CrypTrack Element Semantics

*   `trackID` or `ID`: specifies the track ID to encrypt. If not set, this crypt configuration applies to all tracks for which no `CrypTrack` with a `trackID` is specified.
*   `type`: is the protection scheme type used for this track. If not set, use the type specified at `GPACDRM` level. Syntax is the same as type at `GPACDRM` level.
*   `forceType`: if set, `type` is used during decryption instead of scheme type information indicated in encrypted track.
*   `IsEncrypted` : is the flag which indicates the encryption state of the samples in this track. Default is 1.
*   `IV_size` : is the size in bytes of the Initialization Vector. It should be 0 (if track is not encrypted i.e the IsEncrypted flag is 0x0), 8 or 16. When not set, guessed from the size of the `first_IV` attribute. If `cbcs` mode is used, this attribute is equivalent to `constant_IV_size`.
*   `first_IV` : is the first Initialization Vector used for this track. If the scheme type uses constant IV and `constant_IV` attribute is not present, this will be used as constant IV. When set, this must describe an 8 or 16 byte key. If `cbcs` mode is used, this attribute is equivalent to `constant_IV`.

*   `selectiveType` : specifies how selective encryption is to be used. The possible values are:
    *   **None** : no selective encryption, all samples encrypted (this is the default behavior).
    *   **Clear**: samples are not encrypted but track is signaled as using encryption and sample group seig is used.
    *   ForceClear[=N]**: samples are not encrypted, track is signaled as using encryption but no sample groups are used. If `N` is set, only leaves the first N samples in the clear and switch to regular encryption after. If N is 0, all samples are encrypted. If N is -1, no samples are encrypted.
    *   **RAP** : only Random Access Samples (key frames) will be encrypted. If all media samples are RAPs, this defaults to `None`.
    *   **Non-RAP** : only non-Random Access Samples (non-key frames) will be encrypted. If all media samples are RAPs, this defaults to `None`.
    *   **Rand** : random selection of samples to encrypt is performed.
    *   **X** : encrypts the first sample every `X` samples. `X` must be an integer greater than 2.
    *   **RandX** : encrypts one random samples out of `X` samples. `X` must be an integer greater than 2.
*   `saiSavedBox` : type of the box where we save the CENC sample auxiliary information. The possible values are:
    *   **uuid\_psec** : box type 'uuid', extend-type = 0xA2394F52-5A9B-4f14-A244-6C427C648DF4, according to The Protected Interoperable File Format (PIFF) specification of Microsoft.
    *   **senc** : box type 'senc', according to HbbTV 1.5 and CFF 1.0.5 specifications. This is the default value.
*   `keyRoll` : key selection policy and key rolling configuration. Common Encryption allows groups of samples within the track to use different keys. The encryption parameters (i.e KID, initialization vector size and encryption flag) are contained in a 'SampleGroupDescriptionBox' and will override the default parameters for this track. The first key is assigned to the first set of samples, and key index is incremented based on the roll type and roll number `N`, and rolls back to 0 if greater than number of defined keys. If roll number `N` is not set or is 0, value 1 is assumed. The possible values are:
    *   **idx=N** : use only key whose index is N (zero-based index) for encrypting this track. By default, the first key (N=0) is used.
    *   **samp[=N]** or **roll[=N]** :  roll keys at every `N` samples.
    *   **rap[=N]** : roll keys at every N packets of SAP type 1 or 2 (closed gop) for streams having SAPs, do not roll key for others (all-intra, audio, ...)
    *   **seg[=N]** : roll keys every N DASH/HLS segment. Input must use segment boundary signaling.
    *   **period[=N]** : roll keys every N DASH periods. Input must use segment boundary signaling.
*   `skip_byte_block` : number of 16-bytes blocks in the clear at the beginning of the encryption pattern. When not set and the scheme type uses pattern (cens, cbcs), a value of 9 is assumed for NAL-based tracks and 0 for other tracks.
*   `crypt_byte_block` : number of 16-bytes blocks encrypted at the beginning of the encryption pattern. When not set and the scheme type uses pattern (cens, cbcs), a value of 1 is assumed.
*   `byte_offset` : number of bytes to leave in the clear (defaut: auto) at the begining of each NALU/OBU/etc. The final value will be at least the slice header size.
*   `constant_IV_size` : size of constant IV used in pattern encryption mode. When not set, guessed from the size of the `constant_IV` attribute.
*   `constant_IV` : constant IV used for all samples in cbcs pattern encryption mode. If `IV_size` is set, constant IV is ignored and each sample has a dedicated IV.  If the scheme type does not use constant IV and `first_IV` attribute is not present, this will be used as the first IV.
*   `encryptSliceHeader`: enables old behavior for cenc scheme for AVC in avc1 mode, for which slice headers (and other nal such as SEI) can be encrypted.
*   `clear_bytes`: number of bytes to leave in the clear for non NAL-based tracks. Only used in cbcs mode.
*   `blockAlign`: for 'cenc' scheme, enforces block alignment (multiple of 16 bytes) for encrypted part of subsamples to avoid partial cipher blocks at the end of subsamples. The possible values are:
    *   **always**: always perform block alignment, even if resulting sample is not encrypted
    *   **disable**: never perform block alignment
    *   **default**: performs block alignment unless the resulting sample would not be encrypted. This is the default behaviour.

*   `clearStsd`: indicates if a non-protected sample entry shall be used for non-protected samples. The possible values are:
    *   **none**: no additional sample entry is used (default)
    *   **before**: a clear sample entry is used for non-protected sample, declared before the protected sample entry in `stsd` box
    *   **after**: a clear sample entry is used for non-protected sample, declared after the protected sample entry in `stsd` box

*   `subsamples` : allows selective encryption of subsamples. This can take one or more options, separated by a semi-colon:
    *   **subs=a,b,c** : encrypt only VCL subsample with the given indices. (Note: we use 1-based index)
    *   **rand[=N]** : select a subsample for encryption if rand() % N is 0 (default N is 2)

*   `multikey` : enables multi key per samples. When multi-key is enabled, `keyRoll` is ignored and all defined keys are used for multikey. Possible values are:
    *   **on**, **all** : encrypt using multi key per sample (one per subsample), rotating keys at each VCL NAL / video OBU. (Note: we use 1-based index)
    *   **no** : do not use multi key (default)
    *   **roll[=N]** : use multi-key and roll the key every N VCL NAL / video OBU (a value of 0 disable key roll, using a single key for each subsample)
    *   **subs=a,b,c** : use indicated key index per VCL NAL/OBU. Value 0 means leave VCL unencrypted. If more subsamples than keys, remaining subsamples are left unencrypted

*   `random` : generates random number for IV, keys and KIDs, typically used together with `DRMInfoTemplate`. If set to `true` or `yes`, all key definitions are ignored.