" Event=] algorithm on the session, providing message type and message.

          6. -
        6. -

          Resolve promise.

          -

          Since promise handlers are queued as microtasks, these will be executed ahead of any events queued by the preceding steps.

          -
          7. -
        -
        11. -
      -
      11. -

    11. Return promise.

      12. -
    +

    + A reference to a read-only map of [=key IDs=] [=known=] to the session to the current + status of the associated key. Each entry MUST have a unique key ID. +

    +

    + The map entries and their values may be updated whenever the event loop spins. The + map MUST NOT ever be inconsistent or partially updated, but it may change between + accesses if the event loop spins in between the accesses. Key IDs may be added as the + result of a {{MediaKeySession/load()}} or {{MediaKeySession/update()}} call. Key IDs + may be removed as the result of a {{MediaKeySession/update()}} call that removes + knowledge of existing keys (or replaces the existing set of keys with a new set). Key + IDs MUST NOT be removed because they became unusable, such as due to expiration. + Instead, such keys MUST be given an appropriate status, such as + {{MediaKeyStatus/"expired"}}. +

    +

    + Some older platforms may contain [=Key System=] implementations that do not expose + key IDs, making it impossible to provide a compliant user agent implementation. To + maximize interoperability, user agent implementations exposing such [=CDMs=] SHOULD + implement this member as follows: Whenever a non-empty list is appropriate, such as + when the [=key session=] represented by this object may contain [=key(s)=], populate + the map with a single pair containing the one-byte key ID 0 and the + {{MediaKeyStatus}} most appropriate for the aggregated status of this object. +

    -
    load()
    +
    + onkeystatuseschange of type {{EventHandler}} +
    -

    Loads the data stored for the specified session into this object.

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      -

    1. If this object's closing or closed value is true, return a promise rejected with an {{InvalidStateError}}.

      2. -

    2. If this object's uninitialized value is false, return a promise rejected with an {{InvalidStateError}}.

      3. -

    3. Let this object's uninitialized value be false.

      4. -

    4. If sessionId is the empty string, return a promise rejected with a newly created {{TypeError}}.

      5. -

    5. If the result of running the [=Is persistent session type?=] algorithm on this object's session type is false, return a promise rejected with a newly created {{TypeError}}.

      6. -

    6. Let origin be the [=origin=] of this object's [=Document=].

      7. -

    7. Let promise be a new promise.

      8. -

    8. Run the following steps in parallel:

      -
        -

      1. Let sanitized session ID be a validated and/or sanitized version of sessionId.

        -

        The user agent should thoroughly validate the sessionId value before passing it to the [=CDM=]. - At a minimum, this should include checking that the length and value are reasonable (e.g., not longer than tens of characters and alphanumeric). -

        -
        2. -

      2. If the preceding step failed, or if sanitized session ID is empty, reject promise with a newly created {{TypeError}}.

        3. -

      3. If there is a {{MediaKeySession}} object that is not [=media key session/closed=] in this object's [=Document=] whose {{MediaKeySession/sessionId}} attribute is sanitized session ID, reject promise with a {{QuotaExceededError}}.

        -

        In other words, do not create a session if a non-closed session, regardless of type, already exists for this sanitized session ID in this browsing context.

        -
        4. -

      4. Let expiration time be NaN.

        5. -

      5. Let message be null.

        6. -

      6. Let message type be null.

        7. -

      7. Let cdm be the [=CDM=] instance represented by this object's cdm instance value.

        8. -

      8. Use the cdm to execute the following steps:

        -
          -

        1. If there is no data stored for the sanitized session ID in the origin, resolve promise with false and abort these steps.

          2. -

        2. If the stored session's session type is not the same as the current {{MediaKeySession}} session type, reject promise with a newly created {{TypeError}}.

          3. -

        3. Let session data be the data stored for the sanitized session ID in the origin. - This MUST NOT include data from other origin(s) or that is not associated with an origin.

          4. -

        4. If there is a {{MediaKeySession}} object that is not [=media key session/closed=] in any [=Document=] and that - represents the session data, reject promise with a {{QuotaExceededError}}.

          -

          In other words, do not create a session if a non-closed persistent session already exists for this sanitized session ID in any browsing context.

          -
          5. -

        5. Load the session data.

          6. -

        6. If the session data indicates an [=expiration time=] for the session, let expiration time be that expiration time.

          7. -

        7. If a message needs to be sent, execute the following steps:

          -
            -

          1. Let message be a message generated based on the session data.

            2. -

          2. Let message type be the appropriate {{MediaKeyMessageType}} for the message.

            3. -
          -
          8. -
        -
        9. -
      9. -

        [=Queue a task=] to run the following steps:

        -
          -

        1. If any of the preceding steps failed, reject promise with the appropriate error name.

          2. -

        2. Set the {{MediaKeySession/sessionId}} attribute to sanitized session ID.

          3. -

        3. Set this object's callable value to true.

          4. -
        4. -

          - If the loaded session contains information about any keys (there are [=known keys=]), run the [=Update Key Statuses=] algorithm on the session, providing each key's [=key ID=] along with the appropriate {{MediaKeyStatus}}. -

          -

          Should additional processing be necessary to determine with certainty the status of a key, use {{MediaKeyStatus/"status-pending"}}. - Once the additional processing for one or more keys has completed, run the [=Update Key Statuses=] algorithm again with the actual status(es). -

          -
          5. -

        5. Run the [=Update Expiration=] algorithm on the session, providing expiration time.

          6. -

        6. If message is not null, run the [=Queue a "message" Event=] algorithm on the session, providing message type and message.

          7. - -
        7. -

          Resolve promise with true.

          -

          Since promise handlers are queued as microtasks, these will be executed ahead of any events queued by the preceding steps.

          -
          8. -
        -
        10. -
      -
      9. -

    9. Return promise.

      10. -
    +

    + Event handler for the {{keystatuseschange}} event. +

    -
    update()
    +
    + onmessage of type {{EventHandler}} +
    -

    Provides messages, including licenses, to the [=CDM=].

    -

    The response parameter contains a message to be provided to the [=CDM=]. The contents are [=Key System=]-specific. It MUST NOT contain executable code.

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      -

    1. If this object's closing or closed value is true, return a promise rejected with an {{InvalidStateError}}.

      2. -

    2. If this object's callable value is false, return a promise rejected with an {{InvalidStateError}}.

      3. -

    3. If response is an empty array, return a promise rejected with a newly created {{TypeError}}.

      4. -

    4. Let response copy be a copy of the contents of the response parameter.

      5. -

    5. Let promise be a new promise.

      6. -

    6. Run the following steps in parallel:

      -
        -

      1. Let sanitized response be a validated and/or sanitized version of response copy.

        -

        The user agent should thoroughly validate the response before passing it to the [=CDM=]. - This may include verifying values are within reasonable limits, stripping irrelevant data or fields, pre-parsing it, sanitizing it, and/or generating a fully sanitized version. - The user agent should check that the length and values of fields are reasonable. - Unknown fields should be rejected or removed. -

        -
        2. -

      2. If the preceding step failed, or if sanitized response is empty, reject promise with a newly created {{TypeError}}.

        3. -

      3. Let message be null.

        4. -

      4. Let message type be null.

        5. -

      5. Let session closed be false.

        6. -

      6. Let cdm be the [=CDM=] instance represented by this object's cdm instance value.

        7. -

      7. Use the cdm to execute the following steps:

        -
          -

        1. If the format of sanitized response is invalid in any way, reject promise with a newly created {{TypeError}}.

          2. -

        2. Process sanitized response, following the stipulation for the first matching condition from the following list:

          -
          -
          If sanitized response contains a license or key(s)
          -
          -

          This includes an initial license, an updated license, and a license renewal message.

          -

          Process sanitized response, following the stipulation for the first matching condition from the following list:

          -
          -
          If sessionType is {{MediaKeySessionType/"temporary"}} and sanitized response does not specify that session data, including any license, key(s), or similar session data it contains, should be stored
          -
          Process sanitized response, not storing any session data.
          -
          If sessionType is {{MediaKeySessionType/"persistent-license"}} and sanitized response contains a persistable license
          -
          Process sanitized response, storing the license/key(s) and related session data contained in sanitized response. - Such data MUST be stored such that only the [=origin=] of this object's [=Document=] can access it. -
          -
          Otherwise
          -

          Reject promise with a newly created {{TypeError}}.

          -
          -

          See also Session Storage and Persistence.

          -

          State information, including keys, for each session MUST be stored in such a way that closing one session does not affect the observable state in other session(s), even if they contain overlapping key IDs.

          -

          When sanitized response contains key(s) and/or related data, cdm will likely store (in memory) the key and related data indexed by key ID.

          -

          The replacement algorithm within a session is [=Key System=]-dependent.

          -

          It is RECOMMENDED that [=CDM=] implementations support a standard and reasonably high minimum number of keys per {{MediaKeySession}} object, including a standard replacement algorithm, and a standard and reasonably high minimum number of {{MediaKeySession}} objects. - This enables a reasonable number of key rotation algorithms to be implemented across user agents and may reduce the likelihood of playback interruptions in use cases that involve various streams in the same element (e.g., adaptive streams, various audio and video tracks) using different keys. -

          -
          -
          If sanitized response contains a [=record of license destruction=] acknowledgement and sessionType is {{MediaKeySessionType/"persistent-license"}}
          -
          -

          Run the following steps:

          -
            -
          1. -

            - Close the [=key session=] and clear all stored session data associated with this object, - including the {{MediaKeySession/sessionId}} and [=record of license destruction=]. -

            -

            A subsequent call to {{MediaKeySession/load()}} with the value of this object's {{MediaKeySession/sessionId}} would fail because there is no data stored for that session ID.

            -
            2. -

          2. Set session closed to true.

            3. -
          -
          -
          Otherwise
          -
          Process sanitized response, not storing any session data. -

          For example, sanitized response may contain information that will be used to generate another {{message}} event. - In this case, there is no need to verify the contents against the sessionType. -

          -
          -
          -
          3. -

        3. If a message needs to be sent, execute the following steps:

          -
            -

          1. Let message be that message.

            2. -

          2. Let message type be the appropriate {{MediaKeyMessageType}} for the message.

            3. -
          -
          4. -
        -
        8. -
      8. -

        [=Queue a task=] to run the following steps:

        -
          -
        1. -
          -
          If session closed is true:
          -
          -

          Run the [=Session Closed=] algorithm on this object with reason {{MediaKeySessionClosedReason/"release-acknowledged"}}.

          -
          -
          Otherwise:
          -
          -

          Run the following steps:

          -
            -
          1. -

            - If the set of keys [=known=] to the [=CDM=] for this object changed or the status of any key(s) changed, run the [=Update Key Statuses=] algorithm on the session, providing each known key's [=key ID=] along with the appropriate {{MediaKeyStatus}}. -

            -

            - Should additional processing be necessary to determine with certainty the status of a key, use {{MediaKeyStatus/"status-pending"}}. - Once the additional processing for one or more keys has completed, run the [=Update Key Statuses=] algorithm again with the actual status(es). -

            -
            2. -
          2. -

            If the [=expiration time=] for the session changed, run the [=Update Expiration=] algorithm on the session, providing the new expiration time.

            -
            3. -
          3. -

            If any of the preceding steps failed, reject promise with a new {{DOMException}} whose name is the appropriate error name.

            -
            4. -
          4. -

            If message is not null, run the [=Queue a "message" Event=] algorithm on the session, providing message type and message.

            -
            5. -
          -
          -
          -
          2. -
        2. -

          Resolve promise.

          -

          Since promise handlers are queued as microtasks, these will be executed ahead of any events queued by the preceding steps.

          -
          3. -
        -
        9. -
      -
      7. -

    7. Return promise.

      8. -
    +

    + Event handler for the {{message}} event. +

    -
    close()
    +
    +
    +
    +

    + Methods +

    +
    +
    + generateRequest() +
    -

    Indicates that the application no longer needs the session and the [=CDM=] should release any resources associated with the session and close it. Persisted data should not be released or cleared.

    -

    The returned promise is resolved when the request has been processed, and the {{MediaKeySession/closed}} attribute promise is resolved with {{MediaKeySessionClosedReason/"closed-by-application"}} when the session is closed.

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      -

    1. If this object's closing or closed value is true, return a resolved promise.

      2. -

    2. If this object's callable value is false, return a promise rejected with an {{InvalidStateError}}.

      3. -

    3. Let promise be a new promise.

      4. -

    4. Set this object's closing or closed value to true.

      5. -

    5. Run the following steps in parallel:

      -
        -

      1. Let cdm be the [=CDM=] instance represented by this object's cdm instance value.

        2. -
      2. -

        Use cdm to close the [=key session=] associated with this object.

        -

        Closing the key session results in the destruction of any license(s) and key(s) that have not been explicitly stored.

        -
        3. -
      3. -

        [=Queue a task=] to run the following steps:

        -
          -

        1. Run the [=Session Closed=] algorithm on this object with reason {{MediaKeySessionClosedReason/"closed-by-application"}}.

          2. -
        2. -

          Resolve promise.

          -

          Since promise handlers are queued as microtasks, these will be executed ahead of any events queued by the preceding steps.

          -
          3. -
        -
        4. -
      -
      6. -

    6. Return promise.

      7. -
    -
    -
    remove()
    -
    -

    - Removes all license(s) and key(s) associated with the session. - For persistent session types, other session data will be cleared as defined for each session type once a release message acknowledgment is processed by {{MediaKeySession/update()}}. -

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      -

    1. If this object's closing or closed value is true, return a promise rejected with an {{InvalidStateError}}.

      2. -

    2. If this object's callable value is false, return a promise rejected with an {{InvalidStateError}}.

      3. -

    3. Let promise be a new promise.

      4. -

    4. Run the following steps in parallel:

      -
        -

      1. Let cdm be the [=CDM=] instance represented by this object's cdm instance value.

        2. -

      2. Let message be null.

        3. -

      3. Let message type be null.

        4. -

      4. Use the cdm to execute the following steps:

        -
          -
        1. -

          - If any license(s) and/or key(s) are associated with the session: -

          -
            -
          1. -

            - Destroy the license(s) and/or key(s) associated with the session. -

            -

            - This implies destruction of the license(s) and/or keys(s) whether they are in memory, persistent store or both. -

            -
            2. -

          2. Follow the steps for the value of this object's session type from the following list:

            -
            -
            {{MediaKeySessionType/"temporary"}}
            -
            -

            Continue with the following steps.

            -
            -
            {{MediaKeySessionType/"persistent-license"}}
            -
            -
              -
            1. -

              - Let record of license destruction be a [=record of license destruction=] for the license represented by this object. -

              -
              2. -
            2. -

              - Store the record of license destruction. -

              -
              3. -
            3. -

              - Let message be a message containing or reflecting the record of license destruction. -

              -
              4. -
            -
            -
            -
            3. -
          -
          2. -
        -
        5. -
      5. -

        [=Queue a task=] to run the following steps:

        -
          -
        1. -

          - Run the [=Update Key Statuses=] algorithm on the session, providing all [=key ID=](s) in the session along with the {{MediaKeyStatus/"released"}} {{MediaKeyStatus}} value for each. -

          -
          2. -

        2. Run the [=Update Expiration=] algorithm on the session, providing NaN.

          3. -

        3. If any of the preceding steps failed, reject promise with a new {{DOMException}} whose name is the appropriate error name.

          4. -

        4. Let message type be {{MediaKeyMessageType/"license-release"}}.

          5. -

        5. If message is not null, run the [=Queue a "message" Event=] algorithm on the session, providing message type and message.

          6. -
        6. -

          Resolve promise.

          -

          Since promise handlers are queued as microtasks, these will be executed ahead of any events queued by the preceding steps.

          -
          7. -
        -
        6. -
      -
      5. -

    5. Return promise.

      6. -
    -
    +

    + Generates a license request based on the initData. A {{message}} of type + {{MediaKeyMessageType/"license-request"}} or + {{MediaKeyMessageType/"individualization-request"}} will always be queued if the + algorithm succeeds and the promise is resolved. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. +

      + If this object's closing or closed value is true, return a promise + rejected with an {{InvalidStateError}}. +

      +
      2. +
    2. +

      + If this object's uninitialized value is false, return a promise + rejected with an {{InvalidStateError}}. +

      +
      3. +
    3. +

      + Let this object's uninitialized value be false. +

      +
      4. + +
    4. +

      + If initDataType is the empty string, return a promise rejected with a + newly created {{TypeError}}. +

      +
      5. +
    5. +

      + If initData is an empty array, return a promise rejected with a newly + created {{TypeError}}. +

      +
      6. +
    6. +

      + If the [=Key System=] implementation represented by this object's cdm + implementation value does not support initDataType as an + [=Initialization Data Type=], return a promise rejected with a + {{NotSupportedError}}. String comparison is case-sensitive. +

      +
      7. +
    7. +

      + Let init data be a copy of the contents of the initData + parameter. +

      +
      8. +
    8. +

      + Let session type be this object's session type. +

      +
      9. +
    9. +

      + Let promise be a new promise. +

      +
      10. +
    10. +

      + Run the following steps in parallel: +

      +
        +
      1. +

        + If the init data is not valid for initDataType, reject + promise with a newly created {{TypeError}}. +

        +
        2. +
      2. +

        + Let sanitized init data be a validated and sanitized version of + init data. +

        +

        + The user agent MUST thoroughly validate the [=Initialization Data=] before + passing it to the [=CDM=]. This includes verifying that the length and values + of fields are reasonable, verifying that values are within reasonable limits, + and stripping irrelevant, unsupported, or unknown data or fields. It is + RECOMMENDED that user agents pre-parse, sanitize, and/or generate a fully + sanitized version of the [=Initialization Data=]. If the [=Initialization + Data=] format specified by initDataType supports multiple entries, + the user agent SHOULD remove entries that are not needed by the [=CDM=]. The + user agent MUST NOT re-order entries within the [=Initialization Data=]. +

        +
        3. +
      3. +

        + If the preceding step failed, reject promise with a newly created + {{TypeError}}. +

        +
        4. +
      4. +

        + If sanitized init data is empty, reject promise with a + {{NotSupportedError}}. +

        +
        5. +
      5. +

        + Let session id be the empty string. +

        +
        6. +
      6. +

        + Let message be null. +

        +
        7. +
      7. +

        + Let message type be null. +

        +
        8. +
      8. +

        + Let cdm be the [=CDM=] instance represented by this object's + cdm instance value. +

        +
        9. +
      9. +

        + Use the cdm to execute the following steps: +

        +
          +
        1. +

          + If the sanitized init data is not supported by the + cdm, reject promise with a {{NotSupportedError}}. +

          +
          2. +
        2. +

          + Follow the steps for the value of session type from the + following list: +

          +
          +
          + {{MediaKeySessionType/"temporary"}} +
          +
          +

          + Let requested license type be a temporary non-persistable + license. +

          +

          + The returned license must not be persistable or require persisting + information related to it. +

          +
          +
          + {{MediaKeySessionType/"persistent-license"}} +
          +
          +

          + Let requested license type be a persistable license. +

          +
          +
          +
          3. +
        3. +

          + Let session id be a unique [=Session ID=] string. +

          +

          + If the result of running the [=Is persistent session type?=] algorithm on + session type is true, the ID MUST be unique + within the [=origin=] of this object's [=Document=] over time, including + across Documents and browsing sessions. +

          +
          4. +
        4. +
          +
          + If a license request for the requested license type can be + generated based on the sanitized init data: +
          +
          +
            +
          1. +

            + Let message be a license request for the + requested license type generated based on the + sanitized init data interpreted per + initDataType. +

            +

            + The cdm MUST NOT use any stream-specific data, + including [=HTMLMediaElement/media data=], not provided via the + sanitized init data. +

            +

            + The cdm SHOULD NOT store session data, including the + session ID, at this point. See Session + Storage and Persistence. +

            +
            2. +
          2. +

            + Let message type be + {{MediaKeyMessageType/"license-request"}}. +

            +
            3. +
          +
          +
          + Otherwise: +
          +
          +
            +
          1. +

            + Let message be the request that needs to be processed + before a license request request for the requested license + type can be generated based on the sanitized init + data. +

            +

            + In a subsequent call to {{MediaKeySession/update()}} the [=CDM=] + MUST generate a license request for the requested license + type based on the sanitized init data, which is + interpreted per initDataType. +

            +
            2. +
          2. +

            + Let message type reflect the type of + message, either + {{MediaKeyMessageType/"license-request"}} or + {{MediaKeyMessageType/"individualization-request"}}. +

            +
            3. +
          +
          +
          +
          5. +
        +
        10. +
      10. +

        + [=Queue a task=] to run the following steps: +

        +
          +
        1. +

          + If any of the preceding steps failed due to a lack of resources, reject + promise with {{QuotaExceededError}}. +

          +
          2. +
        2. +

          + If any of the preceding steps failed for any other reason, reject + promise with a new {{DOMException}} whose name is the + appropriate error name. +

          +
          3. +
        3. +

          + Set the {{MediaKeySession/sessionId}} attribute to session id. +

          +
          4. +
        4. +

          + Set this object's callable value to true. +

          +
          5. +
        5. +

          + Run the [=Queue a "message" Event=] algorithm on the session, + providing message type and message. +

          +
          6. +
        6. +

          + Resolve promise. +

          +

          + Since promise handlers are queued as microtasks, these will be executed + ahead of any events queued by the preceding steps. +

          +
          7. +
        +
        11. +
      +
      11. +
    11. +

      + Return promise. +

      +
      12. +
    + +
    + load() +
    +
    +

    + Loads the data stored for the specified session into this object. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. +

      + If this object's closing or closed value is true, return a promise + rejected with an {{InvalidStateError}}. +

      +
      2. +
    2. +

      + If this object's uninitialized value is false, return a promise + rejected with an {{InvalidStateError}}. +

      +
      3. +
    3. +

      + Let this object's uninitialized value be false. +

      +
      4. + +
    4. +

      + If sessionId is the empty string, return a promise rejected with a + newly created {{TypeError}}. +

      +
      5. +
    5. +

      + If the result of running the [=Is persistent session type?=] algorithm on this + object's session type is false, return a promise rejected + with a newly created {{TypeError}}. +

      +
      6. +
    6. +

      + Let origin be the [=origin=] of this object's [=Document=]. +

      +
      7. +
    7. +

      + Let promise be a new promise. +

      +
      8. +
    8. +

      + Run the following steps in parallel: +

      +
        +
      1. +

        + Let sanitized session ID be a validated and/or sanitized version + of sessionId. +

        +

        + The user agent should thoroughly validate the sessionId value before passing + it to the [=CDM=]. At a minimum, this should include checking that the length + and value are reasonable (e.g., not longer than tens of characters and + alphanumeric). +

        +
        2. +
      2. +

        + If the preceding step failed, or if sanitized session ID is empty, + reject promise with a newly created {{TypeError}}. +

        +
        3. +
      3. +

        + If there is a {{MediaKeySession}} object that is not [=media key + session/closed=] in this object's [=Document=] whose + {{MediaKeySession/sessionId}} attribute is sanitized session ID, + reject promise with a {{QuotaExceededError}}. +

        +

        + In other words, do not create a session if a non-closed session, regardless + of type, already exists for this sanitized session ID in this + browsing context. +

        +
        4. +
      4. +

        + Let expiration time be NaN. +

        +
        5. +
      5. +

        + Let message be null. +

        +
        6. +
      6. +

        + Let message type be null. +

        +
        7. +
      7. +

        + Let cdm be the [=CDM=] instance represented by this object's + cdm instance value. +

        +
        8. +
      8. +

        + Use the cdm to execute the following steps: +

        +
          +
        1. +

          + If there is no data stored for the sanitized session ID in the + origin, resolve promise with false and + abort these steps. + +

          +
          2. +
        2. +

          + If the stored session's session type is not the same as the + current {{MediaKeySession}} session type, reject + promise with a newly created {{TypeError}}. +

          +
          3. +
        3. +

          + Let session data be the data stored for the sanitized + session ID in the origin. This MUST NOT include data + from other origin(s) or that is not associated with an origin. +

          +
          4. +
        4. +

          + If there is a {{MediaKeySession}} object that is not [=media key + session/closed=] in any [=Document=] and that represents the session + data, reject promise with a {{QuotaExceededError}}. +

          +

          + In other words, do not create a session if a non-closed persistent + session already exists for this sanitized session ID in any + browsing context. +

          +
          5. +
        5. +

          + Load the session data. +

          +
          6. +
        6. +

          + If the session data indicates an [=expiration time=] for the + session, let expiration time be that expiration time. +

          +
          7. +
        7. +

          + If a message needs to be sent, execute the following steps: +

          +
            +
          1. +

            + Let message be a message generated based on the + session data. +

            +
            2. +
          2. +

            + Let message type be the appropriate + {{MediaKeyMessageType}} for the message. +

            +
            3. +
          +
          8. +
        +
        9. +
      9. +

        + [=Queue a task=] to run the following steps: +

        +
          +
        1. +

          + If any of the preceding steps failed, reject promise with the + appropriate error name. +

          +
          2. +
        2. +

          + Set the {{MediaKeySession/sessionId}} attribute to sanitized session + ID. +

          +
          3. +
        3. +

          + Set this object's callable value to true. +

          +
          4. +
        4. +

          + If the loaded session contains information about any keys (there are + [=known keys=]), run the [=Update Key Statuses=] algorithm on the + session, providing each key's [=key ID=] along with the + appropriate {{MediaKeyStatus}}. +

          +

          + Should additional processing be necessary to determine with certainty the + status of a key, use {{MediaKeyStatus/"status-pending"}}. Once the + additional processing for one or more keys has completed, run the + [=Update Key Statuses=] algorithm again with the actual status(es). +

          +
          5. +
        5. +

          + Run the [=Update Expiration=] algorithm on the session, + providing expiration time. +

          +
          6. +
        6. +

          + If message is not null, run the [=Queue a "message" Event=] + algorithm on the session, providing message type + and message. +

          +
          7. +
        7. +

          + Resolve promise with true. +

          +

          + Since promise handlers are queued as microtasks, these will be executed + ahead of any events queued by the preceding steps. +

          +
          8. +
        +
        10. +
      +
      9. +
    9. +

      + Return promise. +

      +
      10. +
    +
    +
    + update() +
    +
    +

    + Provides messages, including licenses, to the [=CDM=]. +

    +

    + The response parameter contains a message to be provided to the [=CDM=]. + The contents are [=Key System=]-specific. It MUST NOT contain executable code. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. +

      + If this object's closing or closed value is true, return a promise + rejected with an {{InvalidStateError}}. +

      +
      2. +
    2. +

      + If this object's callable value is false, return a promise rejected + with an {{InvalidStateError}}. +

      +
      3. +
    3. +

      + If response is an empty array, return a promise rejected with a newly + created {{TypeError}}. +

      +
      4. +
    4. +

      + Let response copy be a copy of the contents of the response + parameter. +

      +
      5. +
    5. +

      + Let promise be a new promise. +

      +
      6. +
    6. +

      + Run the following steps in parallel: +

      +
        +
      1. +

        + Let sanitized response be a validated and/or sanitized version of + response copy. +

        +

        + The user agent should thoroughly validate the response before passing it to + the [=CDM=]. This may include verifying values are within reasonable limits, + stripping irrelevant data or fields, pre-parsing it, sanitizing it, and/or + generating a fully sanitized version. The user agent should check that the + length and values of fields are reasonable. Unknown fields should be rejected + or removed. +

        +
        2. +
      2. +

        + If the preceding step failed, or if sanitized response is empty, + reject promise with a newly created {{TypeError}}. +

        +
        3. +
      3. +

        + Let message be null. +

        +
        4. +
      4. +

        + Let message type be null. +

        +
        5. +
      5. +

        + Let session closed be false. +

        +
        6. +
      6. +

        + Let cdm be the [=CDM=] instance represented by this object's + cdm instance value. +

        +
        7. +
      7. +

        + Use the cdm to execute the following steps: +

        +
          +
        1. +

          + If the format of sanitized response is invalid in any way, + reject promise with a newly created {{TypeError}}. +

          +
          2. +
        2. +

          + Process sanitized response, following the stipulation for the + first matching condition from the following list: +

          +
          +
          + If sanitized response contains a license or key(s) +
          +
          +

          + This includes an initial license, an updated license, and a license + renewal message. +

          +

          + Process sanitized response, following the stipulation for + the first matching condition from the following list: +

          +
          +
          + If sessionType is {{MediaKeySessionType/"temporary"}} + and sanitized response does not specify that session + data, including any license, key(s), or similar session data it + contains, should be stored +
          +
          + Process sanitized response, not storing any session + data. +
          +
          + If sessionType is + {{MediaKeySessionType/"persistent-license"}} and sanitized + response contains a persistable license +
          +
          + Process sanitized response, storing the license/key(s) + and related session data contained in sanitized + response. Such data MUST be stored such that only the + [=origin=] of this object's [=Document=] can access it. +
          +
          + Otherwise +
          +
          +

          + Reject promise with a newly created {{TypeError}}. +

          +
          +
          +

          + See also Session Storage and + Persistence. +

          +

          + State information, including keys, for each session MUST be stored in + such a way that closing one session does not affect the observable + state in other session(s), even if they contain overlapping key IDs. +

          +

          + When sanitized response contains key(s) and/or related + data, cdm will likely store (in memory) the key and + related data indexed by key ID. +

          +

          + The replacement algorithm within a session is [=Key + System=]-dependent. +

          +

          + It is RECOMMENDED that [=CDM=] implementations support a standard and + reasonably high minimum number of keys per {{MediaKeySession}} + object, including a standard replacement algorithm, and a standard + and reasonably high minimum number of {{MediaKeySession}} objects. + This enables a reasonable number of key rotation algorithms to be + implemented across user agents and may reduce the likelihood of + playback interruptions in use cases that involve various streams in + the same element (e.g., adaptive streams, various audio and video + tracks) using different keys. +

          +
          +
          + If sanitized response contains a [=record of license + destruction=] acknowledgement and sessionType is + {{MediaKeySessionType/"persistent-license"}} +
          +
          +

          + Run the following steps: +

          +
            +
          1. +

            + Close the [=key session=] and clear all stored session + data associated with this object, including the + {{MediaKeySession/sessionId}} and [=record of license + destruction=]. +

            +

            + A subsequent call to {{MediaKeySession/load()}} with the value of + this object's {{MediaKeySession/sessionId}} would fail because + there is no data stored for that session ID. +

            +
            2. +
          2. +

            + Set session closed to true. +

            +
            3. +
          +
          +
          + Otherwise +
          +
          + Process sanitized response, not storing any session data. +

          + For example, sanitized response may contain information + that will be used to generate another {{message}} event. In this + case, there is no need to verify the contents against the + sessionType. +

          +
          +
          +
          3. +
        3. +

          + If a message needs to be sent, execute the following steps: +

          +
            +
          1. +

            + Let message be that message. +

            +
            2. +
          2. +

            + Let message type be the appropriate + {{MediaKeyMessageType}} for the message. +

            +
            3. +
          +
          4. +
        +
        8. +
      8. +

        + [=Queue a task=] to run the following steps: +

        +
          +
        1. +
          +
          + If session closed is true: +
          +
          +

          + Run the [=Session Closed=] algorithm on this object with reason + {{MediaKeySessionClosedReason/"release-acknowledged"}}. +

          +
          +
          + Otherwise: +
          +
          +

          + Run the following steps: +

          +
            +
          1. +

            + If the set of keys [=known=] to the [=CDM=] for this object + changed or the status of any key(s) changed, run the [=Update Key + Statuses=] algorithm on the session, providing each + known key's [=key ID=] along with the appropriate + {{MediaKeyStatus}}. +

            +

            + Should additional processing be necessary to determine with + certainty the status of a key, use + {{MediaKeyStatus/"status-pending"}}. Once the additional + processing for one or more keys has completed, run the [=Update + Key Statuses=] algorithm again with the actual status(es). +

            +
            2. +
          2. +

            + If the [=expiration time=] for the session changed, run the + [=Update Expiration=] algorithm on the session, + providing the new expiration time. +

            +
            3. +
          3. +

            + If any of the preceding steps failed, reject promise + with a new {{DOMException}} whose name is the appropriate + error name. +

            +
            4. +
          4. +

            + If message is not null, run the [=Queue a "message" + Event=] algorithm on the session, providing + message type and message. +

            +
            5. +
          +
          +
          +
          2. +
        2. +

          + Resolve promise. +

          +

          + Since promise handlers are queued as microtasks, these will be executed + ahead of any events queued by the preceding steps. +

          +
          3. +
        +
        9. +
      +
      7. +
    7. +

      + Return promise. +

      +
      8. +
    +
    +
    + close() +
    +
    +

    + Indicates that the application no longer needs the session and the [=CDM=] should + release any resources associated with the session and close it. Persisted data should + not be released or cleared. +

    +

    + The returned promise is resolved when the request has been processed, and the + {{MediaKeySession/closed}} attribute promise is resolved with + {{MediaKeySessionClosedReason/"closed-by-application"}} when the session is closed. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. +

      + If this object's closing or closed value is true, return a resolved + promise. +

      +
      2. +
    2. +

      + If this object's callable value is false, return a promise rejected + with an {{InvalidStateError}}. +

      +
      3. +
    3. +

      + Let promise be a new promise. +

      +
      4. +
    4. +

      + Set this object's closing or closed value to true. +

      +
      5. +
    5. +

      + Run the following steps in parallel: +

      +
        +
      1. +

        + Let cdm be the [=CDM=] instance represented by this object's + cdm instance value. +

        +
        2. +
      2. +

        + Use cdm to close the [=key session=] associated with this object. +

        +

        + Closing the key session results in the destruction of any license(s) and + key(s) that have not been explicitly stored. +

        +
        3. +
      3. +

        + [=Queue a task=] to run the following steps: +

        +
          +
        1. +

          + Run the [=Session Closed=] algorithm on this object with reason + {{MediaKeySessionClosedReason/"closed-by-application"}}. +

          +
          2. +
        2. +

          + Resolve promise. +

          +

          + Since promise handlers are queued as microtasks, these will be executed + ahead of any events queued by the preceding steps. +

          +
          3. +
        +
        4. +
      +
      6. +
    6. +

      + Return promise. +

      +
      7. +
    +
    +
    + remove() +
    +
    +

    + Removes all license(s) and key(s) associated with the session. For persistent session types, other session data will + be cleared as defined for each session type once a release message acknowledgment is + processed by {{MediaKeySession/update()}}. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      +
    1. +

      + If this object's closing or closed value is true, return a promise + rejected with an {{InvalidStateError}}. +

      +
      2. +
    2. +

      + If this object's callable value is false, return a promise rejected + with an {{InvalidStateError}}. +

      +
      3. +
    3. +

      + Let promise be a new promise. +

      +
      4. +
    4. +

      + Run the following steps in parallel: +

      +
        +
      1. +

        + Let cdm be the [=CDM=] instance represented by this object's + cdm instance value. +

        +
        2. +
      2. +

        + Let message be null. +

        +
        3. +
      3. +

        + Let message type be null. +

        +
        4. +
      4. +

        + Use the cdm to execute the following steps: +

        +
          +
        1. +

          + If any license(s) and/or key(s) are associated with the session: +

          +
            +
          1. +

            + Destroy the license(s) and/or key(s) associated with the session. +

            +

            + This implies destruction of the license(s) and/or keys(s) whether + they are in memory, persistent store or both. +

            +
            2. +
          2. +

            + Follow the steps for the value of this object's session + type from the following list: +

            +
            +
            + {{MediaKeySessionType/"temporary"}} +
            +
            +

            + Continue with the following steps. +

            +
            +
            + {{MediaKeySessionType/"persistent-license"}} +
            +
            +
              +
            1. +

              + Let record of license destruction be a [=record of + license destruction=] for the license represented by this + object. +

              +
              2. +
            2. +

              + Store the record of license destruction. +

              +
              3. +
            3. +

              + Let message be a message containing or reflecting + the record of license destruction. +

              +
              4. +
            +
            +
            +
            3. +
          +
          2. +
        +
        5. +
      5. +

        + [=Queue a task=] to run the following steps: +

        +
          +
        1. +

          + Run the [=Update Key Statuses=] algorithm on the session, + providing all [=key ID=](s) in the session along with the + {{MediaKeyStatus/"released"}} {{MediaKeyStatus}} value for each. +

          +
          2. +
        2. +

          + Run the [=Update Expiration=] algorithm on the session, + providing NaN. +

          +
          3. +
        3. +

          + If any of the preceding steps failed, reject promise with a + new {{DOMException}} whose name is the appropriate error name. +

          +
          4. +
        4. +

          + Let message type be {{MediaKeyMessageType/"license-release"}}. +

          +
          5. +
        5. +

          + If message is not null, run the [=Queue a + "message" Event=] algorithm on the session, providing + message type and message. +

          +
          6. +
        6. +

          + Resolve promise. +

          +

          + Since promise handlers are queued as microtasks, these will be executed + ahead of any events queued by the preceding steps. +

          +
          7. +
        +
        6. +
      +
      5. +
    5. +

      + Return promise. +

      +
      6. +
    +
    -
    -

    MediaKeyStatusMap Interface

    -

    The {{MediaKeyStatusMap}} object is a read-only map of [=key IDs=] to the current status of the associated key.

    -

    A key's status is independent of whether the key is currently being used and of media data.

    -

    For example, if a key has output requirements that cannot currently be met, the key's status should be {{MediaKeyStatus/"output-downscaled"}} or {{MediaKeyStatus/"output-restricted"}}, as appropriate, regardless of whether that key has been or is currently needed to decrypt media data.

    +

    + MediaKeyStatusMap Interface +

    +

    + The {{MediaKeyStatusMap}} object is a read-only map of [=key IDs=] to the current status + of the associated key. +

    +

    + A key's status is independent of whether the key is currently being used and of media + data. +

    +

    + For example, if a key has output requirements that cannot currently be met, the key's + status should be {{MediaKeyStatus/"output-downscaled"}} or + {{MediaKeyStatus/"output-restricted"}}, as appropriate, regardless of whether that key + has been or is currently needed to decrypt media data. + 

               [Exposed=Window, SecureContext] interface MediaKeyStatusMap {
             iterable<BufferSource,MediaKeyStatus>;
@@ -2282,40 +4673,61 @@ 
    MediaKeyStatusMap Interface
    
             (MediaKeyStatus or undefined) get (BufferSource keyId);
           };
    -
    -

    Attributes

    -
    -
    size of type {{unsigned long}}, readonly
    -

    The number of [=known keys=].

    -
    -
    - -
    -

    Methods

    -
    -
    has()
    -
    -

    Returns true if the status of the key identified by keyId is known.

    -
    -
    get()
    -
    -

    Returns the {{MediaKeyStatus}} of the key identified by keyId or undefined if the status of the key identified by keyId is not known.

    -
    -
    -

    - This interface has entries, keys, values, forEach and @@iterator methods - brought by [=iterable=] [[WebIDL]]. -

    -

    - The value pairs to iterate over are a snapshot of the set of pairs formed from the [=key ID=] and - associated {{MediaKeyStatus}} value for all [=known keys=], sorted by [=key ID=]. - Key IDs are compared as follows: - For key IDs A of length m and B of length n, assigned such that m <= n, - let A < B if and only if the m octets of A are less in lexicographical - order than the first m octets of B or those octets are equal and m < n. -

    -
    - +
    +

    + Attributes +

    +
    +
    + size of type {{unsigned long}}, readonly +
    +
    +

    + The number of [=known keys=]. +

    +
    +
    +
    +
    +

    + Methods +

    +
    +
    + has() +
    +
    +

    + Returns true if the status of the key identified by keyId + is known. +

    +
    +
    + get() +
    +
    +

    + Returns the {{MediaKeyStatus}} of the key identified by keyId or + undefined if the status of the key identified by keyId is + not known. +

    +
    +
    +

    + This interface has entries, keys, values, + forEach and @@iterator methods brought by [=iterable=] + [[WebIDL]]. +

    +

    + The value pairs to iterate over are a snapshot of the set of pairs formed from the + [=key ID=] and associated {{MediaKeyStatus}} value for all [=known keys=], sorted by + [=key ID=]. Key IDs are compared as follows: For key IDs A of length + m and B of length n, assigned such that m + <= n, let A < B if and only if the m + octets of A are less in lexicographical order than the first m + octets of B or those octets are equal and m < n. +

    + 
               enum MediaKeyStatus {
             "usable",
@@ -2328,53 +4740,109 @@ 
    Methods
    
             "internal-error"
           };
    -

    The MediaKeyStatus enumeration is defined as follows: -

    - - - - - - -
    Enumeration description
    usable - The [=CDM=] is certain the key is currently [=usable for decryption=].
    - Keys that may not currently be [=usable for decryption=] MUST NOT have this status. -
    expired - The key is no longer [=usable for decryption=] because its [=expiration time=] has passed.
    - The time represented by the {{MediaKeySession/expiration}} attribute MUST be earlier than the current time. - All other keys in the session MUST have this status. -
    released - The key itself is no longer available to the [=CDM=], but information about the key, such as a [=record of license destruction=], is available. -
    output-restricted - There are output restrictions associated with the key that cannot currently be met. - Media data decrypted with this key may be blocked from presentation, if necessary according to - the output restrictions. - The application should avoid using streams that will trigger the output restrictions associated - with the key. -
    output-downscaled - There are output restrictions associated with the key that cannot currently be met. - Media data decrypted with this key may be presented at a lower quality (e.g., resolution), - if necessary according to the output restrictions. - The application should avoid using streams that will trigger the output restrictions associated - with the key.
    - Support for downscaling is OPTIONAL. - Applications SHOULD NOT rely on downscaling to ensure uninterrupted playback when output requirements cannot be met. -
    usable-in-future - The key is not yet [=usable for decryption=] because the start time is in the future. - The key will become usable when its start time is reached. -
    status-pending - The status of the key is not yet known and is being determined. - The status will be updated with the actual status when it has been determined. -
    internal-error - The key is not currently [=usable for decryption=] because of an error in the [=CDM=] unrelated to the other values. - This value is not actionable by the application. -
    +

    + The MediaKeyStatus enumeration is defined as follows: +

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    + Enumeration description +
    + usable + + The [=CDM=] is certain the key is currently [=usable for decryption=].
    + Keys that may not currently be [=usable for decryption=] MUST NOT have + this status. +
    + expired + + The key is no longer [=usable for decryption=] because its [=expiration time=] has + passed.
    + The time represented by the {{MediaKeySession/expiration}} attribute MUST be + earlier than the current time. All other keys in the session MUST have this status. +
    + released + + The key itself is no longer available to the [=CDM=], but information about the + key, such as a [=record of license destruction=], is available. +
    + output-restricted + + There are output restrictions associated with the key that cannot currently be met. + Media data decrypted with this key may be blocked from presentation, if necessary + according to the output restrictions. The application should avoid using streams + that will trigger the output restrictions associated with the key. +
    + output-downscaled + + There are output restrictions associated with the key that cannot currently be met. + Media data decrypted with this key may be presented at a lower quality (e.g., + resolution), if necessary according to the output restrictions. The application + should avoid using streams that will trigger the output restrictions associated + with the key.
    + Support for downscaling is OPTIONAL. Applications SHOULD NOT rely on downscaling to + ensure uninterrupted playback when output requirements cannot be met. +
    + usable-in-future + + The key is not yet [=usable for decryption=] because the start time is in the + future. The key will become usable when its start time is reached. +
    + status-pending + + The status of the key is not yet known and is being determined. The status will be + updated with the actual status when it has been determined. +
    + internal-error + + The key is not currently [=usable for decryption=] because of an error in the + [=CDM=] unrelated to the other values. This value is not actionable by the + application. +
    -
    -

    {{MediaKeyMessageEvent}}

    -

    The MediaKeyMessageEvent object is used for the {{message}} event.

    - +

    + {{MediaKeyMessageEvent}} +

    +

    + The MediaKeyMessageEvent object is used for the {{message}} event. + 

               enum MediaKeyMessageType {
             "license-request",
@@ -2383,32 +4851,54 @@ 
    {{MediaKeyMessageEvent}}
    
             "individualization-request"
           };
    -

    The MediaKeyMessageType is defined as follows:

    - - - - - - - - - - - - - - - - - - - - -
    Enumeration description
    license-requestThe message contains a request for a new license.
    license-renewalThe message contains a request to renew an existing license.
    license-releaseThe message contains a [=record of license destruction=].
    individualization-request - The message contains a request for [=App-Assisted Individualization=] (or re-individualization).
    - As with all other messages, any identifiers in the message MUST be distinctive per origin and profile and MUST NOT be [=Distinctive Permanent Identifiers=]. -
    - +

    + The MediaKeyMessageType is defined as follows: +

    + + + + + + + + + + + + + + + + + + + + + + +
    + Enumeration description +
    + license-request + + The message contains a request for a new license. +
    + license-renewal + + The message contains a request to renew an existing license. +
    + license-release + + The message contains a [=record of license destruction=]. +
    + individualization-request + + The message contains a request for [=App-Assisted Individualization=] (or + re-individualization).
    + As with all other messages, any identifiers in the message MUST be distinctive per origin and profile and + MUST NOT be [=Distinctive Permanent Identifiers=]. + 
               [Exposed=Window, SecureContext]
           interface MediaKeyMessageEvent : Event {
@@ -2418,24 +4908,39 @@ 
    {{MediaKeyMessageEvent}}
    
           };
    -

    Attributes

    +

    + Attributes +

    -
    messageType of type {{MediaKeyMessageType}}, readonly
    +
    + messageType of type {{MediaKeyMessageType}}, readonly +
    - The type of the message. -

    Implementations MUST NOT require applications to handle message types. - Implementations MUST support applications that do not differentiate messages and MUST NOT require that applications handle message types. - Specifically, [=Key Systems=] MUST support passing all types of messages to a single URL. -

    -

    This attribute allows an application to differentiate messages without parsing the message. - It is intended to enable optional application and/or server optimizations, but applications are not required to use it. -

    -
    message of type {{ArrayBuffer}}, readonly
    - The message from the [=CDM=]. Messages are [=Key System=]-specific. -
    - + The type of the message. +

    + Implementations MUST NOT require applications to handle message types. + Implementations MUST support applications that do not differentiate messages and + MUST NOT require that applications handle message types. Specifically, [=Key + Systems=] MUST support passing all types of messages to a single URL. +

    +

    + This attribute allows an application to differentiate messages without parsing the + message. It is intended to enable optional application and/or server optimizations, + but applications are not required to use it. +

    + +
    + message of type {{ArrayBuffer}}, readonly +
    +
    + The message from the [=CDM=]. Messages are [=Key System=]-specific. +
    + +
    -

    MediaKeyMessageEventInit

    +

    + MediaKeyMessageEventInit + 

                 dictionary MediaKeyMessageEventInit : EventInit {
               required MediaKeyMessageType messageType;
@@ -2443,259 +4948,469 @@ 
    MediaKeyMessageEventInit
    
             };
    -

    Dictionary MediaKeyMessageEventInit Members

    +

    + Dictionary MediaKeyMessageEventInit Members +

    -
    messageType of type {{MediaKeyMessageType}}
    -
    The type of the message.
    -
    message of type {{ArrayBuffer}}
    -
    The message.
    +
    + messageType of type {{MediaKeyMessageType}} +
    +
    + The type of the message. +
    +
    + message of type {{ArrayBuffer}} +
    +
    + The message. +
    -
    -

    Event Summary

    - +

    + Event Summary +

    - - - + + + - - - + + + - - - + + +
    Event nameInterfaceDispatched when... + Event name + + Interface + + Dispatched when... +
    keystatuseschange{{Event}}There has been a change in the keys in the session or their status. + keystatuseschange + + {{Event}} + + There has been a change in the keys in the session or their status. +
    message{{MediaKeyMessageEvent}}The [=CDM=] has generated a message for the session. + message + + {{MediaKeyMessageEvent}} + + The [=CDM=] has generated a message for the session. +
    -
    -

    Algorithms

    - +

    + Algorithms +

    -

    Queue a "message" Event

    -

    The Queue a "message" Event algorithm queues a message event to a {{MediaKeySession}} object. - Requests to run this algorithm include a target {{MediaKeySession}} object, a message type, and a message. +

    + Queue a "message" Event +

    +

    + The Queue a "message" Event algorithm queues a message event to a {{MediaKeySession}} + object. Requests to run this algorithm include a target {{MediaKeySession}} object, a + message type, and a message.

    - message MUST NOT contain [=Distinctive Permanent Identifier(s)=], even in an encrypted form. - message MUST NOT contain [=Distinctive Identifier(s)=], even in an encrypted form, if the {{MediaKeySession}} object's use distinctive identifier value is false. + message MUST NOT contain [=Distinctive Permanent Identifier(s)=], even in an + encrypted form. message MUST NOT contain [=Distinctive Identifier(s)=], even + in an encrypted form, if the {{MediaKeySession}} object's use distinctive + identifier value is false. +

    +

    + The following steps are run:

    -

    The following steps are run:

      -

    1. Let the session be the specified {{MediaKeySession}} object.

    2. -

      [=Queue a task=] to create an event named {{message}} that does not bubble and is not cancellable using the {{MediaKeyMessageEvent}} interface with its type attribute set to message and its isTrusted attribute initialized to true, and dispatch it at the session.

      -

      The event interface {{MediaKeyMessageEvent}} has:

      -
      • - {{MediaKeyMessageEvent/messageType}} = the specified message type

        - {{MediaKeyMessageEvent/message}} = the specified message -
      +

      + Let the session be the specified {{MediaKeySession}} object. +

      +
      3. +
    3. +

      + [=Queue a task=] to create an event named {{message}} that does not bubble and is + not cancellable using the {{MediaKeyMessageEvent}} interface with its + type attribute set to message and its isTrusted + attribute initialized to true, and dispatch it at the + session. +

      +

      + The event interface {{MediaKeyMessageEvent}} has: +

      +
        +
      • {{MediaKeyMessageEvent/messageType}} = the specified message + type
        +
        + {{MediaKeyMessageEvent/message}} = the specified message +
        • +
      4. -
    +
    -
    -

    Update Key Statuses

    -

    The Update Key Statuses algorithm updates the set of [=known=] keys for a {{MediaKeySession}} or the status of one or more of the keys. - Requests to run this algorithm include a target {{MediaKeySession}} object and a sequence of [=key ID=] and associated {{MediaKeyStatus}} pairs. +

    + Update Key Statuses +

    +

    + The Update Key Statuses algorithm updates the set of [=known=] keys for a + {{MediaKeySession}} or the status of one or more of the keys. Requests to run this + algorithm include a target {{MediaKeySession}} object and a sequence of [=key ID=] and + associated {{MediaKeyStatus}} pairs. +

    +

    + The algorithm is always run in a task. +

    +

    + The following steps are run:

    -

    The algorithm is always run in a task.

    -

    The following steps are run:

      -

    1. Let the session be the associated {{MediaKeySession}} object.

      2. -

    2. Let the input statuses be the sequence of pairs key ID and associated {{MediaKeyStatus}} pairs.

      3. -

    3. Let the statuses be session's {{MediaKeySession/keyStatuses}} attribute.

      4. -

    4. Run the following steps to replace the contents of statuses:

      +
    5. +

      + Let the session be the associated {{MediaKeySession}} object. +

      +
      6. +
    6. +

      + Let the input statuses be the sequence of pairs key ID and associated + {{MediaKeyStatus}} pairs. +

      +
      7. +
    7. +

      + Let the statuses be session's {{MediaKeySession/keyStatuses}} + attribute. +

      +
      8. +
    8. +

      + Run the following steps to replace the contents of statuses: +

        -

      1. Empty statuses.

        2. -

      2. For each pair in input statuses.

        +
      3. +

        + Empty statuses. +

        +
        4. +
      4. +

        + For each pair in input statuses. +

          -

        1. Let pair be the pair.

          2. -

        2. Insert an entry for pair's key ID into statuses with the value of pair's {{MediaKeyStatus}} value.

          3. +
        3. +

          + Let pair be the pair. +

          +
          4. +
        4. +

          + Insert an entry for pair's key ID into statuses with + the value of pair's {{MediaKeyStatus}} value. +

          +
      -

      The effect of this steps is that the contents of session's {{MediaKeySession/keyStatuses}} attribute are replaced without invalidating existing references to the attribute. - This replacement is atomic from a script perspective. That is, script MUST NOT ever see a partially populated sequence. +

      + The effect of this steps is that the contents of session's + {{MediaKeySession/keyStatuses}} attribute are replaced without invalidating + existing references to the attribute. This replacement is atomic from a script + perspective. That is, script MUST NOT ever see a partially populated sequence. +

      +
      9. +
    9. +

      + [=Queue a task=] to [=fire an event=] named {{keystatuseschange}} at the + session.

      10. -

    10. [=Queue a task=] to [=fire an event=] named {{keystatuseschange}} at the session.

      11. -

    11. [=Queue a task=] to run the [=Attempt to Resume Playback If Necessary=] algorithm on each of the media element(s) whose {{HTMLMediaElement/mediaKeys}} attribute is the {{MediaKeys}} object that created the session.

      +
    12. +

      + [=Queue a task=] to run the [=Attempt to Resume Playback If Necessary=] algorithm + on each of the media element(s) whose {{HTMLMediaElement/mediaKeys}} attribute is + the {{MediaKeys}} object that created the session. +

    -
    -

    Update Expiration

    -

    The Update Expiration algorithm updates the [=expiration time=] of a {{MediaKeySession}}. - Requests to run this algorithm include a target {{MediaKeySession}} object and the new expiration time, which may be NaN. +

    + Update Expiration +

    +

    + The Update Expiration algorithm updates the [=expiration time=] of a + {{MediaKeySession}}. Requests to run this algorithm include a target + {{MediaKeySession}} object and the new expiration time, which may be NaN. +

    +

    + The algorithm is always run in a task. +

    +

    + The following steps are run:

    -

    The algorithm is always run in a task.

    -

    The following steps are run:

      -

    1. Let the session be the associated {{MediaKeySession}} object.

      2. -

    2. Let expiration time be NaN.

      3. -

    3. If the new expiration time is not NaN, let expiration time be that expiration time.

      4. -

    4. Set the session's {{MediaKeySession/expiration}} attribute to expiration time expressed as [=time=].

      5. +
    5. +

      + Let the session be the associated {{MediaKeySession}} object. +

      +
      6. +
    6. +

      + Let expiration time be NaN. +

      +
      7. +
    7. +

      + If the new expiration time is not NaN, let expiration time + be that expiration time. +

      +
      8. +
    8. +

      + Set the session's {{MediaKeySession/expiration}} attribute to + expiration time expressed as [=time=]. +

      +
    -
    -

    Session Closed

    +

    + Session Closed +

    - The Session Closed algorithm updates the {{MediaKeySession}} state after a [=key session=] has been closed by the [=CDM=]. - Requests to run this algorithm include a target {{MediaKeySession}} object and a {{MediaKeySessionClosedReason}}. + The Session Closed algorithm updates the {{MediaKeySession}} state after a [=key + session=] has been closed by the [=CDM=]. Requests to run this algorithm include a + target {{MediaKeySession}} object and a {{MediaKeySessionClosedReason}}. +

    +

    + The algorithm is always run in a task.

    -

    The algorithm is always run in a task.

    - When a session is closed, the license(s) and key(s) associated with it are no longer available to - decrypt [=HTMLMediaElement/media data=]. All {{MediaKeySession}} methods will fail and no further events will be queued for this object - after this algorithm is run. + When a session is closed, the license(s) and key(s) associated with it are no longer + available to decrypt [=HTMLMediaElement/media data=]. All {{MediaKeySession}} methods + will fail and no further events will be queued for this object after this algorithm is + run.

    - The [=CDM=] may close a session at any point, such as when the session is no longer needed or when system resources are lost. - In that case, the [=Monitor for CDM State Changes=] algorithm detects the change and runs this algorithm. + The [=CDM=] may close a session at any point, such as when the session is no longer + needed or when system resources are lost. In that case, the [=Monitor for CDM State + Changes=] algorithm detects the change and runs this algorithm. +

    +

    + Keys in other sessions MUST be unaffected, even if they have overlapping key IDs.

    -

    Keys in other sessions MUST be unaffected, even if they have overlapping key IDs.

    - After this algorithm has run, event handlers for the events queued by this algorithm will be executed, but no further events - can be queued. As a result, no messages can be sent by the [=CDM=] as a result of closing the session. + After this algorithm has run, event handlers for the events queued by this algorithm + will be executed, but no further events can be queued. As a result, no messages can + be sent by the [=CDM=] as a result of closing the session.

    -

    The following steps are run:

    +

    + The following steps are run: +

      -

    1. Let session be the associated {{MediaKeySession}} object.

      2. -

    2. Let promise be the session's {{MediaKeySession/closed}} attribute.

      3. +
    3. +

      + Let session be the associated {{MediaKeySession}} object. +

      +
      4. +
    4. +

      + Let promise be the session's {{MediaKeySession/closed}} + attribute. +

      +
      5. -

    5. If promise is resolved, abort these steps.

      6. +
    6. +

      + If promise is resolved, abort these steps. +

      +
      7. -

    7. Set the session's closing or closed value to true.

      8. -

    8. Run the [=Update Key Statuses=] algorithm on the session, providing an empty sequence.

      9. -

    9. Run the [=Update Expiration=] algorithm on the session, providing NaN.

      10. -

    10. Resolve promise with the provided reason.

      11. +
    11. +

      + Set the session's closing or closed value to true. +

      +
      12. +
    12. +

      + Run the [=Update Key Statuses=] algorithm on the session, providing an + empty sequence. +

      +
      13. +
    13. +

      + Run the [=Update Expiration=] algorithm on the session, providing + NaN. +

      +
      14. +
    14. +

      + Resolve promise with the provided reason. +

      +
    -

    Monitor for CDM State Changes

    +

    + Monitor for CDM State Changes +

    - The Monitor for CDM State Changes algorithm executes steps required when various aspects of [=CDM=] state change. + The Monitor for CDM State Changes algorithm executes steps required when various + aspects of [=CDM=] state change. +

    +

    + This algorithm only applies to [=CDM=] state changes that are not covered by other + algorithms. For example, {{MediaKeySession/update()}} may result in messages, key + status changes and/or expiration changes, but those are all handled within that + algorithm. +

    +

    + The algorithm is always run in parallel to the main event loop.

    -

    This algorithm only applies to [=CDM=] state changes that are not covered by other algorithms. For example, {{MediaKeySession/update()}} may result in messages, key status changes and/or expiration changes, but those are all handled within that algorithm.

    -

    The algorithm is always run in parallel to the main event loop.

    The following steps are run:

    -

    1. Let session be the {{MediaKeySession}} object.

      2. -

    2. Let cdm be the [=CDM=] instance represented by session's cdm instance value.

    3. - If cdm has an outgoing message that has not yet been sent, [=queue a task=] to execute the following steps: + Let cdm be the [=CDM=] instance represented by session's + cdm instance value. +

      +
      4. +
    4. +

      + If cdm has an outgoing message that has not yet been sent, [=queue a + task=] to execute the following steps:

      1. - Let message type and message be the message type and message, respectively. + Let message type and message be the message type and + message, respectively.

      2. - Run the [=Queue a "message" Event=] algorithm, passing session, message type and message. + Run the [=Queue a "message" Event=] algorithm, passing session, + message type and message.

    5. - If cdm has changed the set of keys [=known=] to session or the status of one or more of the keys, - [=queue a task=] to execute the following steps: + If cdm has changed the set of keys [=known=] to session or + the status of one or more of the keys, [=queue a task=] to execute the following + steps:

      1. - Let statuses be a list of key ID and {{MediaKeyStatus}} value pairs containing one pair for each key - [=known=] to session. + Let statuses be a list of key ID and {{MediaKeyStatus}} value pairs + containing one pair for each key [=known=] to session.

      2. - Run the [=Update Key Statuses=] algorithm, passing session and statuses. + Run the [=Update Key Statuses=] algorithm, passing session and + statuses.

    6. - If cdm has changed the [=expiration time=] of session, [=queue a task=] to execute the following steps: + If cdm has changed the [=expiration time=] of session, + [=queue a task=] to execute the following steps:

      1. - Let expiration time be the new expiration time of session. + Let expiration time be the new expiration time of + session.

      2. - Run the [=Update Expiration=] algorithm, passing session and expiration time. + Run the [=Update Expiration=] algorithm, passing session and + expiration time.

    7. - If cdm has closed session, [=queue a task=] to run the [=Session Closed=] algorithm on session with an appropriate {{MediaKeySessionClosedReason}} value. + If cdm has closed session, [=queue a task=] to run the + [=Session Closed=] algorithm on session with an appropriate + {{MediaKeySessionClosedReason}} value.

    8. - If cdm has become unavailable, [=queue a task=] to run the [=CDM Unavailable=] algorithm. + If cdm has become unavailable, [=queue a task=] to run the [=CDM + Unavailable=] algorithm.

    -

    Exceptions

    -

    The methods report errors by rejecting the returned promise with a [=simple exception=] [[WEBIDL]] or a {{DOMException}}. - The following [=simple exceptions=] and DOMException names from [[WEBIDL]] are used in the algorithms. - Causes specified specified in the algorithms are listed alongside each name, though these names MAY be used for other reasons as well. +

    + Exceptions +

    +

    + The methods report errors by rejecting the returned promise with a [=simple exception=] + [[WEBIDL]] or a {{DOMException}}. The following [=simple exceptions=] and DOMException names from [[WEBIDL]] are used in + the algorithms. Causes specified specified in the algorithms are listed alongside each + name, though these names MAY be used for other reasons as well.

    - - - + + - + - + - - + - - + @@ -2723,107 +5444,212 @@

    Exceptions

    NamePossible Causes (non-exhaustive) + Name + + Possible Causes (non-exhaustive) +
    TypeError + TypeError + The parameter is empty.
    Invalid initialization data.
    Invalid response format.
    - A persistent license was provided for a {{MediaKeySessionType/"temporary"}} session. + A persistent license was provided for a {{MediaKeySessionType/"temporary"}} + session.
    NotSupportedError + NotSupportedError + The existing {{MediaKeys}} object cannot be removed.
    The [=Key System=] is not supported.
    @@ -2706,16 +5421,22 @@

    Exceptions
    InvalidStateErrorThe existing {{MediaKeys}} object cannot be removed at this time.
    +     		+ InvalidStateError + + The existing {{MediaKeys}} object cannot be removed at this time.
    The session has already been used.
    The session is not yet initialized.
    The session is closed.
    QuotaExceededErrorThe {{MediaKeys}} object cannot be used with additional {{HTMLMediaElement}}s.
    +     		+ QuotaExceededError + + The {{MediaKeys}} object cannot be used with additional {{HTMLMediaElement}}s.
    A non-closed session already exists for this sessionId.
    There are insufficient resources to create a new session or license request.
    -
    -

    Session Storage and Persistence

    -

    This section provides an overview of session storage and persistence that complements the algorithms.

    -

    The following requirements apply in addition to those in [=Storage and Persistence=].

    -

    If the result of running the [=Is persistent session type?=] algorithm on this object's session type is false, the user agent and [=CDM=] MUST NOT persist a record of or data related to the session at any point. - This includes license(s), key(s), [=record(s) of license destruction=], and the [=Session ID=]. +

    + Session Storage and Persistence +

    +

    + This section provides an overview of session storage and persistence that complements the + algorithms. +

    +

    + The following requirements apply in addition to those in [=Storage and Persistence=].

    -

    The remainder of this section applies to session types for which the [=Is persistent session type?=] algorithm returns true.

    -

    The [=CDM=] SHOULD NOT store session data, including the Session ID, until {{MediaKeySession/update()}} is called the first time. - Specifically, the [=CDM=] SHOULD NOT store session data during the {{MediaKeySession/generateRequest()}} algorithm. - This ensures that the application is aware of the session and knows it needs to eventually remove it. +

    + If the result of running the [=Is persistent session type?=] algorithm on this object's + session type is false, the user agent and [=CDM=] MUST NOT + persist a record of or data related to the session at any point. This includes + license(s), key(s), [=record(s) of license destruction=], and the [=Session ID=]. +

    +

    + The remainder of this section applies to session types for which the [=Is persistent + session type?=] algorithm returns true. +

    +

    + The [=CDM=] SHOULD NOT store session data, including the Session ID, until + {{MediaKeySession/update()}} is called the first time. Specifically, the [=CDM=] SHOULD + NOT store session data during the {{MediaKeySession/generateRequest()}} algorithm. This + ensures that the application is aware of the session and knows it needs to eventually + remove it. +

    +

    + All data associated with a session MUST be cleared when the session is cleared, + such as in {{MediaKeySession/update()}} when processing a [=record of license + destruction=] acknowledgement. See Persistent + Data.

    -

    All data associated with a session MUST be cleared when the session is cleared, such as in {{MediaKeySession/update()}} when processing a [=record of license destruction=] acknowledgement. - See Persistent Data. +

    + The [=CDM=] MUST ensure that data for a given session is only present in one + {{MediaKeySession}} object that is not [=media key session/closed=] in any [=Document=]. + In other words, {{MediaKeySession/load()}} MUST fail when there is already a + {{MediaKeySession}} representing the session specified by the sessionId + parameter, either because the object that created it via + {{MediaKeySession/generateRequest()}} is still active or it has been loaded into another + object via {{MediaKeySession/load()}}. A session MAY only be loaded again if all objects + that have ever represented it are [=media key session/closed=].

    -

    The [=CDM=] MUST ensure that data for a given session is only present in one {{MediaKeySession}} object that is not - [=media key session/closed=] in any [=Document=]. - In other words, {{MediaKeySession/load()}} MUST fail when there is already a {{MediaKeySession}} representing the session specified by the sessionId parameter, either because the object that created it via {{MediaKeySession/generateRequest()}} is still active or it has been loaded into another object via {{MediaKeySession/load()}}. - A session MAY only be loaded again if all objects that have ever represented it are [=media key session/closed=]. +

    + An application that creates a session using a type for which the [=Is persistent session + type?=] algorithm returns true SHOULD later remove the stored data by first + initiating the removal process using {{MediaKeySession/remove()}} and then ensuring that + the removal process, which may involve message exchange(s), successfully completes. The + [=CDM=] MAY also remove sessions as appropriate, but applications SHOULD NOT rely on + this.

    -

    An application that creates a session using a type for which the [=Is persistent session type?=] algorithm returns true SHOULD - later remove the stored data by first initiating the removal process using {{MediaKeySession/remove()}} and then ensuring that the removal process, which may involve - message exchange(s), successfully completes. The [=CDM=] MAY also remove sessions as appropriate, but applications SHOULD NOT rely on this. +

    + See and for additional considerations + when supporting persistent storage.

    -

    See and for additional considerations when supporting persistent storage.

    -
    -

    HTMLMediaElement Extensions

    - - - -

    This section specifies additions to and modifications of the {{HTMLMediaElement}} [[HTML]] when the Encrypted Media Extensions are supported.

    -

    The following internal values are added to the {{HTMLMediaElement}}:

    +

    + HTMLMediaElement Extensions +

    +

    + This section specifies additions to and modifications of the {{HTMLMediaElement}} [[HTML]] + when the Encrypted Media Extensions are supported. +

    +

    + The following internal values are added to the {{HTMLMediaElement}}: +

    -

    The following modifications are made to the behaviour of the {{HTMLMediaElement}}:

    +

    + The following modifications are made to the behaviour of the {{HTMLMediaElement}}: +

    - -

    For methods that return a promise, all errors are reported asynchronously by rejecting the returned Promise. This includes [[WEBIDL]] type mapping errors.

    -

    The steps of an algorithm are always aborted when rejecting a promise.

    - +

    + For methods that return a promise, all errors are reported asynchronously by rejecting the + returned Promise. This includes [[WEBIDL]] type mapping errors. +

    +

    + The steps of an algorithm are always aborted when rejecting a promise. + 

             [Exposed=Window] partial interface HTMLMediaElement {
           [SecureContext] readonly        attribute MediaKeys?   mediaKeys;
@@ -2833,85 +5659,231 @@ 
    HTMLMediaElement Extensions
    
         };
    -

    Attributes

    +

    + Attributes +

    -
    mediaKeys of type {{MediaKeys}}, readonly, nullable
    -

    The {{MediaKeys}} being used when decrypting encrypted [=HTMLMediaElement/media data=] for this media element.

    -
    onencrypted of type {{EventHandler}}
    -

    Event handler for the {{encrypted}} event. It MUST be supported by all {{HTMLMediaElement}}s as both a content attribute and an IDL attribute.

    -
    onwaitingforkey of type {{EventHandler}}
    -

    Event handler for the {{waitingforkey}} event. It MUST be supported by all {{HTMLMediaElement}}s as both a content attribute and an IDL attribute.

    +
    + mediaKeys of type {{MediaKeys}}, readonly, nullable +
    +
    +

    + The {{MediaKeys}} being used when decrypting encrypted [=HTMLMediaElement/media + data=] for this media element. +

    +
    +
    + onencrypted of type {{EventHandler}} +
    +
    +

    + Event handler for the {{encrypted}} event. It MUST be supported by all + {{HTMLMediaElement}}s as both a content attribute and an IDL attribute. +

    +
    +
    + onwaitingforkey of type {{EventHandler}} +
    +
    +

    + Event handler for the {{waitingforkey}} event. It MUST be supported by all + {{HTMLMediaElement}}s as both a content attribute and an IDL attribute. +

    +
    -
    -

    Methods

    -
    -
    setMediaKeys()
    -
    -

    Provides the {{MediaKeys}} to use when decrypting media data during playback.

    - -

    Support for clearing or replacing the associated {{MediaKeys}} object during playback is a quality of implementation issue. In many cases it will result in a bad user experience or rejected promise.

    -

    When this method is invoked, the user agent MUST run the following steps:

    -
      - -

    1. If this object's attaching media keys value is true, return a promise rejected with an {{InvalidStateError}}.

      2. -

    2. If mediaKeys and the {{HTMLMediaElement/mediaKeys}} attribute are the same object, return a resolved promise.

      3. -

    3. Let this object's attaching media keys value be true.

      4. -

    4. Let promise be a new promise.

      5. -

    5. Run the following steps in parallel:

      -
        -
      1. -

        If all the following conditions hold:

        -
          -

        • mediaKeys is not null,

          • -
        • -

          the [=CDM=] instance represented by mediaKeys is already in use by another media element

          -
          • -

        • the user agent is unable to use it with this element

          • -
        -

        - then let this object's attaching media keys value be false and reject promise with a {{QuotaExceededError}}. -

        -
        2. -

      2. If the {{HTMLMediaElement/mediaKeys}} attribute is not null, run the following steps:

        -
          -

        1. If the user agent or [=CDM=] do not support removing the association, let this object's attaching media keys value be false and reject promise with a {{NotSupportedError}}.

          2. -

        2. If the association cannot currently be removed, let this object's attaching media keys value be false and reject promise with an {{InvalidStateError}}.

          -

          For example, some implementations may not allow removal during playback.

          -
          3. -

        3. Stop using the [=CDM=] instance represented by the {{HTMLMediaElement/mediaKeys}} attribute to decrypt [=HTMLMediaElement/media data=] and remove the association with the media element.

          4. -

        4. If the preceding step failed, let this object's attaching media keys value be false and reject promise with the appropriate error name.

          5. -
        -
        3. -

      3. If mediaKeys is not null, run the following steps:

        -
          -

        1. Associate the [=CDM=] instance represented by mediaKeys with the media element for decrypting [=HTMLMediaElement/media data=].

          2. -

        2. If the preceding step failed, run the following steps:

          -
            -

          1. Set the {{HTMLMediaElement/mediaKeys}} attribute to null.

            2. -

          2. Let this object's attaching media keys value be false.

            3. -

          3. Reject promise with a new {{DOMException}} whose name is the appropriate error name.

            4. -
          -
          3. -

        3. [=Queue a task=] to run the [=Attempt to Resume Playback If Necessary=] algorithm on the media element.

          -
          4. -
        -
        4. -

      4. Set the {{HTMLMediaElement/mediaKeys}} attribute to mediaKeys.

        5. -

      5. Let this object's attaching media keys value be false.

        6. -

      6. Resolve promise.

        7. -
      -
      6. -

    6. Return promise.

      7. -
    +
    +

    + Methods +

    +
    +
    + setMediaKeys() +
    +
    +

    + Provides the {{MediaKeys}} to use when decrypting media data during playback. +

    +

    + Support for clearing or replacing the associated {{MediaKeys}} object during playback + is a quality of implementation issue. In many cases it will result in a bad user + experience or rejected promise. +

    +

    + When this method is invoked, the user agent MUST run the following steps: +

    +
      + +
    1. +

      + If this object's attaching media keys value is true, return a promise + rejected with an {{InvalidStateError}}. +

      +
      2. +
    2. +

      + If mediaKeys and the {{HTMLMediaElement/mediaKeys}} attribute are the + same object, return a resolved promise. +

      +
      3. +
    3. +

      + Let this object's attaching media keys value be true. +

      +
      4. +
    4. +

      + Let promise be a new promise. +

      +
      5. +
    5. +

      + Run the following steps in parallel: +

      +
        +
      1. +

        + If all the following conditions hold: +

        +
          +
        • +

          + mediaKeys is not null, +

          +
          • +
        • +

          + the [=CDM=] instance represented by mediaKeys is already in + use by another media element +

          +
          • +
        • +

          + the user agent is unable to use it with this element +

          +
          • +
        +

        + then let this object's attaching media keys value be false and + reject promise with a {{QuotaExceededError}}. +

        +
        2. +
      2. +

        + If the {{HTMLMediaElement/mediaKeys}} attribute is not null, run the + following steps: +

        +
          +
        1. +

          + If the user agent or [=CDM=] do not support removing the association, let + this object's attaching media keys value be false and reject + promise with a {{NotSupportedError}}. +

          +
          2. +
        2. +

          + If the association cannot currently be removed, let this object's + attaching media keys value be false and reject + promise with an {{InvalidStateError}}. +

          +

          + For example, some implementations may not allow removal during playback. +

          +
          3. +
        3. +

          + Stop using the [=CDM=] instance represented by the + {{HTMLMediaElement/mediaKeys}} attribute to decrypt + [=HTMLMediaElement/media data=] and remove the association with the media + element. +

          +
          4. +
        4. +

          + If the preceding step failed, let this object's attaching media + keys value be false and reject promise with the + appropriate error name. +

          +
          5. +
        +
        3. +
      3. +

        + If mediaKeys is not null, run the following steps: +

        +
          +
        1. +

          + Associate the [=CDM=] instance represented by mediaKeys with + the media element for decrypting [=HTMLMediaElement/media data=]. +

          +
          2. +
        2. +

          + If the preceding step failed, run the following steps: +

          +
            +
          1. +

            + Set the {{HTMLMediaElement/mediaKeys}} attribute to null. +

            +
            2. + +
          2. +

            + Let this object's attaching media keys value be false. +

            +
            3. +
          3. +

            + Reject promise with a new {{DOMException}} whose name is + the appropriate error name. +

            +
            4. +
          +
          3. +
        3. +

          + [=Queue a task=] to run the [=Attempt to Resume Playback If Necessary=] + algorithm on the media element. +

          +
          4. +
        +
        4. +
      4. +

        + Set the {{HTMLMediaElement/mediaKeys}} attribute to mediaKeys. +

        +
        5. +
      5. +

        + Let this object's attaching media keys value be false. +

        +
        6. +
      6. +

        + Resolve promise. +

        +
        7. +
      +
      6. +
    6. +

      + Return promise. +

      +
      7. +
    -
    -

    MediaEncryptedEvent

    -

    The MediaEncryptedEvent object is used for the {{encrypted}} event.

    - +

    + MediaEncryptedEvent +

    +

    + The MediaEncryptedEvent object is used for the {{encrypted}} event. + 

               [Exposed=Window]
           interface MediaEncryptedEvent : Event {
@@ -2920,19 +5892,30 @@ 
    MediaEncryptedEvent
    
               readonly        attribute ArrayBuffer? initData;
           };
    -
    -

    Attributes

    +

    + Attributes +

    -
    initDataType of type {{DOMString}}, readonly
    -
    Indicates the [=Initialization Data Type=] of the [=Initialization Data=] contained in the {{MediaEncryptedEvent/initData}} attribute.
    -
    initData of type {{ArrayBuffer}}, readonly, nullable
    -
    The [=Initialization Data=] for the event.
    +
    + initDataType of type {{DOMString}}, readonly +
    +
    + Indicates the [=Initialization Data Type=] of the [=Initialization Data=] contained + in the {{MediaEncryptedEvent/initData}} attribute. +
    +
    + initData of type {{ArrayBuffer}}, readonly, nullable +
    +
    + The [=Initialization Data=] for the event. +
    -
    -

    MediaEncryptedEventInit

    +

    + MediaEncryptedEventInit + 

                 dictionary MediaEncryptedEventInit : EventInit {
               DOMString    initDataType = "";
@@ -2940,211 +5923,470 @@ 
    MediaEncryptedEventInit
    
             };
    -

    Dictionary MediaEncryptedEventInit Members

    +

    + Dictionary MediaEncryptedEventInit Members +

    -
    initDataType of type {{DOMString}}, defaulting to ""
    -
    The [=Initialization Data Type=].
    -
    initData of type {{ArrayBuffer}}, nullable, defaulting to null
    -
    The [=Initialization Data=].
    +
    + initDataType of type {{DOMString}}, defaulting to + "" +
    +
    + The [=Initialization Data Type=]. +
    +
    + initData of type {{ArrayBuffer}}, nullable, defaulting to + null +
    +
    + The [=Initialization Data=]. +
    -
    -

    Event Summary

    - +

    + Event Summary +

    - - - - + + + + - - - - + + + - - - + + +
    Event nameInterfaceDispatched when...Preconditions + Event name + + Interface + + Dispatched when... + + Preconditions +
    encrypted{{MediaEncryptedEvent}}The user agent encounters [=Initialization Data=] in the [=HTMLMediaElement/media data=].The element's {{HTMLMediaElement/readyState}} is equal to or greater than {{HTMLMediaElement/HAVE_METADATA}}. -

    It is possible that the element is playing or has played.

    +     		+ encrypted + + {{MediaEncryptedEvent}} + + The user agent encounters [=Initialization Data=] in the [=HTMLMediaElement/media + data=]. + + The element's {{HTMLMediaElement/readyState}} is equal to or greater than + {{HTMLMediaElement/HAVE_METADATA}}. +

    + It is possible that the element is playing or has played. +

    waitingforkey{{Event}}Playback is blocked waiting for a key. - The {{HTMLMediaElement/readyState}} is equal to or less than {{HTMLMediaElement/HAVE_CURRENT_DATA}}. - The element's playback blocked waiting for key value is newly true. + waitingforkey + + {{Event}} + + Playback is blocked waiting for a key. + + The {{HTMLMediaElement/readyState}} is equal to or less than + {{HTMLMediaElement/HAVE_CURRENT_DATA}}. The element's playback blocked waiting + for key value is newly true.
    -
    -

    Algorithms

    - +

    + Algorithms +

    -

    Media Data May Contain Encrypted Blocks

    +

    + Media Data May Contain Encrypted Blocks +

    - The Media Data May Contain Encrypted Blocks algorithm pauses playback if the user agent requires specification of a {{MediaKeys}} object before playing the media data. + The Media Data May Contain Encrypted Blocks algorithm pauses playback if the user agent + requires specification of a {{MediaKeys}} object before playing the media data. Requests to run this algorithm include a target {{HTMLMediaElement}} object.

    -

    The following steps are run:

    +

    + The following steps are run: +

      -

    1. Let the media element be the specified {{HTMLMediaElement}} object.

    2. -

      If the media element's {{HTMLMediaElement/mediaKeys}} attribute is null and the implementation requires specification of a {{MediaKeys}} object before decoding potentially-encrypted [=HTMLMediaElement/media data=], run the following steps:

      -

      These steps may be reached when the application provides [=HTMLMediaElement/media data=] before calling {{HTMLMediaElement/setMediaKeys()}} to provide a {{MediaKeys}} object. - Selecting a [=CDM=] may affect the pipeline and/or decoders used, so some implementations may delay playback of media data that may contain encrypted blocks until a [=CDM=] is specified by passing a {{MediaKeys}} object to {{HTMLMediaElement/setMediaKeys()}}. +

      + Let the media element be the specified {{HTMLMediaElement}} object. +

      +
      3. +
    3. +

      + If the media element's {{HTMLMediaElement/mediaKeys}} attribute is null + and the implementation requires specification of a {{MediaKeys}} object before + decoding potentially-encrypted [=HTMLMediaElement/media data=], run the following + steps: +

      +

      + These steps may be reached when the application provides [=HTMLMediaElement/media + data=] before calling {{HTMLMediaElement/setMediaKeys()}} to provide a + {{MediaKeys}} object. Selecting a [=CDM=] may affect the pipeline and/or decoders + used, so some implementations may delay playback of media data that may contain + encrypted blocks until a [=CDM=] is specified by passing a {{MediaKeys}} object to + {{HTMLMediaElement/setMediaKeys()}}.

        -

      1. Run the [=Wait for Key=] algorithm on the media element.

        2. -

      2. Wait for a signal to resume playback.

        3. +
      3. +

        + Run the [=Wait for Key=] algorithm on the media element. +

        +
        4. +
      4. +

        + Wait for a signal to resume playback. +

        +
    -
    -

    Initialization Data Encountered

    +

    + Initialization Data Encountered +

    - The Initialization Data Encountered algorithm queues an {{encrypted}} event for [=Initialization Data=] encountered in the [=HTMLMediaElement/media data=]. - Requests to run this algorithm include a target {{HTMLMediaElement}} object. + The Initialization Data Encountered algorithm queues an {{encrypted}} event for + [=Initialization Data=] encountered in the [=HTMLMediaElement/media data=]. Requests to + run this algorithm include a target {{HTMLMediaElement}} object. +

    +

    + The following steps are run:

    -

    The following steps are run:

      -

    1. Let the media element be the specified {{HTMLMediaElement}} object.

      2. -

    2. Let initDataType be the empty string.

      3. -

    3. Let initData be null.

    4. -

      If the [=HTMLMediaElement/media data=] is [=CORS-same-origin=] and not [=mixed content limitations|mixed content=], run the following steps:

      +

      + Let the media element be the specified {{HTMLMediaElement}} object. +

      +
      5. +
    5. +

      + Let initDataType be the empty string. +

      +
      6. +
    6. +

      + Let initData be null. +

      +
      7. +
    7. +

      + If the [=HTMLMediaElement/media data=] is [=CORS-same-origin=] and not + [=mixed content limitations|mixed content=], run the following steps: +

        -

      1. Let initDataType be the string representing the [=Initialization Data Type=] of the Initialization Data.

        2. -

      2. Let initData be the Initialization Data.

        3. +
      3. +

        + Let initDataType be the string representing the [=Initialization + Data Type=] of the Initialization Data. +

        +
        4. +
      4. +

        + Let initData be the Initialization Data. +

        +
      -

      While the media element may allow loading of "Upgradeable Content" [[MIXED-CONTENT]], the user agent MUST NOT expose Initialization Data from such media data to the application.

      +

      + While the media element may allow loading of "Upgradeable Content" + [[MIXED-CONTENT]], the user agent MUST NOT expose Initialization Data from such + media data to the application. +

    8. -

      [=Queue a task=] to create an event named {{encrypted}} that does not bubble and is not cancellable using the MediaEncryptedEvent interface with its type attribute set to encrypted and its isTrusted attribute initialized to true, and dispatch it at the media element.

      -

      The event interface MediaEncryptedEvent has:

      -
      • - {{MediaEncryptedEvent/initDataType}} = initDataType

        - {{MediaEncryptedEvent/initData}} = initData -
      -

      {{HTMLMediaElement/readyState}} is not changed and no algorithms are aborted. This event merely provides information.

      -

      The {{MediaEncryptedEvent/initData}} attribute will be null if the media data is not [=CORS-same-origin=] or is [=mixed content limitations|mixed content=]. - Applications may retrieve the Initialization Data from an alternate source. +

      + [=Queue a task=] to create an event named {{encrypted}} that does not bubble and is + not cancellable using the MediaEncryptedEvent interface with its + type attribute set to encrypted and its + isTrusted attribute initialized to true, and dispatch it at + the media element. +

      +

      + The event interface MediaEncryptedEvent has: +

      +
        +
      • {{MediaEncryptedEvent/initDataType}} = initDataType
        +
        + {{MediaEncryptedEvent/initData}} = initData +
        • +
      +

      + {{HTMLMediaElement/readyState}} is not changed and no algorithms are + aborted. This event merely provides information. +

      +

      + The {{MediaEncryptedEvent/initData}} attribute will be null if the media data is + not [=CORS-same-origin=] or is [=mixed content limitations|mixed + content=]. Applications may retrieve the Initialization Data from an alternate + source.

    -
    -

    Encrypted Block Encountered

    +

    + Encrypted Block Encountered +

    - The Encrypted Block Encountered algorithm queues a block of encrypted media data for decryption and attempts to decrypt if possible. - Requests to run this algorithm include a target {{HTMLMediaElement}} object. + The Encrypted Block Encountered algorithm queues a block of encrypted media data for + decryption and attempts to decrypt if possible. Requests to run this algorithm include + a target {{HTMLMediaElement}} object. +

    +

    + The following steps are run:

    -

    The following steps are run:

      -

    1. Let the media element be the specified {{HTMLMediaElement}} object.

    2. -

      Let block be the block of encrypted media data.

      +

      + Let the media element be the specified {{HTMLMediaElement}} object. +

      +
      3. +
    3. +

      + Let block be the block of encrypted media data. +

    4. -

      Add block to the end of the media element's encrypted block queue.

      +

      + Add block to the end of the media element's encrypted + block queue. +

    5. -

      If the media element's decryption blocked waiting for key value is false, run the [=Attempt to Decrypt=] algorithm.

      +

      + If the media element's decryption blocked waiting for key + value is false, run the [=Attempt to Decrypt=] algorithm. +

    -

    Attempt to Decrypt

    +

    + Attempt to Decrypt +

    - The Attempt to Decrypt algorithm attempts to decrypt media data that is queued for decryption. - Requests to run this algorithm include a target {{HTMLMediaElement}} object. + The Attempt to Decrypt algorithm attempts to decrypt media data that is queued for + decryption. Requests to run this algorithm include a target {{HTMLMediaElement}} + object. +

    +

    + The following steps are run:

    -

    The following steps are run:

      -

    1. Let the media element be the specified {{HTMLMediaElement}} object.

      2. -

    2. If the media element's encrypted block queue is empty, abort these steps.

      3. -

    3. If the media element's {{HTMLMediaElement/mediaKeys}} attribute is not null, run the following steps:

      +
    4. +

      + Let the media element be the specified {{HTMLMediaElement}} object. +

      +
      5. +
    5. +

      + If the media element's encrypted block queue is empty, abort + these steps. +

      +
      6. +
    6. +

      + If the media element's {{HTMLMediaElement/mediaKeys}} attribute is not + null, run the following steps: +

        -

      1. Let media keys be the {{MediaKeys}} object referenced by that attribute.

        2. -

      2. Let cdm be the [=CDM=] instance represented by media keys's cdm instance value.

      3. -

        If cdm is no longer usable for any reason, run the following steps:

        -

        These steps are intended to be run on unrecoverable failures of the [=CDM=].

        +

        + Let media keys be the {{MediaKeys}} object referenced by that + attribute. +

        +
        4. +
      4. +

        + Let cdm be the [=CDM=] instance represented by media + keys's cdm instance value. +

        +
        5. +
      5. +

        + If cdm is no longer usable for any reason, run the following steps: +

        +

        + These steps are intended to be run on unrecoverable failures of the [=CDM=]. +

        1. -

          Run the media data is corrupted steps of the [=resource fetch algorithm=].

          +

          + Run the media data is corrupted + steps of the [=resource fetch algorithm=]. +

        2. -

          Run the [=CDM Unavailable=] algorithm on media keys.

          +

          + Run the [=CDM Unavailable=] algorithm on media keys. +

        3. -

          Abort these steps.

          +

          + Abort these steps. +

        6. -

      6. If there is at least one {{MediaKeySession}} created by the media keys that is not [=media key session/closed=], run the following steps:

        -

        This check ensures the cdm has finished loading and is a prerequisite for a matching key being available.

        +
      7. +

        + If there is at least one {{MediaKeySession}} created by the media + keys that is not [=media key session/closed=], run the following steps: +

        +

        + This check ensures the cdm has finished loading and is a + prerequisite for a matching key being available. +

          -

        1. Let block be the first entry in the media element's encrypted block queue.

          2. -

        2. Let the block key ID be the key ID of block.

          -

          The key ID is generally specified by the container.

          +
        3. +

          + Let block be the first entry in the media element's + encrypted block queue. +

          +
          4. +
        4. +

          + Let the block key ID be the key ID of block. +

          +

          + The key ID is generally specified by the container. +

          5. -

        5. Use the cdm to execute the following steps:

          +
        6. +

          + Use the cdm to execute the following steps: +

            -

          1. Let available keys be the union of keys in sessions that were created by the media keys.

            2. -

          2. Let block key be null.

            3. -

          3. If any of the available keys corresponds to the block key ID and is [=usable for decryption=], let session be a - {{MediaKeySession}} object containing that key and let block key be that key.

            -

            If multiple sessions contain a key that is [=usable for decryption=] for the block key ID, which session and key to use is [=Key System=]-dependent.

            +
          4. +

            + Let available keys be the union of keys in sessions that + were created by the media keys. +

            +
            5. +
          5. +

            + Let block key be null. +

            +
            6. +
          6. +

            + If any of the available keys corresponds to the block + key ID and is [=usable for decryption=], let session + be a {{MediaKeySession}} object containing that key and let block + key be that key. +

            +

            + If multiple sessions contain a key that is [=usable for decryption=] + for the block key ID, which session and key to use is [=Key + System=]-dependent. +

            +
            7. +
          7. +

            + If the status of any of the available keys changed as the + result of running the preceding step, [=queue a task=] to run the + [=Update Key Statuses=] algorithm on each affected session, + providing all [=key ID=](s) in the session along with the appropriate + {{MediaKeyStatus}} value(s) for each. +

            8. -

          8. If the status of any of the available keys changed as the result of running the preceding step, [=queue a task=] to run the [=Update Key Statuses=] algorithm on each affected session, providing all [=key ID=](s) in the session along with the appropriate {{MediaKeyStatus}} value(s) for each.

            9. -

          9. If block key is not null, run the following steps:

            +
          10. +

            + If block key is not null, run the following steps: +

              -

            1. Use the cdm to decrypt block using block key.

              2. -

            2. Follow the steps for the first matching condition from the following list:

              +
            3. +

              + Use the cdm to decrypt block using block + key. +

              +
              4. +
            4. +

              + Follow the steps for the first matching condition from the + following list: +

              -
              If decryption fails
              +
              + If decryption fails +
              1. -

                Run the media data is corrupted steps of the [=resource fetch algorithm=].

                +

                + Run the media data + is corrupted steps of the [=resource fetch algorithm=]. +

              2. -

                If cdm is no longer usable for any reason then run the [=CDM Unavailable=] algorithm on media keys.

                +

                + If cdm is no longer usable for any reason then + run the [=CDM Unavailable=] algorithm on media + keys. +

              3. -

                Abort these steps.

                +

                + Abort these steps. +

              -
              Otherwise
              +
              + Otherwise +
                -

              1. Remove block from the front of the media element's encrypted block queue.

                2. -

              2. Process the decrypted block as normal.

                -

                In other words, decode the block.

                +
              3. +

                + Remove block from the front of the media + element's encrypted block queue. +

                +
                4. +
              4. +

                + Process the decrypted block as normal. +

                +

                + In other words, decode the block. +

                +
                5. +
              5. +

                + Return to the beginning of this algorithm. +

                6. -

              6. Return to the beginning of this algorithm.

              -
              -

              Not all decryption problems (e.g., using the wrong key) will result in a decryption failure. In such cases, no error is fired here but one may be fired during decode.

              +

              + Not all decryption problems (e.g., using the wrong key) will result + in a decryption failure. In such cases, no error is fired here but + one may be fired during decode. +

            -

            Otherwise, there is no key for the block key ID in any session so continue.

            +

            + Otherwise, there is no key for the block key ID in any + session so continue. +

          7. @@ -3153,102 +6395,226 @@

          Attempt to Decrypt

      8. -

        Set the media element's decryption blocked waiting for key value to true.

        -

        This step is reached when there is no key that is [=usable for decryption=] for block.

        +

        + Set the media element's decryption blocked waiting for key + value to true. +

        +

        + This step is reached when there is no key that is [=usable for decryption=] for + block. +

        -

        Once the user agent has rendered the blocks preceding the block that cannot be decrypted (as much as it can, such as, all complete video frames), it will run the [=Wait for Key=] algorithm.

        -

        That algorithm is not run directly here in order to allow implementations to decrypt and decode media data ahead of the ahead of the current playback position without affecting the visible behavior.

        +

        + Once the user agent has rendered the blocks preceding the block that cannot be + decrypted (as much as it can, such as, all complete video frames), it will run + the [=Wait for Key=] algorithm. +

        +

        + That algorithm is not run directly here in order to allow implementations to + decrypt and decode media data ahead of the ahead of the current playback position + without affecting the visible behavior. +

      -
      -

      For frame-based encryption, this may be implemented as follows when the media element attempts to decode a frame as part of the [=resource fetch algorithm=]:

      +

      + For frame-based encryption, this may be implemented as follows when the media element + attempts to decode a frame as part of the [=resource fetch algorithm=]: +

        -

      1. Let encrypted be false.

        2. -

      2. Detect whether the frame is encrypted.

        +
      3. +

        + Let encrypted be false. +

        +
        4. +
      4. +

        + Detect whether the frame is encrypted. +

        -
        If the frame is encrypted
        -
        Run the steps above.
        -
        Otherwise
        -
        Continue.
        +
        + If the frame is encrypted +
        +
        + Run the steps above. +
        +
        + Otherwise +
        +
        + Continue. +
        5. -

      5. Decode the frame.

        6. -

      6. Provide the frame for rendering.

        7. +
      7. +

        + Decode the frame. +

        +
        8. +
      8. +

        + Provide the frame for rendering. +

        +
    -
    -

    Wait for Key

    +

    + Wait for Key +

    - The Wait for Key algorithm queues a {{waitingforkey}} event and updates {{HTMLMediaElement/readyState}}. - It should only be called when the {{HTMLMediaElement}} object is [=media element/potentially playing=] and its {{HTMLMediaElement/readyState}} is equal to {{HTMLMediaElement/HAVE_FUTURE_DATA}} or greater. - Requests to run this algorithm include a target {{HTMLMediaElement}} object. + The Wait for Key algorithm queues a {{waitingforkey}} event and updates + {{HTMLMediaElement/readyState}}. It should only be called when the {{HTMLMediaElement}} + object is [=media element/potentially playing=] and its {{HTMLMediaElement/readyState}} + is equal to {{HTMLMediaElement/HAVE_FUTURE_DATA}} or greater. Requests to run this + algorithm include a target {{HTMLMediaElement}} object. +

    +

    + The following steps are run:

    -

    The following steps are run:

      -

    1. Let the media element be the specified {{HTMLMediaElement}} object.

      2. -

    2. If the media element's playback blocked waiting for key value is true, abort these steps.

    3. -

      Set the media element's playback blocked waiting for key value to true.

      -

      As a result of the above step, the media element will become a blocked media element if it wasn't already. In that case, the media element will stop playback.

      +

      + Let the media element be the specified {{HTMLMediaElement}} object. +

      +
      4. +
    4. +

      + If the media element's playback blocked waiting for key value + is true, abort these steps. +

      +
      5. +
    5. +

      + Set the media element's playback blocked waiting for key + value to true. +

      +

      + As a result of the above step, the media element will become a blocked media element if it wasn't already. In + that case, the media element will stop playback. +

    6. -

      Follow the steps for the first matching condition from the following list:

      +

      + Follow the steps for the first matching condition from the following list: +

      -
      If data for the immediate current playback position is available
      +
      + If data for the immediate current + playback position is available +
      -

      Set the {{HTMLMediaElement/readyState}} of media element to {{HTMLMediaElement/HAVE_CURRENT_DATA}}.

      +

      + Set the {{HTMLMediaElement/readyState}} of media element to + {{HTMLMediaElement/HAVE_CURRENT_DATA}}. +

      -
      Otherwise
      +
      + Otherwise +
      -

      Set the {{HTMLMediaElement/readyState}} of media element to {{HTMLMediaElement/HAVE_METADATA}}.

      +

      + Set the {{HTMLMediaElement/readyState}} of media element to + {{HTMLMediaElement/HAVE_METADATA}}. +

      - In other words, if the video frame and audio data for the current playback position have been decoded because they were unencrypted and/or successfully decrypted, set {{HTMLMediaElement/readyState}} to {{HTMLMediaElement/HAVE_CURRENT_DATA}}. - Otherwise, including if this was previously the case but the data is no longer available, set {{HTMLMediaElement/readyState}} to {{HTMLMediaElement/HAVE_METADATA}}. + In other words, if the video frame and audio data for the current playback position have been decoded + because they were unencrypted and/or successfully decrypted, set + {{HTMLMediaElement/readyState}} to {{HTMLMediaElement/HAVE_CURRENT_DATA}}. + Otherwise, including if this was previously the case but the data is no longer + available, set {{HTMLMediaElement/readyState}} to + {{HTMLMediaElement/HAVE_METADATA}}. +

      +
      7. +
    7. +

      + [=Queue a task=] to [=fire an event=] named {{waitingforkey}} at the media + element. +

      +
      8. +
    8. +

      + Suspend playback.

      9. -

    9. [=Queue a task=] to [=fire an event=] named {{waitingforkey}} at the media element.

      10. -

    10. Suspend playback.

    -
    -

    Attempt to Resume Playback If Necessary

    +

    + Attempt to Resume Playback If Necessary +

    - The Attempt to Resume Playback If Necessary algorithm resumes playback if the media element is blocked waiting for a key and necessary key is currently [=usable for decryption=] - Requests to run this algorithm include a target {{HTMLMediaElement}} object. + The Attempt to Resume Playback If Necessary algorithm resumes playback if the media + element is blocked waiting for a key and necessary key is currently [=usable for + decryption=] Requests to run this algorithm include a target {{HTMLMediaElement}} + object. +

    +

    + The following steps are run:

    -

    The following steps are run:

      -

    1. Let the media element be the specified {{HTMLMediaElement}} object.

      2. -

    2. If the media element's playback blocked waiting for key is false, abort these steps.

      3. -

    3. Run the [=Attempt to Decrypt=] algorithm on the media element.

      4. -

    4. If the user agent can advance the current playback position in the direction of playback:

      +
    5. +

      + Let the media element be the specified {{HTMLMediaElement}} object. +

      +
      6. +
    6. +

      + If the media element's playback blocked waiting for key is + false, abort these steps. +

      +
      7. +
    7. +

      + Run the [=Attempt to Decrypt=] algorithm on the media element. +

      +
      8. +
    8. +

      + If the user agent can advance the current playback position in the direction of playback: +

      1. -

        Set the media element's decryption blocked waiting for key value to false.

        +

        + Set the media element's decryption blocked waiting for + key value to false. +

      2. -

        Set the media element's playback blocked waiting for key value to false.

        -

        As a result of the above step, the media element may no longer be a blocked media element and thus playback may resume.

        +

        + Set the media element's playback blocked waiting for key + value to false. +

        +

        + As a result of the above step, the media element may no longer be a + blocked media element and thus + playback may resume. +

      3. - Set the media element's {{HTMLMediaElement/readyState}} value to {{HTMLMediaElement/HAVE_CURRENT_DATA}}, {{HTMLMediaElement/HAVE_FUTURE_DATA}} or - {{HTMLMediaElement/HAVE_ENOUGH_DATA}} as appropriate. + Set the media element's {{HTMLMediaElement/readyState}} value to + {{HTMLMediaElement/HAVE_CURRENT_DATA}}, {{HTMLMediaElement/HAVE_FUTURE_DATA}} + or {{HTMLMediaElement/HAVE_ENOUGH_DATA}} as appropriate.

        - States beyond {{HTMLMediaElement/HAVE_CURRENT_DATA}} and the [=HTMLMediaElement/canplaythrough=] event do not - (or are unlikely to) consider key availability beyond the current key. + States beyond {{HTMLMediaElement/HAVE_CURRENT_DATA}} and the + [=HTMLMediaElement/canplaythrough=] event do not (or are unlikely to) + consider key availability beyond the current key.

        - The change in ready state may also cause {{HTMLMediaElement}} events to be fired as described here. + The change in ready state may also cause {{HTMLMediaElement}} events to be + fired as described here.

        4. @@ -3257,87 +6623,129 @@

        Attempt to Resume Playback If Necessary

    -
    -

    Media Element Restrictions

    -

    Media data processed by a [=CDM=] MAY be unavailable through web platform APIs in the usual way (for example using the {{CanvasRenderingContext2D}} {{CanvasDrawImage/drawImage()}} method and the {{AudioContext}} {{MediaElementAudioSourceNode}}). - This specification does not define conditions for such non-availability of media data, however, if media data is not available to through such APIs then they MAY behave as if no media data was present at all.

    -

    Where media rendering is not performed by the UA, for example in the case of a hardware-based media pipeline, the full set of HTML rendering capabilities, for example CSS Transforms, MAY be unavailable. One likely restriction is that - video media MAY be constrained to appear only in rectangular regions with sides parallel to the edges of the window and with normal orientation.

    +

    + Media Element Restrictions +

    +

    + Media data processed by a [=CDM=] MAY be unavailable through web platform APIs in the + usual way (for example using the {{CanvasRenderingContext2D}} + {{CanvasDrawImage/drawImage()}} method and the {{AudioContext}} + {{MediaElementAudioSourceNode}}). This specification does not define conditions for such + non-availability of media data, however, if media data is not available to through such + APIs then they MAY behave as if no media data was present at all. +

    +

    + Where media rendering is not performed by the UA, for example in the case of a + hardware-based media pipeline, the full set of HTML rendering capabilities, for example + CSS Transforms, MAY be unavailable. One likely restriction is that video media MAY be + constrained to appear only in rectangular regions with sides parallel to the edges of the + window and with normal orientation. +

    - -
    -

    Implementation Requirements

    +

    + Implementation Requirements +

    - This section defines implementation requirements - for both user agents and [=Key Systems=], including the [=CDM=] and server(s) - that may not be explicitly addressed in the algorithms. - The requirements here and throughout the spec apply to all implementations, regardless of whether the [=CDM=] is separate from or a part of the user agent. + This section defines implementation requirements - for both user agents and [=Key + Systems=], including the [=CDM=] and server(s) - that may not be explicitly addressed in + the algorithms. The requirements here and throughout the spec apply to all implementations, + regardless of whether the [=CDM=] is separate from or a part of the user agent.

    -
    -

    CDM Constraints

    +

    + CDM Constraints +

    - User agent implementers MUST ensure that [=CDMs=] do not access any information, storage or system capabilities that are not reasonably required for playback of protected media using the features of this specification. - Specifically, the [=CDM=] SHALL NOT: + User agent implementers MUST ensure that [=CDMs=] do not access any information, storage + or system capabilities that are not reasonably required for playback of protected media + using the features of this specification. Specifically, the [=CDM=] SHALL NOT:

    • - Access network resources, either local or remote, except via the user agent as explicitly permitted by this specification. + Access network resources, either local or remote, except via the user agent as + explicitly permitted by this specification.

    • - Access storage (e.g., disk or memory), except where reasonably required for playback of protected media using the features of this specification. + Access storage (e.g., disk or memory), except where reasonably required for playback + of protected media using the features of this specification.

    • - Access user data other than [=CDM=] state and persistent data. + Access user data other than [=CDM=] state and persistent data.

    • - Access hardware components or devices, except where reasonably required for playback of protected media using the features of this specification. + Access hardware components or devices, except where reasonably required for playback + of protected media using the features of this specification.

    - User Agent implementers may use various techniques to meet the above requirements. For example, a User Agent implementer also implementing their own [=CDM=] may include the above as design requirements for that component. - A User Agent implementer making use of a third party [=CDM=] may ensure that it executes in a constrained environment (e.g., "sandbox") without access to the prohibited information and components. + User Agent implementers may use various techniques to meet the above requirements. For + example, a User Agent implementer also implementing their own [=CDM=] may include the + above as design requirements for that component. A User Agent implementer making use of a + third party [=CDM=] may ensure that it executes in a constrained environment (e.g., + "sandbox") without access to the prohibited information and components.

    -
    -

    Messages and Communication

    +

    + Messages and Communication +

    - All messages and communication to and from the [=CDM=], such as between the [=CDM=] and a license server, MUST be passed through the user agent. - The [=CDM=] MUST NOT make direct out-of band network requests. - All messages and communication other than those described in Direct Individualization MUST be passed through the application via the APIs defined in this specification. - Specifically, all communication that contains application-, [=origin=]-, or content-specific information or is sent to a URL specified by the application or based on its origin, MUST pass through the APIs. - This includes all license exchange messages. + All messages and communication to and from the [=CDM=], such as between the [=CDM=] and a + license server, MUST be passed through the user agent. The [=CDM=] MUST NOT make direct + out-of band network requests. All messages and communication other than those described + in Direct Individualization MUST be passed + through the application via the APIs defined in this specification. Specifically, all + communication that contains application-, [=origin=]-, or content-specific information or + is sent to a URL specified by the application or based on its origin, MUST pass through + the APIs. This includes all license exchange messages.

    -
    -

    Persistent Data

    +

    + Persistent Data +

    - Persistent Data includes all data stored by the [=CDM=], or by the User Agent on behalf of the [=CDM=], that exists after the destruction of the {{MediaKeys}} object. Specifically, it includes any identifiers (including [=Distinctive Identifier(s)=]), licenses, keys, key IDs, or [=records of license destruction=] stored by the [=CDM=] or by the User Agent on behalf of the [=CDM=]. + Persistent Data includes all data stored by the [=CDM=], or by the User Agent on behalf + of the [=CDM=], that exists after the destruction of the {{MediaKeys}} object. + Specifically, it includes any identifiers (including [=Distinctive Identifier(s)=]), + licenses, keys, key IDs, or [=records of license destruction=] stored by the [=CDM=] or + by the User Agent on behalf of the [=CDM=].

    -

    Use origin-specific and browsing profile-specific [=Key System=] storage

    -

    Persistent Data that might impact messages or behavior in an application- or license server-visible way MUST be stored in an [=origin=]-specific and [=browsing profile=]-specific way and MUST NOT leak to or from private browsing sessions. - Specifically but not exhaustively, session data, licenses, keys and per-origin identifiers MUST be stored per-[=origin=] and per-[=browsing profile=]. +

    + Use origin-specific and browsing profile-specific [=Key System=] storage +

    +

    + Persistent Data that might impact messages or behavior in an application- or license + server-visible way MUST be stored in an [=origin=]-specific and [=browsing + profile=]-specific way and MUST NOT leak to or from private browsing sessions. + Specifically but not exhaustively, session data, licenses, keys and per-origin + identifiers MUST be stored per-[=origin=] and per-[=browsing profile=].

    - See Session Storage and Persistence. + See Session Storage and Persistence.

    -

    Allow Persistent Data to Be Cleared

    +

    + Allow Persistent Data to Be Cleared +

    - Implementations that use Persistent Data MUST allow the user to clear that data such that it is no longer retrievable both outside, such as via the APIs defined in this specification, and on the client device. + Implementations that use Persistent Data MUST allow the user to clear that data such + that it is no longer retrievable both outside, such as via the APIs defined in this + specification, and on the client device.

    User Agents SHOULD: @@ -3345,17 +6753,20 @@

    Allow Persistent Data to Be Cleared

    • - Treat Persistent Data like other site data, such as cookies [[COOKIES]]. Specifically: + Treat Persistent Data like other site data, such as cookies [[COOKIES]]. + Specifically:

      • - Allow users to clear Persistent Data along with cookies [[COOKIES]] and other site data. + Allow users to clear Persistent Data along with cookies [[COOKIES]] and other + site data.

      • - Allow users to clear Persistent Data as part of user agent features to clear browsing history. + Allow users to clear Persistent Data as part of user agent features to clear + browsing history.

      • @@ -3372,449 +6783,856 @@

        Allow Persistent Data to Be Cleared

      • - Allow users to clear Persistent Data on a per-[=origin=] and per-[=browsing profile=] basis, particularly as part of a "Forget about this site" feature that forgets cookies [[COOKIES]], databases, etc. associated with a particular site. + Allow users to clear Persistent Data on a per-[=origin=] and per-[=browsing + profile=] basis, particularly as part of a "Forget about this site" feature that + forgets cookies [[COOKIES]], databases, etc. associated with a particular site.

      • - Ensure that operations which clear Persistent Data are sufficiently atomic to prevent a "cookie resurrection" type of recorrelation of a new identifier with the old by relying on another type of locally stored data that did not get cleared at the same time. See incomplete clearing of data. + Ensure that operations which clear Persistent Data are sufficiently atomic to + prevent a "cookie resurrection" type of recorrelation of a new identifier with the + old by relying on another type of locally stored data that did not get cleared at + the same time. See incomplete clearing of data.

      • - Present these interfaces in a way that helps users to understand the possibility of incomplete clearing of data and enables them to delete data associated with all features that persist data, including cookies [[COOKIES]] and web storage, simultaneously. + Present these interfaces in a way that helps users to understand the possibility of + incomplete clearing of data and enables them to + delete data associated with all features that persist data, including cookies + [[COOKIES]] and web storage, simultaneously.

      • - Present the interfaces for disabling and re-enabling a [=Key System=] in a way that helps users to understand the possibility of incomplete clearing of data and enables them to delete all such data in all persistent storage features simultaneously. + Present the interfaces for disabling and re-enabling a [=Key System=] in a way that + helps users to understand the possibility of incomplete clearing of data and enables them to delete + all such data in all persistent storage features simultaneously.

      • - Allow users to specifically delete Persistent Data, by [=origin=] and/or for all origins. + Allow users to specifically delete Persistent Data, by [=origin=] and/or for all + origins.

    -

    Encrypt or obfuscate Persistent Data

    -

    User agents SHOULD treat Persistent Data as potentially sensitive; it is quite possible for user privacy to be compromised by the release of this information. - To this end, user agents SHOULD ensure that Persistent Data is securely stored and when deleting data, it is promptly deleted from the underlying storage. +

    + Encrypt or obfuscate Persistent Data +

    +

    + User agents SHOULD treat Persistent Data as potentially sensitive; it is quite possible + for user privacy to be compromised by the release of this information. To this end, + user agents SHOULD ensure that Persistent Data is securely stored and when deleting + data, it is promptly deleted from the underlying storage.

    -
    -

    Values Exposed to the Application

    -

    Values exposed to or inferable by, such as via its use by the [=CDM=], the application could be used to identify the client or user, regardless of whether they are designed to be identifiers. - This section defines requirements for avoiding or at least mitigating such concerns. - There are additional requirements for Identifiers. +

    + Values Exposed to the Application +

    +

    + Values exposed to or inferable by, such as via its use by the [=CDM=], the application + could be used to identify the client or user, regardless of whether they are designed to + be identifiers. This section defines requirements for avoiding or at least mitigating + such concerns. There are additional requirements for Identifiers.

    -
    -

    Use Per-Origin Per-Profile Values

    - +

    + Use Per-Origin Per-Profile Values +

    - All [=Distinctive Values=] exposed to or inferable by the application MUST be unique per [=origin=] and [=browsing profile=]. - That is, the value(s) used for one [=origin=] using the APIs defined in this specification MUST be different from those used for any other origin using the APIs, - and value(s) used in one [=browsing profile=] MUST be different from those used for any other profile, regardless of origin. - Such values MUST NOT leak to or from private browsing sessions. + All [=Distinctive Values=] exposed to or inferable by the application MUST be unique + per [=origin=] and [=browsing profile=]. That is, the value(s) used for one [=origin=] + using the APIs defined in this specification MUST be different from those used for any + other origin using the APIs, and value(s) used in one [=browsing profile=] MUST be + different from those used for any other profile, regardless of origin. Such values MUST + NOT leak to or from private browsing sessions.

    - Values across origins and profiles MUST be [=non-associable by applications=], meaning it MUST NOT be possible to correlate values from multiple origins or profiles, such as to determine that they came from the same client or user. - Specifically, implementations that derive per-origin values from an origin-independent and/or profile-independent value, MUST do so in a way that ensures the above non-associability - property, such as by using derivation functions with appropriate non-reversible properties. + Values across origins and profiles MUST be [=non-associable by applications=], meaning + it MUST NOT be possible to correlate values from multiple origins or profiles, such as + to determine that they came from the same client or user. Specifically, implementations + that derive per-origin values from an origin-independent and/or profile-independent + value, MUST do so in a way that ensures the above non-associability property, such as + by using derivation functions with appropriate non-reversible properties.

    -
    -

    Allow Values to Be Cleared

    +

    + Allow Values to Be Cleared +

    - As a consequence of the requirements in Allow Persistent Data to Be Cleared, - all persisted values exposed to the application MUST be clearable - such that the values are no longer retrievable, observable, or inferable both outside, such as via the APIs defined in this specification, and on the client device. + As a consequence of the requirements in Allow + Persistent Data to Be Cleared, all persisted values exposed to the application MUST + be clearable such that the values are no longer retrievable, observable, or inferable + both outside, such as via the APIs defined in this specification, and on the client + device.

    - Once cleared, new [=non-associable by applications=] value(s) MUST be generated when values are subsequently needed. + Once cleared, new [=non-associable by applications=] value(s) MUST be generated when + values are subsequently needed.

    -
    -

    Identifiers

    -

    The use of identifiers, especially [=uses Distinctive Identifier(s) or Distinctive Permanent Identifier(s)|Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=], by implementations presents a privacy concern. - This section defines requirements for avoiding or at least mitigating such concerns. - The requirements for Values Exposed to the Application also apply to identifiers exposed to the application. +

    + Identifiers +

    +

    + The use of identifiers, especially [=uses Distinctive Identifier(s) or Distinctive + Permanent Identifier(s)|Distinctive Identifier(s) or Distinctive Permanent + Identifier(s)=], by implementations presents a privacy concern. This section defines + requirements for avoiding or at least mitigating such concerns. The requirements for + Values Exposed to the Application also apply to + identifiers exposed to the application.

    -

    In summary:

    +

    + In summary: +

    -
    -

    Limit or Avoid use of Distinctive Identifiers and Permanent Identifiers

    +

    + Limit or Avoid use of Distinctive Identifiers and Permanent Identifiers +

    • -

      Implementations SHOULD avoid [=use of Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=].

      -

      For example, use identifiers or other values that apply to a group of clients or devices rather than individual clients.

      +

      + Implementations SHOULD avoid [=use of Distinctive Identifier(s) or Distinctive + Permanent Identifier(s)=]. +

      +

      + For example, use identifiers or other values that apply to a group of clients or + devices rather than individual clients. +

    • -

      Implementations SHOULD only [=use Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=] when necessary to enforce the policies related to the specific [=CDM=] instance and session.

      -

      For example, {{MediaKeySessionType/"temporary"}} and {{MediaKeySessionType/"persistent-license"}} sessions may have different requirements.

      +

      + Implementations SHOULD only [=use Distinctive Identifier(s) or Distinctive + Permanent Identifier(s)=] when necessary to enforce the policies related to the + specific [=CDM=] instance and session. +

      +

      + For example, {{MediaKeySessionType/"temporary"}} and + {{MediaKeySessionType/"persistent-license"}} sessions may have different + requirements. +

    • - Implementations that [=use Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=] SHOULD support the option to not use them. - Implementations with such support SHOULD expose the ability for the user to select this option. + Implementations that [=use Distinctive Identifier(s) or Distinctive Permanent + Identifier(s)=] SHOULD support the option to not use them. Implementations with + such support SHOULD expose the ability for the user to select this option.

      - When supported, applications can select for this mode using {{MediaKeySystemConfiguration/distinctiveIdentifier}} = {{MediaKeysRequirement/"not-allowed"}}. - Selecting such an option may affect the results of the {{Navigator/requestMediaKeySystemAccess()}} call and/or the license requests that are generated from subsequently generated sessions. + When supported, applications can select for this mode using + {{MediaKeySystemConfiguration/distinctiveIdentifier}} = + {{MediaKeysRequirement/"not-allowed"}}. Selecting such an option may affect the + results of the {{Navigator/requestMediaKeySystemAccess()}} call and/or the + license requests that are generated from subsequently generated sessions.

      - Providing the user access to select or choose this implementation capability may allow the user to access content while maintaining a higher degree of privacy. + Providing the user access to select or choose this implementation capability may + allow the user to access content while maintaining a higher degree of privacy.

    -
    -

    Encrypt Identifiers

    +

    + Encrypt Identifiers +

    - [=Distinctive Identifiers=] and [=Distinctive Permanent Identifiers=] MUST be encrypted at the message exchange level when exposed outside the client. - All other identifiers SHOULD be encrypted at the message exchange level when exposed outside the client. - The encryption MUST ensure that any two instances of the identifier ciphertext are [=associable by an entity|associable=] only by an entity in possession of the decryption key. + [=Distinctive Identifiers=] and [=Distinctive Permanent Identifiers=] MUST be encrypted + at the message exchange level when exposed outside the client. All other identifiers + SHOULD be encrypted at the message exchange level when exposed outside the client. The + encryption MUST ensure that any two instances of the identifier ciphertext are + [=associable by an entity|associable=] only by an entity in possession of the + decryption key.

    -

    Identifiers may be exposed in the following ways:

    +

    + Identifiers may be exposed in the following ways: +

      -

    • To the application via a {{message}} event.

      • -

    • In a message from a server, such as one that is passed to {{MediaKeySession/update()}}.

      • -

    • As part of [=individualization=].

      • +
    • +

      + To the application via a {{message}} event. +

      +
      • +
    • +

      + In a message from a server, such as one that is passed to + {{MediaKeySession/update()}}. +

      +
      • +
    • +

      + As part of [=individualization=]. +

      +

    - The [=CDM=] MUST verify that the encryption key belongs to a valid server for its [=Key System=]. - For identifers exposed to the application, this MAY be implemented using a server certificate. + The [=CDM=] MUST verify that the encryption key belongs to a valid server for its [=Key + System=]. For identifers exposed to the application, this MAY be implemented using a + server certificate. +

    +

    + The server MUST NOT expose a [=Distinctive Identifier=] to any entity other than the + [=CDM=] that sent it.

    -

    The server MUST NOT expose a [=Distinctive Identifier=] to any entity other than the [=CDM=] that sent it.

    -

    Specifically, it should not be provided to the application or included unencrypted in messages to the [=CDM=]. - This can be accomplished by encrypting the identifier or message with the identifier or such that it is only decryptable by that specific [=CDM=]. +

    + Specifically, it should not be provided to the application or included unencrypted in + messages to the [=CDM=]. This can be accomplished by encrypting the identifier or + message with the identifier or such that it is only decryptable by that specific + [=CDM=].

    -

    Among other things, this means that:

    +

    + Among other things, this means that: +

      -

    • Every signature made with device-specific or user-specific keys MUST be different, even given the same plaintext.

      • -

    • Identifiers, keys, or certificates relating to device-specific or user-specific keys MUST be encrypted for the license or [=individualization=] server.

      • -

    • Messages from the license server to the [=CDM=] MUST NOT expose recipient-unique identifiers, such as the ID of the intended decryption key, on the outside of the encryption envelope.

      • +
    • +

      + Every signature made with device-specific or user-specific keys MUST be + different, even given the same plaintext. +

      +
      • +
    • +

      + Identifiers, keys, or certificates relating to device-specific or user-specific + keys MUST be encrypted for the license or [=individualization=] server. +

      +
      • +
    • +

      + Messages from the license server to the [=CDM=] MUST NOT expose recipient-unique + identifiers, such as the ID of the intended decryption key, on the outside of the + encryption envelope. +

      +
    -
    -

    Use Per-Origin Per-Profile Identifiers

    +

    + Use Per-Origin Per-Profile Identifiers +

    - All identifiers except [=Distinctive Permanent Identifiers=] MUST be unique per [=origin=] and [=browsing profile=]. - See . + All identifiers except [=Distinctive Permanent Identifiers=] MUST be unique per + [=origin=] and [=browsing profile=]. See .

    -

    This includes but is not limited to [=Distinctive Identifiers=].

    -

    [=Distinctive Permanent Identifiers=] MUST NOT be exposed to the application or origin.

    +

    + This includes but is not limited to [=Distinctive Identifiers=]. +

    +

    + [=Distinctive Permanent Identifiers=] MUST NOT be exposed to the application or + origin. +

    -
    -

    Use Non-Associable Identifiers

    +

    + Use Non-Associable Identifiers +

    - All identifiers, including [=Distinctive Identifiers=], exposed by the implementation to applications, even in encrypted form, MUST be [=non-associable by application=](s) across [=origins=], [=browsing profiles=], and clearing of identifiers. + All identifiers, including [=Distinctive Identifiers=], exposed by the implementation + to applications, even in encrypted form, MUST be [=non-associable by application=](s) + across [=origins=], [=browsing profiles=], and clearing of identifiers.

    - For all such identifiers, it MUST NOT be possible for one or more applications, including related license or other servers to achieve such correlation or association. + For all such identifiers, it MUST NOT be possible for one or more applications, + including related license or other servers to achieve such correlation or association.

    -
    -

    Allow Identifiers to Be Cleared

    +

    + Allow Identifiers to Be Cleared +

    - As a consequence of the requirements in Allow Persistent Data to Be Cleared, - all potential identifiers or [=Distinctive Values=] except [=Distinctive Permanent Identifiers=] MUST be clearable - such that the values are no longer retrievable, observable, or inferable both outside, such as via the APIs defined in this specification, and on the client device. + As a consequence of the requirements in Allow + Persistent Data to Be Cleared, all potential identifiers or [=Distinctive Values=] + except [=Distinctive Permanent Identifiers=] MUST be clearable such that the values are + no longer retrievable, observable, or inferable both outside, such as via the APIs + defined in this specification, and on the client device.

    - Implementations that [=use Distinctive Identifier(s)=] MUST allow the user to clear the [=Distinctive Identifier(s)=]. - Implementations that [=use Distinctive Permanent Identifier(s)=] MUST allow the user to clear values associated with the [=Distinctive Permanent Identifier(s)=]. + Implementations that [=use Distinctive Identifier(s)=] MUST allow the user to clear the + [=Distinctive Identifier(s)=]. Implementations that [=use Distinctive Permanent + Identifier(s)=] MUST allow the user to clear values associated with the [=Distinctive + Permanent Identifier(s)=].

    - Once cleared, new [=non-associable by applications=] value(s) MUST be generated when values, such as [=Distinctive Identifiers=], are subsequently needed. + Once cleared, new [=non-associable by applications=] value(s) MUST be generated when + values, such as [=Distinctive Identifiers=], are subsequently needed.

    -
    -

    Individualization

    +

    + Individualization +

    - Identifiers, especially [=Distinctive Identifiers=], are sometimes generated or obtained via a process called individualization or provisioning. - The resulting identifier(s) MUST be [=non-associable by applications=] and [=use of Distinctive Identifier(s)|use of them=] MUST only be exposed to a single origin from a single profile. - This process MAY be performed multiple times, such as after identifier(s) are cleared. + Identifiers, especially [=Distinctive Identifiers=], are sometimes generated or obtained + via a process called individualization or provisioning. The resulting identifier(s) MUST + be [=non-associable by applications=] and [=use of Distinctive Identifier(s)|use of + them=] MUST only be exposed to a single + origin from a single profile. This process MAY be performed multiple times, such as + after identifier(s) are cleared.

    -

    This process MUST be performed either [=direct individualization|directly by the user agent=] or [=app-assisted individualization|through the application=]. - The mechanisms, flow, and restrictions for the two types of individualization are different, as described in the following sections. - Which method is used depends on the [=CDM=] implementation and application of the requirements of this specification, especially those below. +

    + This process MUST be performed either [=direct individualization|directly by the user + agent=] or [=app-assisted individualization|through the application=]. The mechanisms, + flow, and restrictions for the two types of individualization are different, as described + in the following sections. Which method is used depends on the [=CDM=] implementation and + application of the requirements of this specification, especially those below.

    - {{MediaKeySystemConfiguration/distinctiveIdentifier}} controls whether [=Distinctive Identifiers=] and [=Distinctive Permanent Identifiers=] may be [=use Distinctive Identifier(s) or Distinctive Permanent Identifier(s)|used=], including for individualization. - Specifically, such identifiers may only be [=use Distinctive Identifier(s) or Distinctive Permanent Identifier(s)|used=] when the value of the {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of the {{MediaKeySystemAccess}} used to create the {{MediaKeys}} object is {{MediaKeysRequirement/"required"}}. + {{MediaKeySystemConfiguration/distinctiveIdentifier}} controls whether [=Distinctive + Identifiers=] and [=Distinctive Permanent Identifiers=] may be [=use Distinctive + Identifier(s) or Distinctive Permanent Identifier(s)|used=], including for + individualization. Specifically, such identifiers may only be [=use Distinctive + Identifier(s) or Distinctive Permanent Identifier(s)|used=] when the value of the + {{MediaKeySystemConfiguration/distinctiveIdentifier}} member of the + {{MediaKeySystemAccess}} used to create the {{MediaKeys}} object is + {{MediaKeysRequirement/"required"}}.

    -
    -
    Direct Individualization
    +
    + Direct Individualization +

    - Direct Individualization is performed between the [=CDM=] and an origin- and application-independent server. - Although the server is origin-independent, the result of the individualization enables the [=CDM=] to provide origin-specific identifiers per the other - requirements of this specification. - The process MUST be performed by the user agent and MUST NOT use the APIs defined in this specification. + Direct Individualization is performed between the [=CDM=] and an origin- and + application-independent server. Although the server is origin-independent, the result + of the individualization enables the [=CDM=] to provide origin-specific identifiers per + the other requirements of this specification. The process MUST be performed by the user + agent and MUST NOT use the APIs defined in this specification.

    -

    For example, such a process may initialize a client device and/or obtain a per-origin clearable identifier for a single browsing profile by communicating with a pre-determined server hosted by the user agent or CDM vendor, possibly [=using Distinctive Permanent Identifier(s)=] or other [=Permanent Identifier(s)=] from the client device. +

    + For example, such a process may initialize a client device and/or obtain a per-origin clearable identifier for a single browsing profile by communicating + with a pre-determined server hosted by the user agent or CDM vendor, possibly [=using + Distinctive Permanent Identifier(s)=] or other [=Permanent Identifier(s)=] from the + client device. +

    +

    + For such individualization, all message exchanges:

    -

    For such individualization, all message exchanges:

      -

    • MUST be handled by the user agent and performed by the user agent via the user agent's network stack.

      • -

    • MUST NOT be performed directly by the [=CDM=].

      • -

    • MUST NOT be passed to or through the application via the APIs defined in this specification.

      • -

    • MUST be sent to a URL selected independently of any origin and application.

      • -

    • MUST encrypt all [=Distinctive Identifiers=] and [=Distinctive Permanent Identifiers=].

      • -

    • MUST use TLS.

      • +
    • +

      + MUST be handled by the user agent and performed by the user agent via the user + agent's network stack. +

      +
      • +
    • +

      + MUST NOT be performed directly by the [=CDM=]. +

      +
      • +
    • +

      + MUST NOT be passed to or through the application via the APIs defined in this + specification. +

      +
      • +
    • +

      + MUST be sent to a URL selected independently of any origin and application. +

      +
      • +
    • +

      + MUST encrypt all [=Distinctive Identifiers=] and [=Distinctive Permanent + Identifiers=]. +

      +
      • +
    • +

      + MUST use TLS. +

      +

    - Implementations MUST NOT expose, even in encrypted form, [=origin=](s), origin- or application-specific information, or values that are [=associable=] with origin(s) to centralized servers since this could create a central record of all origins visited by a user or device. + Implementations MUST NOT expose, even in encrypted form, [=origin=](s), origin- or + application-specific information, or values that are [=associable=] with origin(s) to + centralized servers since this could create a central record of all origins visited by + a user or device.

    -
    -
    App-Assisted Individualization
    -

    App-Assisted Individualization is performed between the [=CDM=] and the application, including an application-selected server, and results in a per-origin identifier. - The process MUST be performed via the APIs defined in this specification and MUST NOT involve other methods of communication. - As with all other uses of the APIs, the process MAY [=use Distinctive Identifier(s)|use one or more Distinctive Identifier(s)=], but it MUST NOT [=use Distinctive Permanent Identifier(s)=] or non-origin-specific values, even in encrypted form. - If the process [=uses Distinctive Identifier(s)|uses one or more Distinctive Identifier(s)=], the resulting identifier is by definition also a [=Distinctive Identifier=]. +

    + App-Assisted Individualization +
    +

    + App-Assisted Individualization is performed between the [=CDM=] and the application, + including an application-selected server, and results in a per-origin identifier. The + process MUST be performed via the APIs defined in this specification and MUST NOT + involve other methods of communication. As with all other uses of the APIs, the process + MAY [=use Distinctive Identifier(s)|use one or more Distinctive Identifier(s)=], but it + MUST NOT [=use Distinctive Permanent Identifier(s)=] or non-origin-specific values, + even in encrypted form. If the process [=uses Distinctive Identifier(s)|uses one or + more Distinctive Identifier(s)=], the resulting identifier is by definition also a + [=Distinctive Identifier=]. +

    +

    + For such individualization, all message exchanges:

    -

    For such individualization, all message exchanges:

      -

    • MUST be passed to or through the application via the APIs defined in this specification.

      • -

    • SHALL use the message type {{MediaKeyMessageType/"individualization-request"}} for all related {{message}} events.

      • -

    • MUST NOT be performed by the user agent.

      • -

    • MUST NOT be performed directly by the [=CDM=].

      • -

    • MUST NOT contain or otherwise [=use Distinctive Permanent Identifier(s)=].

      • -

    • MUST NOT contain non-origin-specific per-client information

    • -

      MUST adhere to the identifier requirements.

      -

      This includes only using values that are unique per origin and profile and clearable and encrypting them as required.

      +

      + MUST be passed to or through the application via the APIs defined in this + specification. +

      +
      • +
    • +

      + SHALL use the message type {{MediaKeyMessageType/"individualization-request"}} for + all related {{message}} events. +

      +
      • +
    • +

      + MUST NOT be performed by the user agent. +

      +
      • +
    • +

      + MUST NOT be performed directly by the [=CDM=]. +

      +
      • +
    • +

      + MUST NOT contain or otherwise [=use Distinctive Permanent Identifier(s)=]. +

      +
      • +
    • +

      + MUST NOT contain non-origin-specific per-client information +

      +
      • +
    • +

      + MUST adhere to the identifier requirements. +

      +

      + This includes only using values that are unique per origin and profile and + clearable and encrypting them as required. +

      +
      • +
    • +

      + MUST NOT provide executable code to the [=CDM=]. +

      • -

    • MUST NOT provide executable code to the [=CDM=].

    - When [=associable=] values, including [=Distinctive Identifier(s)=], are [=uses Distinctive Identifier(s)|used=] in the process, - implementations MUST NOT expose, even in encrypted form, [=origin=](s)-, origin- or application-specific information, or values that are [=associable=] with origin(s) to centralized servers since this could create a central record of all origins visited by a user or device. + When [=associable=] values, including [=Distinctive Identifier(s)=], are [=uses + Distinctive Identifier(s)|used=] in the process, implementations MUST NOT expose, even + in encrypted form, [=origin=](s)-, origin- or application-specific information, or + values that are [=associable=] with origin(s) to centralized servers since this could + create a central record of all origins visited by a user or device.

    -

    With appropriate precautions, such individualization can provide better privacy than [=Direct Individualization=], though not as good as models that do not [=use Distinctive Identifier(s)=]. - To preserve the benefits of such a design and to avoid introducing other privacy concerns, - such implementations and the applications that support them SHOULD avoid deferring or forwarding individualization messages to a central server or other server not controlled by the application author. +

    + With appropriate precautions, such individualization can provide better privacy than + [=Direct Individualization=], though not as good as models that do not [=use + Distinctive Identifier(s)=]. To preserve the benefits of such a design and to avoid + introducing other privacy concerns, such implementations and the applications that + support them SHOULD avoid deferring or forwarding individualization messages to a + central server or other server not controlled by the application author.

    -
    -

    Support Multiple Keys

    -

    Implementations MUST support multiple keys in each {{MediaKeySession}} object.

    -

    The mechanics of how multiple keys are supported is an implementation detail, but it MUST be transparent to the application and the APIs defined in this specification.

    - -

    Implementations MUST support seamless switching between keys during playback. - This includes both keys in the same {{MediaKeySession}} and keys in separate {{MediaKeySession}} objects. +

    + Support Multiple Keys +

    +

    + Implementations MUST support multiple keys in each {{MediaKeySession}} object. +

    +

    + The mechanics of how multiple keys are supported is an implementation detail, but it MUST + be transparent to the application and the APIs defined in this specification. +

    +

    + Implementations MUST support seamless switching between keys during playback. This + includes both keys in the same {{MediaKeySession}} and keys in separate + {{MediaKeySession}} objects.

    -
    -

    Initialization Data Type Support

    +

    + Initialization Data Type Support +

    -

    Licenses Generated are Independent of Content Type

    -

    Implementations SHOULD allow licenses generated with any [=Initialization Data Type=] they support to be used with any content type.

    -

    Otherwise, the {{Navigator/requestMediaKeySystemAccess()}} algorithm might, for example, reject a {{MediaKeySystemConfiguration}} because one of the {{MediaKeySystemConfiguration/initDataTypes}} is not supported with one of the {{MediaKeySystemConfiguration/videoCapabilities}}.

    +

    + Licenses Generated are Independent of Content Type +

    +

    + Implementations SHOULD allow licenses generated with any [=Initialization Data Type=] + they support to be used with any content type. +

    +

    + Otherwise, the {{Navigator/requestMediaKeySystemAccess()}} algorithm might, for + example, reject a {{MediaKeySystemConfiguration}} because one of the + {{MediaKeySystemConfiguration/initDataTypes}} is not supported with one of the + {{MediaKeySystemConfiguration/videoCapabilities}}. +

    -
    -

    Support Extraction From Media Data

    -

    For any supported [=Initialization Data Type=] that may appear in a supported container, the user agents MUST support extracting that type of [=Initialization Data=] from each such supported container.

    -

    In other words, indicating support for an [=Initialization Data Type=] implies both [=CDM=] support for generating license requests and, for container-specific types, user agent support for extracting it from the container. - This does not mean that implementations must be able to parse any supported [=Initialization Data=] from any supported content type. +

    + Support Extraction From Media Data +

    +

    + For any supported [=Initialization Data Type=] that may appear in a supported + container, the user agents MUST support extracting + that type of [=Initialization Data=] from each such supported container. +

    +

    + In other words, indicating support for an [=Initialization Data Type=] implies both + [=CDM=] support for generating license requests and, for container-specific types, user + agent support for extracting it from the container. This does not mean + that implementations must be able to parse any supported [=Initialization + Data=] from any supported content type.

    -
    -

    Supported Media

    -

    This section defines properties of content (media resource) supported by implementations of this specification.

    - +

    + Supported Media +

    +

    + This section defines properties of content (media + resource) supported by implementations of this specification. +

    -

    Unencrypted Container

    +

    + Unencrypted Container +

    - The media container MUST NOT be encrypted. - This specification relies on the user agent's ability to parse the media container without having to decrypt any of the media data. - This includes the [=Encrypted Block Encountered=] and [=Initialization Data Encountered=] algorithms as well as supporting standard {{HTMLMediaElement}} [[HTML]] functionality, such as seeking. + The media container MUST NOT be encrypted. This specification relies on the user + agent's ability to parse the media container without having to decrypt any of the media + data. This includes the [=Encrypted Block Encountered=] and [=Initialization Data + Encountered=] algorithms as well as supporting standard {{HTMLMediaElement}} [[HTML]] + functionality, such as seeking.

    -
    -

    Interoperably Encrypted

    +

    + Interoperably Encrypted +

    - Media resources, including all tracks, MUST be encrypted and packaged per a container-specific "common encryption" specification that allows the content to be decrypted in a fully specified and compatible way when a key or keys are provided. + Media resources, including all tracks, MUST be + encrypted and packaged per a container-specific "common encryption" specification that + allows the content to be decrypted in a fully specified and compatible way when a key + or keys are provided.

    - The [[[EME-STREAM-REGISTRY]]] [[EME-STREAM-REGISTRY]] provides references to such stream formats. + The [[[EME-STREAM-REGISTRY]]] [[EME-STREAM-REGISTRY]] provides references to such + stream formats.

    -
    -

    Unencrypted In-band Support Content

    +

    + Unencrypted In-band Support Content +

    - In-band support content, such as captions, described audio, and transcripts, SHOULD NOT be encrypted. + In-band support content, such as captions, described audio, and transcripts, SHOULD NOT + be encrypted.

    - Decryption of such tracks - especially such that they can be provided back the user agent - is not generally supported by implementations. - Thus, encrypting such tracks would prevent them from being widely available for use with accessibility features in user agent implementations. + Decryption of such tracks - especially such that they can be provided back the user + agent - is not generally supported by implementations. Thus, encrypting such tracks + would prevent them from being widely available for use with accessibility features in + user agent implementations.

    - To ensure accessibility information is available in usable form, for implementations that choose to support encrypted in-band support content: a) the [=CDM=] MUST provide the decrypted data to the user agent and - b) the user agent MUST process it in the same way as equivalent unencrypted support content. For example, to be exposed as timed text tracks [[HTML]]. + To ensure accessibility information is available in usable form, for implementations + that choose to support encrypted in-band support content: a) the [=CDM=] MUST provide + the decrypted data to the user agent and b) the user agent MUST process it in the same + way as equivalent unencrypted support content. For example, to be exposed as + timed text tracks [[HTML]].

    -
    -
    -

    Common Key Systems

    -

    All user agents MUST support the common [=Key Systems=] described in this section.

    -

    This ensures that there is a common baseline level of functionality that is guaranteed to be supported in all user agents, including those that are entirely open source. - Thus, content providers that need only basic decryption can build simple applications that will work on all platforms without needing to work with any content protection providers. +

    + Common Key Systems +

    +

    + All user agents MUST support the common [=Key Systems=] described in this section. +

    +

    + This ensures that there is a common baseline level of functionality that is guaranteed to + be supported in all user agents, including those that are entirely open source. Thus, + content providers that need only basic decryption can build simple applications that will + work on all platforms without needing to work with any content protection providers.

    -
    -

    Clear Key

    -

    The "org.w3.clearkey" [=Key System=] uses plain-text clear (unencrypted) key(s) to decrypt the source. - No additional client-side content protection is required. - This [=Key System=] is described below. +

    + Clear Key +

    +

    + The "org.w3.clearkey" [=Key System=] uses plain-text clear (unencrypted) + key(s) to decrypt the source. No additional client-side content protection is required. + This [=Key System=] is described below.

    -
    -

    Capabilities

    -

    The following describe how [=Clear Key=] supports [=Key System=]-specific capabilities:

    +

    + Capabilities +

    +

    + The following describe how [=Clear Key=] supports [=Key System=]-specific capabilities: +

    • -

      {{MediaKeySystemConfiguration}}:

      +

      + {{MediaKeySystemConfiguration}}: +

        -

      1. {{MediaKeySystemMediaCapability/encryptionScheme}}: Implementations MUST support the [="cenc"=] scheme, and MAY support other schemes.

        2. -

      2. {{MediaKeySystemMediaCapability/robustness}}: Only the empty string is supported.

        3. -

      3. {{MediaKeySystemConfiguration/distinctiveIdentifier}}: {{MediaKeysRequirement/"required"}} is not supported.

        4. -

      4. {{MediaKeySystemConfiguration/persistentState}}: Not {{MediaKeysRequirement/"required"}} unless the application intends to create non-{{MediaKeySessionType/"temporary"}} sessions, if supported.

        5. +
      5. +

        + {{MediaKeySystemMediaCapability/encryptionScheme}}: Implementations MUST + support the [="cenc"=] scheme, and MAY support other schemes. +

        +
        6. +
      6. +

        + {{MediaKeySystemMediaCapability/robustness}}: Only the empty string is + supported. +

        +
        7. +
      7. +

        + {{MediaKeySystemConfiguration/distinctiveIdentifier}}: + {{MediaKeysRequirement/"required"}} is not supported. +

        +
        8. +
      8. +

        + {{MediaKeySystemConfiguration/persistentState}}: Not + {{MediaKeysRequirement/"required"}} unless the application intends to create + non-{{MediaKeySessionType/"temporary"}} sessions, if supported. +

        +
      • -

    • The {{MediaKeySessionType/"persistent-license"}} {{MediaKeySessionType}}: Implementations MAY support this type.

      • -

    • The {{MediaKeys/setServerCertificate()}} method: Not supported.

      • -

    • The {{HTMLMediaElement/setMediaKeys()}} method: Implementations MAY support associating the {{MediaKeys}} object with more than one {{HTMLMediaElement}}.

      • +
    • +

      + The {{MediaKeySessionType/"persistent-license"}} {{MediaKeySessionType}}: + Implementations MAY support this type. +

      +
      • +
    • +

      + The {{MediaKeys/setServerCertificate()}} method: Not supported. +

      +
      • +
    • +

      + The {{HTMLMediaElement/setMediaKeys()}} method: Implementations MAY support + associating the {{MediaKeys}} object with more than one {{HTMLMediaElement}}. +

      +
    -
    -

    Behavior

    -

    The following describe how [=Clear Key=] implements [=Key System=]-specific behaviors:

    +

    + Behavior +

    +

    + The following describe how [=Clear Key=] implements [=Key System=]-specific behaviors: +

      -

    • In the {{MediaKeySession/generateRequest()}} algorithm:

      +
    • +

      + In the {{MediaKeySession/generateRequest()}} algorithm: +

        -

      • The generated message is a JSON object encoded in UTF-8 as described in License Request Format.

        • -

      • The request is generated by extracting the key IDs from the sanitized init data.

        • -

      • The "type" member value is the value of the sessionType parameter.

        • +
      • +

        + The generated message is a JSON object encoded in UTF-8 as described + in License Request Format. +

        +
        • +
      • +

        + The request is generated by extracting the key IDs from the sanitized init + data. +

        +
        • +
      • +

        + The "type" member value is the value of the sessionType parameter. +

        +
      • -

    • The {{MediaKeySession/sessionId}} attribute is a numerical value representable by a 32-bit integer.

      • -

    • The {{MediaKeySession/expiration}} attribute is always NaN.

      • -

    • In the {{MediaKeySession/update()}} algorithm:

      +
    • +

      + The {{MediaKeySession/sessionId}} attribute is a numerical value representable by a + 32-bit integer. +

      +
      • +
    • +

      + The {{MediaKeySession/expiration}} attribute is always NaN. +

      +
      • +
    • +

      + In the {{MediaKeySession/update()}} algorithm: +

      • - The response parameter is either a JWK Set as described in License Format, - or a JSON object encoded in UTF-8 as described in License Release Acknowledgement Format. + The response parameter is either a JWK Set as described in License Format, or a JSON object encoded in + UTF-8 as described in License Release + Acknowledgement Format.

      • - In the first case, sanitized response is considered invalid if it is not a valid JWK Set with at least one valid JWK key of a valid length for the audio/video type. - In the second case sanitized response is considered invalid if it is not a valid JSON object. + In the first case, sanitized response is considered invalid if it is + not a valid JWK Set with at least one valid JWK key of a valid length for the + audio/video type. In the second case sanitized response is + considered invalid if it is not a valid JSON object.

    • - For sessions of type {{MediaKeySessionType/"persistent-license"}}, in the {{MediaKeySession/remove()}} algorithm, the message reflecting - the record of license destruction is a JSON object encoded in UTF-8 as described in License Release Format. + For sessions of type {{MediaKeySessionType/"persistent-license"}}, in the + {{MediaKeySession/remove()}} algorithm, the message reflecting the + record of license destruction is a JSON object encoded in UTF-8 as + described in License Release Format.

    • - The {{MediaKeySession/keyStatuses}} attribute method initially contains all key IDs that have been provided via {{MediaKeySession/update()}}, with status {{MediaKeyStatus/"usable"}}. - When the {{MediaKeySession/remove()}} algorithm is executed, the {{MediaKeySession/keyStatuses}} attribute will be set to an empty list. + The {{MediaKeySession/keyStatuses}} attribute method initially contains all key IDs + that have been provided via {{MediaKeySession/update()}}, with status + {{MediaKeyStatus/"usable"}}. When the {{MediaKeySession/remove()}} algorithm is + executed, the {{MediaKeySession/keyStatuses}} attribute will be set to an empty + list.

    • - [=Initialization Data=]: Implementations MAY support any combination of registered Initialization Data Types [[EME-INITDATA-REGISTRY]]. - Implementations SHOULD support the "keyids" type [[EME-INITDATA-KEYIDS]] and other types appropriate for content types supported by the user agent. + [=Initialization Data=]: Implementations MAY support any combination of registered + Initialization Data Types [[EME-INITDATA-REGISTRY]]. Implementations SHOULD support + the "keyids" type [[EME-INITDATA-KEYIDS]] and other types appropriate + for content types supported by the user agent.

    -
    -

    License Request Format

    -

    This section describes the format of the license request provided to the application via the message attribute of the {{message}} event.

    - -

    The format is a JSON object containing the following members:

    +

    + License Request Format +

    +

    + This section describes the format of the license request provided to the application + via the message attribute of the {{message}} event. +

    +

    + The format is a JSON object containing the following members: +

    -
    "kids"
    -
    An array of [=key IDs=]. Each element of the array is the base64url encoding of the octet sequence containing the key ID value.
    -
    "type"
    -
    The requested {{MediaKeySessionType}}.
    +
    + "kids" +
    +
    + An array of [=key IDs=]. Each element of the array is the base64url encoding of the + octet sequence containing the key ID value. +
    +
    + "type" +
    +
    + The requested {{MediaKeySessionType}}. +
    - -

    When contained in the ArrayBuffer {{MediaKeyMessageEvent/message}} attribute of a {{MediaKeyMessageEvent}} object, the JSON string is encoded in UTF-8 as specified in the Encoding specification [[ENCODING]]. - Applications MAY decode the contents of the ArrayBuffer to a JSON string using the {{TextDecoder}} interface [[ENCODING]]. +

    + When contained in the ArrayBuffer {{MediaKeyMessageEvent/message}} attribute of a + {{MediaKeyMessageEvent}} object, the JSON string is encoded in UTF-8 as specified in + the Encoding specification [[ENCODING]]. Applications MAY decode the contents of the + ArrayBuffer to a JSON string using the {{TextDecoder}} interface [[ENCODING]].

    -
    -
    Example
    -

    The following example is a license request for a temporary license for two key IDs. (Line breaks are for readability only.)

    +
    + Example +
    +

    + The following example is a license request for a temporary license for two key IDs. + (Line breaks are for readability only.) + 

                   {
                 "kids": [
@@ -3826,35 +7644,62 @@ 
    Example
    -
    -

    License Format

    -

    This section describes the format of the license to be provided via the response parameter of the {{MediaKeySession/update()}} method.

    - -

    The format is a JSON Web Key (JWK) Set containing representation of the symmetric key to be used for decryption, as defined in the JSON Web Key (JWK) specification [[RFC7517]].

    - -

    For each JWK in the set, the parameter values are as follows:

    +

    + License Format +

    +

    + This section describes the format of the license to be provided via the + response parameter of the {{MediaKeySession/update()}} method. +

    +

    + The format is a JSON Web Key (JWK) Set containing representation of the symmetric key + to be used for decryption, as defined in the JSON Web Key (JWK) specification + [[RFC7517]]. +

    +

    + For each JWK in the set, the parameter values are as follows: +

    -
    "kty" (key type)
    -
    "oct" (octet sequence).
    -
    "k" (key value)
    -
    The base64url encoding of the octet sequence containing the symmetric [=key=] value.
    -
    "kid" (key ID)
    -
    The base64url encoding of the octet sequence containing the [=key ID=] value.
    +
    + "kty" (key type) +
    +
    + "oct" (octet sequence). +
    +
    + "k" (key value) +
    +
    + The base64url encoding of the octet sequence containing the symmetric [=key=] value. +
    +
    + "kid" (key ID) +
    +
    + The base64url encoding of the octet sequence containing the [=key ID=] value. +
    - -

    The JSON object MAY have an optional "type" member value, which MUST be one of the {{MediaKeySessionType}} values. - If not specified, the default value of {{MediaKeySessionType/"temporary"}} is used. - The {{MediaKeySession/update()}} algorithm compares this value to the sessionType. +

    + The JSON object MAY have an optional "type" member value, which MUST be one of the + {{MediaKeySessionType}} values. If not specified, the default value of + {{MediaKeySessionType/"temporary"}} is used. The {{MediaKeySession/update()}} algorithm + compares this value to the sessionType.

    - -

    When passed to the {{MediaKeySession/update()}} method as the ArrayBuffer response parameter, the JSON string MUST be encoded in UTF-8 as specified in the Encoding specification [[ENCODING]]. - Applications MAY encode the JSON string using the {{TextEncoder}} interface [[ENCODING]]. +

    + When passed to the {{MediaKeySession/update()}} method as the ArrayBuffer + response parameter, the JSON string MUST be encoded in UTF-8 as specified in + the Encoding specification [[ENCODING]]. Applications MAY encode the JSON string using + the {{TextEncoder}} interface [[ENCODING]].

    -
    -
    Example
    -

    The following example is a JWK Set containing a single symmetric key. (Line breaks are for readability only.)

    +
    + Example +
    +

    + The following example is a JWK Set containing a single symmetric key. (Line breaks + are for readability only.) + 

                   {
                 "keys": [{
@@ -3867,27 +7712,42 @@ 
    Example
    -
    - -

    License Release Format

    -

    This section describes the format of the license release message to be provided via the message attribute of the {{message}} event.

    +

    + License Release Format +

    +

    + This section describes the format of the license release message to be provided via the + message attribute of the {{message}} event. +

    - The format is a JSON object. For sessions of type {{MediaKeySessionType/"persistent-license"}}, the object shall contain the following member: + The format is a JSON object. For sessions of type + {{MediaKeySessionType/"persistent-license"}}, the object shall contain the following + member:

    -
    "kids"
    -
    An array of [=key IDs=]. Each element of the array is the base64url encoding of the octet sequence containing the key ID value.
    +
    + "kids" +
    +
    + An array of [=key IDs=]. Each element of the array is the base64url encoding of the + octet sequence containing the key ID value. +
    -

    When contained in the ArrayBuffer {{MediaKeyMessageEvent/message}} attribute of a {{MediaKeyMessageEvent}} object, the JSON string is encoded in UTF-8 as specified in the Encoding specification [[ENCODING]]. - Applications MAY decode the contents of the ArrayBuffer to a JSON string using the {{TextDecoder}} interface [[ENCODING]]. +

    + When contained in the ArrayBuffer {{MediaKeyMessageEvent/message}} attribute of a + {{MediaKeyMessageEvent}} object, the JSON string is encoded in UTF-8 as specified in + the Encoding specification [[ENCODING]]. Applications MAY decode the contents of the + ArrayBuffer to a JSON string using the {{TextDecoder}} interface [[ENCODING]].

    -
    -
    Example message reflecting a [=record of license destruction=]
    +
    + Example message reflecting a [=record of license destruction=] +

    - The following example is a license release for a {{MediaKeySessionType/"persistent-license"}} session that contained two keys. - (Line breaks are for readability only.) + The following example is a license release for a + {{MediaKeySessionType/"persistent-license"}} session that contained two keys. (Line + breaks are for readability only.) 

                   {
@@ -3896,24 +7756,40 @@ 
    Example message reflecting a [=record of license destruction=]
    -
    -

    License Release Acknowledgement Format

    -

    This section describes the format of the license release acknowledgement provided via the response parameter of the {{MediaKeySession/update()}} method.

    - -

    The format is a JSON object containing the following members:

    +

    + License Release Acknowledgement Format +

    +

    + This section describes the format of the license release acknowledgement provided via + the response parameter of the {{MediaKeySession/update()}} method. +

    +

    + The format is a JSON object containing the following members: +

    -
    "kids"
    -
    An array of [=key IDs=]. Each element of the array is the base64url encoding of the octet sequence containing the key ID value.
    +
    + "kids" +
    +
    + An array of [=key IDs=]. Each element of the array is the base64url encoding of the + octet sequence containing the key ID value. +
    - -

    When passed to the {{MediaKeySession/update()}} method as the ArrayBuffer response parameter, the JSON string MUST be encoded in UTF-8 as specified in the Encoding specification [[ENCODING]]. - Applications MAY encode the JSON string using the {{TextEncoder}} interface [[ENCODING]]. +

    + When passed to the {{MediaKeySession/update()}} method as the ArrayBuffer + response parameter, the JSON string MUST be encoded in UTF-8 as specified in + the Encoding specification [[ENCODING]]. Applications MAY encode the JSON string using + the {{TextEncoder}} interface [[ENCODING]].

    -
    -
    Example
    -

    The following example is a license request for a temporary license for two key IDs. (Line breaks are for readability only.)

    +
    + Example +
    +

    + The following example is a license request for a temporary license for two key IDs. + (Line breaks are for readability only.) + 

                   {
                 "kids": [
@@ -3925,482 +7801,964 @@ 
    Example
    -

    Using base64url

    -

    For more information on base64url and working with it, see the "Base64url Encoding" terminology definition and "Notes on implementing base64url encoding without padding" in [[RFC7515]]. - Specifically, there is no '=' padding, and the characters '-' and '_' MUST be used instead of '+' and '/', respectively. +

    + Using base64url +

    +

    + For more information on base64url and working with it, see the "Base64url Encoding" + terminology definition and "Notes on implementing base64url encoding without padding" + in [[RFC7515]]. Specifically, there is no '=' padding, and the characters '-' and '_' + MUST be used instead of '+' and '/', respectively.

    - -
    -

    Security

    - +

    + Security +

    -

    Input Data Attacks and Vulnerabilities

    -

    User Agent and [=Key System=] implementations MUST consider [=HTMLMediaElement/media data=], [=Initialization Data=], data passed to {{MediaKeySession/update()}}, licenses, key data, and all other data provided by the application as untrusted content and potential attack vectors. - They MUST use appropriate safeguards to mitigate any associated threats and take care to safely parse, decrypt, etc. such data. - User Agents SHOULD validate data before passing it to the [=CDM=]. +

    + Input Data Attacks and Vulnerabilities +

    +

    + User Agent and [=Key System=] implementations MUST consider [=HTMLMediaElement/media + data=], [=Initialization Data=], data passed to {{MediaKeySession/update()}}, licenses, + key data, and all other data provided by the application as untrusted content and + potential attack vectors. They MUST use appropriate safeguards to mitigate any associated + threats and take care to safely parse, decrypt, etc. such data. User Agents SHOULD + validate data before passing it to the [=CDM=].

    -

    Such validation is especially important if the [=CDM=] does not run in the same (sandboxed) context as, for example, the DOM.

    - -

    Implementations MUST NOT return active content or passive content that affects program control flow to the application.

    -

    For example, it is not safe to expose URLs or other information that may have come from media data, such as is the case for the [=Initialization Data=] passed to {{MediaKeySession/generateRequest()}}. - Applications must determine the URLs to use. The {{MediaKeyMessageEvent/messageType}} attribute of the {{message}} event can be used by the application to select among a set of URLs if applicable. +

    + Such validation is especially important if the [=CDM=] does not run in the same + (sandboxed) context as, for example, the DOM. +

    +

    + Implementations MUST NOT return active content or passive content that affects program + control flow to the application. +

    +

    + For example, it is not safe to expose URLs or other information that may have come from + media data, such as is the case for the [=Initialization Data=] passed to + {{MediaKeySession/generateRequest()}}. Applications must determine the URLs to use. The + {{MediaKeyMessageEvent/messageType}} attribute of the {{message}} event can be used by + the application to select among a set of URLs if applicable.

    -
    -

    CDM Attacks and Vulnerabilities

    -

    User Agents are responsible for providing users with a secure way to browse the web. - This responsibility applies to any functionality used by User Agents, including functionalities from third parties. - User agent implementers MUST obtain sufficient information from [=Key System=] implementers to enable them to properly assess the security implications of integrating with the [=Key System=]. - User agent implementers MUST ensure [=CDM=] implementations provide and/or support sufficient controls for the user agent to provide security for the user. - User agent implementers MUST ensure [=CDM=] implementations can and will be quickly and proactively updated in the event of security vulnerabilities. +

    + CDM Attacks and Vulnerabilities +

    +

    + User Agents are responsible for providing users with a secure way to browse the web. This + responsibility applies to any functionality used by User Agents, including + functionalities from third parties. User agent implementers MUST obtain sufficient + information from [=Key System=] implementers to enable them to properly assess the + security implications of integrating with the [=Key System=]. User agent implementers + MUST ensure [=CDM=] implementations provide and/or support sufficient controls for the + user agent to provide security for the user. User agent implementers MUST ensure [=CDM=] + implementations can and will be quickly and proactively updated in the event of security + vulnerabilities.

    -

    Exploiting a [=CDM=] implementation that is not fully sandboxed and/or uses platform features may allow an attacker to access OS or platform features, elevate privilege (e.g., to run as system or root), and/or access drivers, kernel, firmware, hardware, etc. - Such features, software, and hardware may not be written to be robust against hostile software or web-based attacks and may not be updated with security fixes, especially compared to the user agent. - Lack of, infrequent, or slow updates for fixes to security vulnerabilities in [=CDM=] implementations increases the risk. - Such [=CDM=] implementations and UAs that expose them MUST be especially careful in all areas of security, including parsing of all data. +

    + Exploiting a [=CDM=] implementation that is not fully sandboxed and/or uses platform + features may allow an attacker to access OS or platform features, elevate privilege + (e.g., to run as system or root), and/or access drivers, kernel, firmware, hardware, etc. + Such features, software, and hardware may not be written to be robust against hostile + software or web-based attacks and may not be updated with security fixes, especially + compared to the user agent. Lack of, infrequent, or slow updates for fixes to security + vulnerabilities in [=CDM=] implementations increases the risk. Such [=CDM=] + implementations and UAs that expose them MUST be especially careful in all areas of + security, including parsing of all data.

    -

    User agents should be especially diligent when using a [=CDM=] or underlying mechanism that is part of or provided by the client OS, platform and/or hardware.

    - -

    If a user agent chooses to support a [=Key System=] implementation that cannot be sufficiently sandboxed or otherwise secured, the user agent SHOULD ensure that users are fully informed and/or give explicit consent before loading or invoking it. +

    + User agents should be especially diligent when using a [=CDM=] or underlying mechanism + that is part of or provided by the client OS, platform and/or hardware.

    -

    Granting permissions to unauthenticated origins is equivalent to granting the permissions to any origin in the presence of a network attacker. - See abuse of persisted consent. +

    + If a user agent chooses to support a [=Key System=] implementation that cannot be + sufficiently sandboxed or otherwise secured, the user agent SHOULD ensure that users are fully informed and/or give explicit consent + before loading or invoking it. +

    +

    + Granting permissions to unauthenticated origins is equivalent to granting the permissions + to any origin in the presence of a network attacker. See abuse of persisted consent.

    -
    -

    Network Attacks

    +

    + Network Attacks +

    -

    Potential Attacks

    -

    Potential network attacks and their implications include:

    +

    + Potential Attacks +

    +

    + Potential network attacks and their implications include: +

      -

    • DNS spoofing attacks: One cannot guarantee that a host claiming to be in a certain domain ([=origin=]) really is from that domain.

      • -

    • Passive network attacks: One cannot guarantee that data, including [=Distinctive Identifiers=] and [=Distinctive Permanent Identifiers=], transmitted between the client and server is not viewed by other entities. See User Tracking.

    • -

      Active network attacks: One cannot guarantee that Additional scripts or iframes are not injected into pages (both those that use the APIs defined in this specification for legitimate purposes and pages that do not use them). - The consequences are that: +

      + DNS spoofing attacks: One cannot guarantee that a host claiming to be in a certain + domain ([=origin=]) really is from that domain. +

      +
      • +
    • +

      + Passive network attacks: One cannot guarantee that data, including [=Distinctive + Identifiers=] and [=Distinctive Permanent Identifiers=], transmitted between the + client and server is not viewed by other entities. See User Tracking. +

      +
      • +
    • +

      + Active network attacks: One cannot guarantee that Additional scripts or iframes are + not injected into pages (both those that use the APIs defined in this specification + for legitimate purposes and pages that do not use them). The consequences are that:

        -

      • Calls to the APIs defined in this specification can be injected into any page.

        • -

      • Calls to the APIs defined in this specification from pages using them for legitimate reasons can be manipulated, including modifying the requested functionality, modifying or adding calls, and modifying or injecting data. See also Input Data Attacks and Vulnerabilities

        • -

      • Data, including [=Distinctive Identifiers=] and [=Distinctive Permanent Identifiers=], transmitted between the client and server can be viewed and/or modified by other entities. See User Tracking.

        • +
      • +

        + Calls to the APIs defined in this specification can be injected into any page. +

        +
        • +
      • +

        + Calls to the APIs defined in this specification from pages using them for + legitimate reasons can be manipulated, including modifying the requested + functionality, modifying or adding calls, and modifying or injecting data. See + also Input Data Attacks and Vulnerabilities +

        +
        • +
      • +

        + Data, including [=Distinctive Identifiers=] and [=Distinctive Permanent + Identifiers=], transmitted between the client and server can be viewed and/or + modified by other entities. See User Tracking. +

        +

    • - Abuse of persisted consent: One cannot guarantee that the host requesting use of the APIs defined in this specification is the host to which the user previously provided consent. - The consequences are that granting permissions to unauthenticated origins is equivalent to granting the permissions to any origin in the presence of a network attacker. + Abuse of persisted consent: One cannot + guarantee that the host requesting use of the APIs defined in this specification is + the host to which the user previously provided consent. The consequences are that + granting permissions to unauthenticated origins is equivalent to granting the + permissions to any origin in the presence of a network attacker.

    -

    Mitigations

    -

    The following techniques may mitigate the risks:

    +

    + Mitigations +

    +

    + The following techniques may mitigate the risks: +

    -
    Use TLS
    +
    + Use TLS +
    -

    Applications using TLS can be sure that only the user, software working on behalf of the user, and other pages using TLS that have certificates identifying them as being from the same domain, can interact with that application. - Furthermore, [=origin=]-specific permissions in combination with a secure origin, ensure that permissions granted to an application cannot be abused by a network attacker. +

    + Applications using TLS can be sure that only the user, software working on behalf + of the user, and other pages using TLS that have certificates identifying them as + being from the same domain, can interact with that application. Furthermore, + [=origin=]-specific permissions in combination with a secure origin, ensure that + permissions granted to an application cannot be abused by a network attacker.

    -

    The APIs defined in this specification are only exposed on secure contexts. - See also Secure Origin and Transport. +

    + The APIs defined in this specification are only exposed on secure contexts. See + also Secure Origin and Transport.

    - -
    Block Mixed Content
    +
    + Block Mixed Content +
    -

    User agents MUST properly handle Mixed Content [[MIXED-CONTENT]], including blocking "Blockable Content" [[MIXED-CONTENT]] to avoid potential exposure to insecure content. - Such exposure could compromise other mitigations, such as use of TLS. +

    + User agents MUST properly handle Mixed Content [[MIXED-CONTENT]], including + blocking "Blockable Content" [[MIXED-CONTENT]] to avoid potential exposure to + insecure content. Such exposure could compromise other mitigations, such as use of + TLS. +

    +

    + User agents MAY choose to block all Mixed Content, including "Optionally-blockable + Content" [[MIXED-CONTENT]] to further increase security by preventing untrusted media data from being passed to the [=CDM=] + (see CDM Attacks and Vulnerabilities).

    -

    User agents MAY choose to block all Mixed Content, including "Optionally-blockable Content" [[MIXED-CONTENT]] to further increase security by preventing untrusted media data from being passed to the [=CDM=] (see CDM Attacks and Vulnerabilities).

    - - +
    -

    User agents SHOULD ensure that users are fully informed and/or give explicit consent before a [=Key System=] that presents security concerns that are greater than other user agent features (e.g., DOM content) may be accessed by an [=origin=]. +

    + User agents SHOULD ensure that users are fully informed and/or give explicit + consent before a [=Key System=] that presents security concerns that are greater + than other user agent features (e.g., DOM content) may be accessed by an + [=origin=].

    -

    Such mechanisms MUST be per [=origin=] to avoid valid uses enabling subsequent malicious access and MUST be per [=browsing profile=]. +

    + Such mechanisms MUST be per [=origin=] to avoid valid uses enabling subsequent + malicious access and MUST be per [=browsing profile=].

    -

    The restriction of the APIs defined in this specification to secure contexts ensures that a network attacker cannot exploit permissions granted to an unauthenticated origin. - See abuse of persisted consent. +

    + The restriction of the APIs defined in this specification to secure contexts + ensures that a network attacker cannot exploit + permissions granted to an unauthenticated origin. See abuse of persisted consent.

    -
    -

    iframe Attacks

    +

    + iframe Attacks +

    -

    Potential Attacks

    -

    Malicious pages could host legitimate applications in an iframe in an attempt hide an attack or deceive the user as to the source, such as making the use appear to be from a legitimate content provider. - This is especially relevent for implementations that inform the user or require consent, such as for security and/or privacy reasons. - In addition to Network Attacks, attackers could try to exploit legitimate uses of the APIs defined in this specification by hosting them in an iframe. - By having the legitimate application performing the actions, the attacker can reuse existing granted permissions (or whitelisting) and/or appear to be a legitimate request or use. +

    + Potential Attacks +

    +

    + Malicious pages could host legitimate applications in an iframe in an attempt hide an + attack or deceive the user as to the source, such as making the use appear to be from a + legitimate content provider. This is especially relevent for implementations that + inform the user or require consent, such as for + security and/or privacy reasons. In addition to Network Attacks, attackers could try to exploit legitimate uses + of the APIs defined in this specification by hosting them in an iframe. By + having the legitimate application performing the actions, the attacker can reuse + existing granted permissions (or whitelisting) and/or appear to be a legitimate request + or use.

    -

    Mitigations

    -

    User agents that inform the user or require consent, including for security and/or privacy reasons, - SHOULD base the UI and persistence of consent on the combination of [=origin=] of the top-level [=Document=] and the [=origin=] using the APIs defined in this specification. - This ensures that users are informed of the main document making the request and that persisting a permission for one (legitimate) combination does not inadvertently allow malicious use to go undetected. +

    + Mitigations +

    +

    + User agents that inform the user or require consent, + including for security and/or privacy reasons, SHOULD + base the UI and persistence of consent on the combination of [=origin=] of the + top-level [=Document=] and the [=origin=] using the APIs defined in this specification. + This ensures that users are informed of the main document making the request and that + persisting a permission for one (legitimate) combination does not inadvertently allow + malicious use to go undetected.

    -

    Authors SHOULD prevent other entities from hosting their applications in iframes. - Applications that must support being hosted for legitimate application-design reasons SHOULD NOT allow hosting documents to provide any data to be passed to the CDM - either via the APIs defined in this specification or as media data - and SHOULD NOT allow hosting frames to invoke the APIs defined in this specification. +

    + Authors SHOULD prevent other entities from hosting their applications in + iframes. Applications that must support being hosted for legitimate + application-design reasons SHOULD NOT allow hosting documents to provide any data to be passed to the CDM - either via the APIs + defined in this specification or as media data - and SHOULD NOT allow hosting frames to + invoke the APIs defined in this specification.

    -
    -

    Cross-Directory Attacks

    -

    Different authors sharing one host name, for example users hosting content on geocities.com, all share one [=origin=]. - User agents do not provide features to restrict access to APIs by pathname. +

    + Cross-Directory Attacks +

    +

    + Different authors sharing one host name, for example users hosting content on + geocities.com, all share one [=origin=]. User agents do not provide features + to restrict access to APIs by pathname. +

    +

    + Using the APIs defined in this specification on shared hosts compromises origin-based + security and privacy mitigations implemented by user agents. For example, per-origin + [=Distinctive Identifiers=] are shared by all authors on one host name, and peristed data + may be accessed and manipulated by any author on the host. The latter is especially + important if, for example, modification or deletion of such data could erase a user's + right to specific content. +

    +

    + Even if a path-restriction feature was made available by user agents, the usual DOM + scripting security model would make it trivial to bypass this protection and access the + data from any path.

    -

    Using the APIs defined in this specification on shared hosts compromises origin-based security and privacy mitigations implemented by user agents. - For example, per-origin [=Distinctive Identifiers=] are shared by all authors on one host name, and peristed data may be accessed and manipulated by any author on the host. - The latter is especially important if, for example, modification or deletion of such data could erase a user's right to specific content. +

    + Authors on shared hosts are therefore RECOMMENDED to avoid using the APIs defined in this + specification because doing so compromises origin-based security and privacy mitigations + in user agents.

    -

    Even if a path-restriction feature was made available by user agents, the usual DOM scripting security model would make it trivial to bypass this protection and access the data from any path.

    -

    Authors on shared hosts are therefore RECOMMENDED to avoid using the APIs defined in this specification because doing so compromises origin-based security and privacy mitigations in user agents.

    -
    -
    -

    Privacy

    - -

    The presence or use of [=Key System(s)=] on a user's device raises a number of privacy issues, falling into two categories: (a) user-specific information that may be disclosed by the EME interface itself or within [=Key System=] messages and (b) user-specific information that may be persistently stored on the user's device.

    -

    User Agents MUST take responsibility for providing users with adequate control over their own privacy. - Since User Agents may integrate with third party [=CDM=] implementations, [=CDM=] implementers MUST provide sufficient information and controls to user agent implementers to enable them to implement appropriate techniques to ensure users have control over their privacy, including but not limited to the techniques described below. +

    + Privacy +

    +

    + The presence or use of [=Key System(s)=] on a user's device raises a number of privacy + issues, falling into two categories: (a) user-specific information that may be disclosed by + the EME interface itself or within [=Key System=] messages and (b) user-specific + information that may be persistently stored on the user's device. +

    +

    + User Agents MUST take responsibility for providing users with adequate control over their + own privacy. Since User Agents may integrate with third party [=CDM=] implementations, + [=CDM=] implementers MUST provide sufficient information and controls to user agent + implementers to enable them to implement appropriate techniques to ensure users have + control over their privacy, including but not limited to the techniques described below.

    -
    -

    Information Disclosed by EME and Key Systems

    -

    Concerns regarding information disclosed by EME and [=Key Systems=] fall into two categories: (a) concerns about non-specific information that may nevertheless contribute to the possibility of fingerprinting a user agent or device and (b) user-specific information that may be used directly for user tracking.

    +

    + Information Disclosed by EME and Key Systems +

    +

    + Concerns regarding information disclosed by EME and [=Key Systems=] fall into two + categories: (a) concerns about non-specific information that may nevertheless contribute + to the possibility of fingerprinting a user agent or device and (b) user-specific + information that may be used directly for user tracking. +

    -
    -

    Fingerprinting

    -

    Malicious applications may be able to fingerprint users or user agents by detecting or enumerating the list of [=Key Systems=] that are supported and related information. - If proper origin protections are not provided this could include detection of sites that have been visited and information stored for those sites. In particular, [=Key Systems=] MUST not share key or other data between [=origins=]. +

    + Fingerprinting +

    +

    + Malicious applications may be able to fingerprint users or user agents by detecting or + enumerating the list of [=Key Systems=] that are supported and related information. If + proper origin protections are not provided this could include detection of sites that + have been visited and information stored for those sites. In particular, [=Key Systems=] + MUST not share key or other data between [=origins=].

    -
    -

    Information Leakage

    +

    + Information Leakage +

    -

    Concerns

    -

    CDMs, especially those implemented outside the user agent, may not have the same fundamental isolations as the web platform. - It is important that steps be taken to avoid information leakage, especially across origins. - This includes both in-memory and stored data. - Failure to do so could lead to information leakage to/from private browsing sessions, across [=browsing profiles=] (including across operating system user accounts) and even across different browsers or applications. +

    + Concerns +

    +

    + CDMs, especially those implemented outside the user agent, may not have the same + fundamental isolations as the web platform. It is important that steps be taken to + avoid information leakage, especially across origins. This includes both in-memory and + stored data. Failure to do so could lead to information leakage to/from private + browsing sessions, across [=browsing profiles=] (including across operating system user + accounts) and even across different browsers or applications.

    -

    Mitigations

    -

    To avoid such issues, user agent and [=CDM=] implementations MUST ensure that:

    +

    + Mitigations +

    +

    + To avoid such issues, user agent and [=CDM=] implementations MUST ensure that: +

      -

    • [=CDMs=] have a concept of a [=CDM=] instance that is associated one-to-one with a {{MediaKeys}} object.

      • -

    • Keys, licenses, other session data, and the presence of sessions are restricted to the [=CDM=] instance associated with the {{MediaKeys}} object that created the session.

      • -

    • Session data is not shared between {{MediaKeys}} objects or [=CDM=] instances.

    • - Session data is not shared with media elements not associated with the {{MediaKeys}} object that created the session. - Among other things, this means a session's keys MUST not be used to decrypt content loaded by a media element whose {{HTMLMediaElement/mediaKeys}} attribute is not that {{MediaKeys}} object. + [=CDMs=] have a concept of a [=CDM=] instance that is associated one-to-one with a + {{MediaKeys}} object. +

      +
      • +
    • +

      + Keys, licenses, other session data, and the presence of sessions are restricted to + the [=CDM=] instance associated with the {{MediaKeys}} object that created the + session. +

      +
      • +
    • +

      + Session data is not shared between {{MediaKeys}} objects or [=CDM=] instances. +

      +
      • +
    • +

      + Session data is not shared with media elements not associated with the + {{MediaKeys}} object that created the session. Among other things, this means a + session's keys MUST not be used to decrypt content loaded by a media element whose + {{HTMLMediaElement/mediaKeys}} attribute is not that {{MediaKeys}} object. +

      +
      • +
    • +

      + {{MediaKeys}} objects and the underlying implementation do not expose information + outside the [=origin=]. +

      +
      • +
    • +

      + Persisted session data, if applicable, is stored on a per-[=origin=] basis. +

      +
      • +
    • +

      + Only data stored by the requesting [=origin=] may be loaded.

      • -

    • {{MediaKeys}} objects and the underlying implementation do not expose information outside the [=origin=].

      • -

    • Persisted session data, if applicable, is stored on a per-[=origin=] basis.

      • -

    • Only data stored by the requesting [=origin=] may be loaded.

    • - It is not possible to extract, derive or infer information from the [=CDM=] that is not either explicitly described in this specification - or available to the page through other web platform APIs without user permission. This applies to any information that is exposed outside - the client device or to the application, including, for example, in [=CDM=] messages. + It is not possible to extract, derive or infer information from the [=CDM=] that is + not either explicitly described in this specification or available to the page + through other web platform APIs without user permission. This applies to any + information that is exposed outside the client device or to the application, + including, for example, in [=CDM=] messages.

      -

      The type of information covered by this requirement includes but is not limited to:

      +

      + The type of information covered by this requirement includes but is not limited + to: +

        -

      • Location, including geolocation

        • -

      • Credentials or identifiers other than [=Distinctive Identifiers=]

        • -

      • OS account name and other potential PII

        • -

      • Local directory paths, which may contain similar information.

        • -

      • Local network details (for example, the device's local IP address)

        • -

      • Local devices, including but not limited to Bluetooth, USB, and user media.

        • -

      • User state not associated with or stored as a result of the APIs defined in this specification.

        • +
      • +

        + Location, including geolocation +

        +
        • +
      • +

        + Credentials or identifiers other than [=Distinctive Identifiers=] +

        +
        • +
      • +

        + OS account name and other potential PII +

        +
        • +
      • +

        + Local directory paths, which may contain similar information. +

        +
        • +
      • +

        + Local network details (for example, the device's local IP address) +

        +
        • +
      • +

        + Local devices, including but not limited to Bluetooth, USB, and user media. +

        +
        • +
      • +

        + User state not associated with or stored as a result of the APIs defined in + this specification. +

        +
    -
    -

    User Tracking

    +

    + User Tracking +

    -

    Concerns

    -

    A third-party host (or any entity, such as an advertiser, capable of getting content distributed to multiple sites) could use a [=Distinctive Identifier=] or persistent data, including licenses, keys, key IDs, or - [=records of license destruction=], stored by or on behalf of the [=CDM=] to track a user across multiple sessions (including across [=origins=] and [=browsing profiles=]), building a profile of the user's activities or interests. Such tracking would undermine the privacy protections provided by the rest of the web platform and could, for example, enable highly-targeted advertising not otherwise possible. - In conjunction with a site that is aware of the user's real identity (for example, a content provider or e-commerce site that requires authenticated credentials), this could allow oppressive groups to target individuals with greater accuracy than in a world with purely anonymous web usage. +

    + Concerns +

    +

    + A third-party host (or any entity, such as an advertiser, capable of getting content + distributed to multiple sites) could use a [=Distinctive Identifier=] or persistent + data, including licenses, keys, key IDs, or [=records of license destruction=], stored + by or on behalf of the [=CDM=] to track a user across multiple sessions (including + across [=origins=] and [=browsing profiles=]), building a profile of the user's + activities or interests. Such tracking would undermine the privacy protections provided + by the rest of the web platform and could, for example, enable highly-targeted + advertising not otherwise possible. In conjunction with a site that is aware of the + user's real identity (for example, a content provider or e-commerce site that requires + authenticated credentials), this could allow oppressive groups to target individuals + with greater accuracy than in a world with purely anonymous web usage. +

    +

    + User- or client-specific information that could be obtained via implementations of the + APIs in this specification includes:

    - -

    User- or client-specific information that could be obtained via implementations of the APIs in this specification includes:

      -

    • [=Distinctive Identifier(s)=]

      • -

    • [=Distinctive Permanent Identifier(s)=]

      • -

    • Origins visited (via stored or in-memory data, permissions, etc.)

      • -

    • Content viewed (via stored or in-memory licenses, keys, key IDs, [=records of license destruction=], etc.)

      • +
    • +

      + [=Distinctive Identifier(s)=] +

      +
      • +
    • +

      + [=Distinctive Permanent Identifier(s)=] +

      +
      • +
    • +

      + Origins visited (via stored or in-memory data, permissions, etc.) +

      +
      • +
    • +

      + Content viewed (via stored or in-memory licenses, keys, key IDs, [=records of + license destruction=], etc.) +

      +
    -

    This specification presents a specific concern because such information is commonly stored outside the user agent (and associated [=browsing profile=] storage), often in the [=CDM=].

    - -

    Since the content of licenses and [=records of license destruction=] are [=Key System=]-specific and since key IDs may contain any value, these data items could be abused to store user-identifying information.

    - -

    [=Key Systems=] may access or create persistent or semi-persistent identifier(s) for a device or user of a device. - In some cases these identifiers may be bound to a specific device in a secure manner. - If these identifiers are present in [=Key System=] messages, then devices and/or users may be tracked. - If the mitigations below are not applied, this could include both tracking of users / devices over time and associating multiple users of a given device. +

    + This specification presents a specific concern because such information is commonly + stored outside the user agent (and associated [=browsing profile=] storage), often in + the [=CDM=]. +

    +

    + Since the content of licenses and [=records of license destruction=] are [=Key + System=]-specific and since key IDs may contain any value, these data items could be + abused to store user-identifying information. +

    +

    + [=Key Systems=] may access or create persistent or semi-persistent identifier(s) for a + device or user of a device. In some cases these identifiers may be bound to a specific + device in a secure manner. If these identifiers are present in [=Key System=] messages, + then devices and/or users may be tracked. If the mitigations below are not applied, + this could include both tracking of users / devices over time and associating multiple + users of a given device. +

    +

    + It is important to note that such identifiers, especially those that are non-clearable, + non-[=origin=]-specific, or [=permanent identifier|permanent=], exceed the tracking + impact of existing techniques such as cookies [[COOKIES]] or session identifiers + embedded in URLs. +

    +

    + If not mitigated, such tracking may take three forms depending on the design of the + [=Key System=]:

    - -

    It is important to note that such identifiers, especially those that are non-clearable, non-[=origin=]-specific, or [=permanent identifier|permanent=], exceed the tracking impact of existing techniques such as cookies [[COOKIES]] or session identifiers embedded in URLs.

    - -

    If not mitigated, such tracking may take three forms depending on the design of the [=Key System=]:

      -

    • In all cases, such identifiers are expected to be available to sites and/or servers that fully support the [=Key System=] (and thus can interpret [=Key System=] messages) enabling tracking by such sites.

      • -

    • If identifiers exposed by [=Key Systems=] are not origin-specific, then two sites and/or servers that fully support the [=Key System=] may collude to track the user.

      • -

    • If [=Key System=] messages contain information derived from a user identifier in a consistent manner, for example such that a portion of the initial [=Key System=] message for a specific content item does not change over time and is dependent on the user identifier, then this information could be used by any application to track the device or user over time.

      • +
    • +

      + In all cases, such identifiers are expected to be available to sites and/or servers + that fully support the [=Key System=] (and thus can interpret [=Key System=] + messages) enabling tracking by such sites. +

      +
      • +
    • +

      + If identifiers exposed by [=Key Systems=] are not origin-specific, then two sites + and/or servers that fully support the [=Key System=] may collude to track the user. +

      +
      • +
    • +

      + If [=Key System=] messages contain information derived from a user identifier in a + consistent manner, for example such that a portion of the initial [=Key System=] + message for a specific content item does not change over time and is dependent on + the user identifier, then this information could be used by any application to + track the device or user over time. +

      +
    - -

    In addition, if a [=Key System=] permits keys or other data to be stored and to be re-used between origins, then it may be possible for two origins to collude and track a unique user by recording their ability to access a common key.

    -

    Finally, if any user interface for user control of [=Key Systems=] presents data separately from data in HTTP session cookies [[COOKIES]] or persistent storage, then users are likely to modify site authorization or delete data in one and not the others. - This would allow sites to use the various features as redundant backup for each other, defeating a user's attempts to protect his or her privacy. +

    + In addition, if a [=Key System=] permits keys or other data to be stored and to be + re-used between origins, then it may be possible for two origins to collude and track a + unique user by recording their ability to access a common key.

    -

    - In addition to the potential for sites and other third-parties to track users, the user agent implementer, [=CDM=] vendor, or device vendor could build a profile of the user's activities or interests, such as sites using the APIs defined in this specification that the user visits. - Such tracking would undermine the privacy protections provided by the rest of the web platform, especially those related to isolation of origins. + Finally, if any user interface for user control of [=Key Systems=] presents data + separately from data in HTTP session cookies [[COOKIES]] or persistent storage, then + users are likely to modify site authorization or delete data in one and not the others. + This would allow sites to use the various features as redundant backup for each other, + defeating a user's attempts to protect his or her privacy.

    -

    - Identifiers, such as [=Distinctive Identifiers=], may be obtained from a server operated or provided by the [=CDM=] vendor, such as via an [=individualization=] process. - The process may include providing client identifier(s), including [=Distinctive Permanent Identifier(s)=], to the server. - In order to generate a per-origin identifier, a value representing the origin may also be provided. + In addition to the potential for sites and other third-parties to track users, the user + agent implementer, [=CDM=] vendor, or device vendor could build a profile of the user's + activities or interests, such as sites using the APIs defined in this specification + that the user visits. Such tracking would undermine the privacy protections provided by + the rest of the web platform, especially those related to isolation of origins. +

    +

    + Identifiers, such as [=Distinctive Identifiers=], may be obtained from a server + operated or provided by the [=CDM=] vendor, such as via an [=individualization=] + process. The process may include providing client identifier(s), including + [=Distinctive Permanent Identifier(s)=], to the server. In order to generate a + per-origin identifier, a value representing the origin may also be provided.

    -

    - In such an implementation, the [=CDM=] vendor may be able to track the activity of the user, such as number of origins visited or number of times a new identifier is required. - If the origin or a value [=associable=] with the origin is provided in the identifier request, the [=CDM=] vendor could track the sites visited by the user or user(s) of a device. + In such an implementation, the [=CDM=] vendor may be able to track the activity of the + user, such as number of origins visited or number of times a new identifier is + required. If the origin or a value [=associable=] with the origin is provided in the + identifier request, the [=CDM=] vendor could track the sites visited by the user or + user(s) of a device. +

    +

    + The following section describes techniques that may mitigate the risks of tracking + without user consent.

    -

    The following section describes techniques that may mitigate the risks of tracking without user consent.

    -

    Mitigations

    +

    + Mitigations +

    -
    Do not [=use Distinctive Identifier(s) or Distinctive Permanent Identifier(s)|use Distinctive Identifiers or Distinctive Permanent Identifiers=]
    +
    + Do not [=use Distinctive Identifier(s) or Distinctive Permanent Identifier(s)|use + Distinctive Identifiers or Distinctive Permanent Identifiers=] +
    -

    [=Key System=] implementations SHOULD avoid [=using Distinctive Identifier(s) or Distinctive Permanent Identifier(s)|using Distinctive Identifiers and Distinctive Permanent Identifiers=] whenever possible and only use them when they meaningfully contribute to the robustness of the implementation. - See Limit or Avoid use of Distinctive Identifiers and Permanent Identifiers. +

    + [=Key System=] implementations SHOULD avoid [=using Distinctive Identifier(s) or + Distinctive Permanent Identifier(s)|using Distinctive Identifiers and Distinctive + Permanent Identifiers=] whenever possible and only use them when they meaningfully + contribute to the robustness of the implementation. See Limit or + Avoid use of Distinctive Identifiers and Permanent Identifiers.

    - -
    Do not expose [=Distinctive Permanent Identifiers=] to the application
    +
    + Do not expose [=Distinctive Permanent Identifiers=] to the application +

    - Implementations MUST NOT expose [=Distinctive Permanent Identifiers=] to the application or origin. + Implementations MUST NOT expose [=Distinctive Permanent Identifiers=] to the + application or origin.

    - -
    Encrypt [=Distinctive Identifiers=]
    +
    + Encrypt [=Distinctive Identifiers=] +
    -

    [=Distinctive Identifiers=] in [=Key System=] messages MUST be encrypted, together with a timestamp or nonce, such that the [=Key System=] messages are always different. - This prevents the use of [=Key System=] messages for tracking except by servers fully supporting the [=Key System=]. - See Encrypt Identifiers. +

    + [=Distinctive Identifiers=] in [=Key System=] messages MUST be encrypted, together + with a timestamp or nonce, such that the [=Key System=] messages are always + different. This prevents the use of [=Key System=] messages for tracking except by + servers fully supporting the [=Key System=]. See Encrypt Identifiers.

    - -
    Treat [=Distinctive Identifiers=] and Key System stored data like cookies / web storage
    +
    + Treat [=Distinctive Identifiers=] and Key System stored data like cookies / web + storage +
    -

    User agents SHOULD present the presence of [=Distinctive Identifiers=] and data stored by [=Key Systems=] to the user in a way that associates them strongly with HTTP session cookies [[COOKIES]], including it in "remove all data", and presenting it in the same UI locations. - This might encourage users to view such identifiers with healthy suspicion. - User agents SHOULD help the user avoid Incomplete Clearing of Data. +

    + User agents SHOULD present the presence of [=Distinctive Identifiers=] and data + stored by [=Key Systems=] to the user in a way that associates them strongly with + HTTP session cookies [[COOKIES]], including it in "remove all data", and presenting + it in the same UI locations. This might encourage users to view such identifiers + with healthy suspicion. User agents SHOULD help the user avoid Incomplete Clearing of Data.

    - -
    Do not expose per-origin information to unrelated entities
    +
    + Do not expose per-origin information to unrelated entities +

    - Do not provide [=origin=](s) or values [=associable=] with origins to individualization servers or other entities not related to the origin. - Follow the requirements and recommendations in the [=Individualization=] section if such a process is used by the implementation. + Do not provide [=origin=](s) or values [=associable=] with origins to + individualization servers or other entities not related to the origin. Follow the + requirements and recommendations in the [=Individualization=] section if such a + process is used by the implementation.

    - -
    Use non-associable per-origin per-profile values and identifiers
    +
    + Use non-associable per-origin per-profile values and identifiers +

    - For all [=Distinctive Values=] exposed to the application, - implementations MUST use a different [=non-associable by applications=] value for each [=origin=] and [=browsing profile=]. - See . + For all [=Distinctive Values=] exposed to the application, implementations MUST use + a different [=non-associable by applications=] value for each [=origin=] and + [=browsing profile=]. See .

    - This is especially important for implementations that [=use Distinctive Identifier(s)=]. - See . + This is especially important for implementations that [=use Distinctive + Identifier(s)=]. See .

    - -
    Use origin-specific and browsing profile-specific [=Key System=] storage
    +
    + Use origin-specific and browsing profile-specific [=Key System=] storage +
    -

    Any data used by the [=CDM=] that might impact messages or behavior in an application- or license server-visible way MUST be partitioned by [=origin=] and [=browsing profile=] and MUST NOT leak to or from private browsing sessions. - This includes both in-memory and persisted data. - Specifically but not exhaustively, session data, licenses, keys, and per-origin identifiers MUST be partitioned per-[=origin=] and per-[=browsing profile=]. - See and . +

    + Any data used by the [=CDM=] that might impact messages or behavior in an + application- or license server-visible way MUST be partitioned by [=origin=] and + [=browsing profile=] and MUST NOT leak to or from private browsing sessions. This + includes both in-memory and persisted data. Specifically but not exhaustively, + session data, licenses, keys, and per-origin identifiers MUST be partitioned + per-[=origin=] and per-[=browsing profile=]. See and .

    - -
    Provide user deletion of persistent data, including [=Distinctive Identifiers=]
    +
    + Provide user deletion of persistent data, including [=Distinctive Identifiers=] +
    -

    User agents MUST provide users with the ability to clear any persistent data, including [=Distinctive Identifiers=], maintained by [=Key Systems=]. - See Allow Persistent Data to Be Cleared. +

    + User agents MUST provide users with the ability to clear any persistent data, + including [=Distinctive Identifiers=], maintained by [=Key Systems=]. See Allow Persistent Data to Be Cleared.

    - -
    Expire stored data
    +
    + Expire stored data +
    -

    User agents MAY, possibly in a manner configured by the user, automatically delete [=Distinctive Identifiers=] and/or other Key System data after a period of time.

    +

    + User agents MAY, possibly in a manner configured by the user, automatically delete + [=Distinctive Identifiers=] and/or other Key System data after a period of time. +

    -

    For example, a user agent could be configured to store such data as session-only storage, deleting the data once the user had closed all the browsing contexts that could access it.

    -

    This can restrict the ability of a site to track a user, as the site would then only be able to track the user across multiple sessions when the user authenticates with the site itself (e.g., by making a purchase or signing in to a service).

    -

    However, this can also put the user's access to content, especially purchased or rented content, at risk if the user does not fully understand the implications of such expiration.

    +

    + For example, a user agent could be configured to store such data as session-only + storage, deleting the data once the user had closed all the browsing contexts + that could access it. +

    +

    + This can restrict the ability of a site to track a user, as the site would then + only be able to track the user across multiple sessions when the user + authenticates with the site itself (e.g., by making a purchase or signing in to a + service). +

    +

    + However, this can also put the user's access to content, especially purchased or + rented content, at risk if the user does not fully understand the implications of + such expiration. +

    - -
    Block third-party access
    +
    + Block third-party access +
    -

    User agents MAY restrict access to [=Key Systems=] and/or features to scripts originating at the [=origin=] of the top-level [=Document=] of the browsing context. - For example, {{Navigator/requestMediaKeySystemAccess()}} may deny requests for certain configurations for pages from other origins running in iframes. +

    + User agents MAY restrict access to [=Key Systems=] and/or features to scripts + originating at the [=origin=] of the top-level [=Document=] of the browsing + context. For example, {{Navigator/requestMediaKeySystemAccess()}} may deny requests + for certain configurations for pages from other origins running in + iframes.

    - - +
    -

    User agents MUST ensure that users are fully informed and/or give explicit consent before [=using Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=]. +

    + User agents MUST ensure that users are fully informed and/or give explicit consent + before [=using Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=].

    -

    Such mechanisms MUST be per [=origin=] to avoid valid uses enabling subsequent malicious access and MUST be per [=browsing profile=]. +

    + Such mechanisms MUST be per [=origin=] to avoid valid uses enabling subsequent + malicious access and MUST be per [=browsing profile=].

    -

    The restriction of the APIs defined in this specification to secure contexts ensures that a network attacker cannot exploit permissions granted to an unauthenticated origin. - See abuse of persisted consent. +

    + The restriction of the APIs defined in this specification to secure contexts + ensures that a network attacker cannot exploit + permissions granted to an unauthenticated origin. See abuse of persisted consent.

    - -
    Provide user controls to disable [=Key Systems=] or [=Key System=] use of identifiers
    +
    + Provide user controls to disable [=Key Systems=] or [=Key System=] use of identifiers +
    -

    User Agents SHOULD provide users with a global control of whether a [=Key System=] is enabled and/or whether [=Key System=] [=use of Distinctive Identifier(s) or Distinctive Permanent Identifier(s)=] is enabled (if supported by the [=Key System=]). - User agents SHOULD help the user avoid Incomplete Clearing of Data. +

    + User Agents SHOULD provide users with a global control of whether a [=Key System=] + is enabled and/or whether [=Key System=] [=use of Distinctive Identifier(s) or + Distinctive Permanent Identifier(s)=] is enabled (if supported by the [=Key + System=]). User agents SHOULD help the user avoid Incomplete Clearing of Data.

    - -
    Require site-specific whitelisting of access to each [=Key System=]
    +
    + Require site-specific whitelisting of access to each [=Key System=] +
    -

    User agents MAY require the user to explicitly authorize access to each [=Key System=] - and/or certain features - before a site can use it. - User agents SHOULD enable users to revoke this authorization either temporarily or permanently. +

    + User agents MAY require the user to explicitly authorize access to each [=Key + System=] - and/or certain features - before a site can use it. User agents SHOULD + enable users to revoke this authorization either temporarily or permanently.

    - -
    Use shared blacklists
    +
    + Use shared blacklists +
    -

    User agents MAY allow users to share blacklists of [=origins=] and/or [=Key Systems=]. - This would allow communities to act together to protect their privacy. +

    + User agents MAY allow users to share blacklists of [=origins=] and/or [=Key + Systems=]. This would allow communities to act together to protect their privacy.

    - -

    While these suggestions prevent trivial use of the APIs defined in this specification for user tracking, they do not block it altogether. - Within a single origin, a site can continue to track the user during a session, and can then pass all this information to a third party along with any identifying information (names, credit card numbers, addresses) obtained by the site. - If a third party cooperates with multiple sites to obtain such information, and if identifiers are not unique per origin and profile, then a profile can still be created. +

    + While these suggestions prevent trivial use of the APIs defined in this specification + for user tracking, they do not block it altogether. Within a single origin, a site can + continue to track the user during a session, and can then pass all this information to + a third party along with any identifying information (names, credit card numbers, + addresses) obtained by the site. If a third party cooperates with multiple sites to + obtain such information, and if identifiers are not + unique per origin and profile, then a profile + can still be created.

    -
    -

    Information Stored on User Devices

    +

    + Information Stored on User Devices +

    -

    Concerns

    -

    [=Key Systems=] may store information on a user's device, or user agents may store information on behalf of Key Systems. - Potentially, this could reveal information about a user to another user of the same device, including potentially the [=origins=] that have used a particular [=Key System=] (i.e., sites visited) or even the content that has been decrypted using a [=Key System=]. +

    + Concerns +

    +

    + [=Key Systems=] may store information on a user's device, or user agents may store + information on behalf of Key Systems. Potentially, this could reveal information about + a user to another user of the same device, including potentially the [=origins=] that + have used a particular [=Key System=] (i.e., sites visited) or even the content that + has been decrypted using a [=Key System=]. +

    +

    + If information stored by one origin affects the operation of the [=Key System=] for + another origin, then potentially the sites visited or content viewed by a user on one + site may be revealed to another, potentially malicious, site. +

    +

    + If information stored for one [=browsing profile=] on the client device affects the + operation of the [=Key System=] for other [=browsing profiles=], or browsers, then + potentially the sites visited or content viewed in one may be revealed by or + correlatable with another [=browsing profile=], even including for different operating + system user accounts or browsers.

    -

    If information stored by one origin affects the operation of the [=Key System=] for another origin, then potentially the sites visited or content viewed by a user on one site may be revealed to another, potentially malicious, site.

    -

    If information stored for one [=browsing profile=] on the client device affects the operation of the [=Key System=] for other [=browsing profiles=], or browsers, then potentially the sites visited or content viewed in one may be revealed by or correlatable with another [=browsing profile=], even including for different operating system user accounts or browsers.

    -

    Mitigations

    -

    Requirements mitigating these concerns are defined in .

    +

    + Mitigations +

    +

    + Requirements mitigating these concerns are defined in . +

    -
    -

    Incomplete Clearing of Data

    +

    + Incomplete Clearing of Data +

    -

    Concerns

    -

    A user's attempts to protect his or her privacy by clearing [=Distinctive Identifiers=] and stored data and/or disabling a [=Key System=] may be defeated if all such data and functionality as well as cookies [[COOKIES]] and other site data are not cleared and/or disabled at the same time. - For example: +

    + Concerns +

    +

    + A user's attempts to protect his or her privacy by clearing [=Distinctive Identifiers=] + and stored data and/or disabling a [=Key System=] may be defeated if all such data and + functionality as well as cookies [[COOKIES]] and other site data are not cleared and/or + disabled at the same time. For example:

      -

    • If a user clears cookies or other persistent storage without also clearing [=Distinctive Identifiers=] and data stored by Key Systems, sites can defeat those attempts by using the various features as redundant backup for each other.

      • -

    • If a user clears [=Distinctive Identifiers=] without also clearing data stored by [=Key Systems=], including persistent sessions, as well as cookies and other persistent storage, sites can defeat those attempts by using the remaining data to associate the old and new identifiers.

      • -

    • If a user disables a [=Key System=], especially for a specific [=origin=], without also clearing cookies or other persistent storage, sites can defeat those attempts by using the remaining features.

      • -

    • If a user disables a [=Key System=], then later decide to enable the [=Key System=], without also clearing cookies or other persistent storage, [=Distinctive Identifiers=], and data stored by [=Key Systems=], sites may be able to associate data prior to the disabling with data and behavior after the [=Key System=] is re-enabled.

      • +
    • +

      + If a user clears cookies or other persistent storage without also clearing + [=Distinctive Identifiers=] and data stored by Key Systems, sites can defeat those + attempts by using the various features as redundant backup for each other. +

      +
      • +
    • +

      + If a user clears [=Distinctive Identifiers=] without also clearing data stored by + [=Key Systems=], including persistent sessions, as well as cookies and other + persistent storage, sites can defeat those attempts by using the remaining data to + associate the old and new identifiers. +

      +
      • +
    • +

      + If a user disables a [=Key System=], especially for a specific [=origin=], without + also clearing cookies or other persistent storage, sites can defeat those attempts + by using the remaining features. +

      +
      • +
    • +

      + If a user disables a [=Key System=], then later decide to enable the [=Key + System=], without also clearing cookies or other persistent storage, [=Distinctive + Identifiers=], and data stored by [=Key Systems=], sites may be able to associate + data prior to the disabling with data and behavior after the [=Key System=] is + re-enabled. +

      +
    -

    Mitigations

    -

    Recommendations mitigating these concerns are defined in .

    +

    + Mitigations +

    +

    + Recommendations mitigating these concerns are defined in . +

    -
    -

    Private Browsing Modes

    -

    User agents may support a mode (e.g., private browsing) of operation intended to preserve user anonymity and/or ensure records of browsing activity are not persisted on the client. - The privacy concerns discussed in previous sections may be especially concerning for users employing such modes. +

    + Private Browsing Modes +

    +

    + User agents may support a mode (e.g., private browsing) of operation intended to preserve + user anonymity and/or ensure records of browsing activity are not persisted on the + client. The privacy concerns discussed in previous sections may be especially concerning + for users employing such modes.

    -

    User agent implementers that support such mode(s) SHOULD carefully consider whether access to [=Key Systems=] should be disabled in these mode(s). - For example, such modes MAY prohibit creation of {{MediaKeySystemAccess}} objects that support or use {{MediaKeySystemConfiguration/persistentState}} or a {{MediaKeySystemConfiguration/distinctiveIdentifier}} (either as part of the [=CDM=] implementation or because the application indicated they were {{MediaKeysRequirement/"required"}}). - If implementations do not prohibit such creation, they SHOULD inform the user of the implications and potential consequences for the expected privacy properties of such modes before allowing their use. +

    + User agent implementers that support such mode(s) SHOULD carefully consider whether + access to [=Key Systems=] should be disabled in these mode(s). For example, such modes + MAY prohibit creation of {{MediaKeySystemAccess}} objects that support or use + {{MediaKeySystemConfiguration/persistentState}} or a + {{MediaKeySystemConfiguration/distinctiveIdentifier}} (either as part of the [=CDM=] + implementation or because the application indicated they were + {{MediaKeysRequirement/"required"}}). If implementations do not prohibit such creation, + they SHOULD inform the user of the implications and potential consequences for the + expected privacy properties of such modes before allowing their use.

    -
    -

    Secure Origin and Transport

    +

    + Secure Origin and Transport +

    +

    + The APIs defined in this specification are only supported on secure origins, protecting + information discussed in previous sections. Identifiers are additionally encrypted as + specified in Encrypt Identifiers. +

    +

    + Applications, including the servers they use, SHOULD use secure transport for all traffic + involving or containing data or messages from the [=CDM=], including but is not limited + to all data passed from {{message}} events and to {{MediaKeySession/update()}}. +

    - The APIs defined in this specification are only supported on secure origins, protecting information discussed in previous sections. - Identifiers are additionally encrypted as specified in Encrypt Identifiers. + All user agents MUST properly handle Mixed Content [[MIXED-CONTENT]] to avoid exposure to + insecure content or transport when the user agent or application wish to enforce secure + origin and transport.

    -

    Applications, including the servers they use, SHOULD use secure transport for all traffic involving or containing data or messages from the [=CDM=], including but is not limited to all data passed from {{message}} events and to {{MediaKeySession/update()}}.

    -

    All user agents MUST properly handle Mixed Content [[MIXED-CONTENT]] to avoid exposure to insecure content or transport when the user agent or application wish to enforce secure origin and transport.

    -
    -
    -
    -

    Examples

    -

    This section contains example solutions for various use cases using the proposed extensions. - These are not the only solutions to these use cases. - Video elements are used in the examples, but the same would apply to all media elements. - In some cases, such as using synchronous XHR, the examples are simplified to keep the focus on the extensions. +

    + Examples +

    +

    + This section contains example solutions for various use cases using the proposed + extensions. These are not the only solutions to these use cases. Video elements are used in + the examples, but the same would apply to all media elements. In some cases, such as using + synchronous XHR, the examples are simplified to keep the focus on the extensions.

    -
    -

    Source and Key Known at Page Load (Clear Key)

    -

    In this simple example, the source file and clear-text license are hard-coded in the page. - Only one session will ever be created.

    - +

    + Source and Key Known at Page Load (Clear Key) +

    +

    + In this simple example, the source file and clear-text license + are hard-coded in the page. Only one session will ever be created. + 

    <script>
   function onLoad() {
     var video = document.getElementById('video');
@@ -4453,14 +8811,17 @@ 
    Source and Key Known at Page Load (Clear Key)
    
 </body>
    -
    -

    Selecting a Supported Key System and Using Initialization Data from the "encrypted" Event

    -

    This example selects a supported [=Key System=] using the {{Navigator/requestMediaKeySystemAccess()}} method then uses - the [=Initialization Data=] from the [=HTMLMediaElement/media data=] to generate the license request and send it to the appropriate license server. - One of the supported key systems uses a serverCertificate, which is provided proactively. +

    + Selecting a Supported Key System and Using Initialization Data from the "encrypted" Event +

    +

    + This example selects a supported [=Key System=] using the + {{Navigator/requestMediaKeySystemAccess()}} method then uses the [=Initialization Data=] + from the [=HTMLMediaElement/media data=] to generate the license request and send it to + the appropriate license server. One of the supported key systems uses a + serverCertificate, which is provided proactively.

    - 
    <script>
   var licenseUrl;
   var serverCertificate;
@@ -4593,14 +8954,16 @@ 
    Selecting a Supported Key System and Using Initialization Data from the "enc
 <video autoplay onencrypted='handleInitData(event)'></video>
    -
    -

    Create MediaKeys Before Loading Media

    -

    Initialization is much simpler if encrypted events do not need to be handled during {{MediaKeys}} initialization. - This can be accomplished either by providing the [=Initialization Data=] in other ways or setting the source after the {{MediaKeys}} object has been created. - This example does the latter. +

    + Create MediaKeys Before Loading Media +

    +

    + Initialization is much simpler if encrypted events do not need to be handled during + {{MediaKeys}} initialization. This can be accomplished either by providing the + [=Initialization Data=] in other ways or setting the source after the {{MediaKeys}} + object has been created. This example does the latter.

    - 
    <script>
   var licenseUrl;
   var serverCertificate;
@@ -4632,12 +8995,18 @@ 
    Create MediaKeys Before Loading Media
    
 <video id="v" autoplay onencrypted='handleInitData(event)'></video>
    -
    -

    Using All Events

    -

    This is a more complete example showing all events being used.

    -

    Note that handleMessage() could be called multiple times, including in response to the {{MediaKeySession/update()}} call if multiple round trips are required and for any other reason the Key System might need to send a message.

    - +

    + Using All Events +

    +

    + This is a more complete example showing all events being used. +

    +

    + Note that handleMessage() could be called multiple times, including in + response to the {{MediaKeySession/update()}} call if multiple round trips are required + and for any other reason the Key System might need to send a message. + 

    <script>
   var licenseUrl;
   var serverCertificate;
@@ -4727,11 +9096,14 @@ 
    Using All Events
    
 <video id="v" autoplay onencrypted='handleInitData(event)'></video>
    -
    -

    Stored License

    -

    This example requests a persistent license for future use and stores it. It also provides functions for later retrieving the license and for destroying it.

    - +

    + Stored License +

    +

    + This example requests a persistent license for future use and stores it. It also provides + functions for later retrieving the license and for destroying it. + 

    <script>
   var licenseUrl;
   var serverCertificate;
@@ -4831,11 +9203,14 @@ 
    Stored License
    
 <video id='v' src='foo.webm' autoplay></video>
    -
    -

    Pre-fetch Media With HDCP Policy

    -

    If some media will have an HDCP policy in the license, an application can check for that version before pre-fetching.

    - +

    + Pre-fetch Media With HDCP Policy +

    +

    + If some media will have an HDCP policy in the license, an application can check for that + version before pre-fetching. + 

               const status = await video.mediaKeys.getStatusForPolicy({
             minHdcpVersion: '1.4'
@@ -4849,41 +9224,20 @@ 
    Pre-fetch Media With HDCP Policy
    -
    -

    Acknowledgments

    -

    The editors would like to thank - Aaron Colwell, - Alex Russell, - Anne van Kesteren, - Bob Lund, - Boris Zbarsky, - Chris Needham, - Chris Pearce, - David Singer, - Domenic Denicola, - Frank Galligan, - Glenn Adams, - Henri Sivonen, - Jer Noble, - Joe Steele, - Joey Parrish, - John Simmons, - Mark Vickers, - Pavel Pergamenshchik, - Philip Jägenstedt, - Pierre Lemieux, - Robert O'Callahan, - Ryan Sleevi, - Steve Heffernan, - Steven Robertson - Theresa O'Connor, - Thomás Inskip, - Travis Leithead, - and - Xiaohan Wang - for their contributions to this specification. Thank you also to the many others who contributed to the specification, including through their participation on the mailing list and in the issues. +

    + Acknowledgments +

    +

    + The editors would like to thank Aaron Colwell, Alex Russell, Anne van Kesteren, Bob Lund, + Boris Zbarsky, Chris Needham, Chris Pearce, David Singer, Domenic Denicola, Frank Galligan, + Glenn Adams, Henri Sivonen, Jer Noble, Joe Steele, Joey Parrish, John Simmons, Mark + Vickers, Pavel Pergamenshchik, Philip Jägenstedt, Pierre Lemieux, Robert O'Callahan, Ryan + Sleevi, Steve Heffernan, Steven Robertson Theresa O'Connor, Thomás Inskip, Travis Leithead, + and Xiaohan Wang for their contributions to this specification. Thank you also to the many + others who contributed to the specification, including through their participation on the + mailing list and in the issues.

    - +