CMSF supports content protection using Common Encryption [CENC] for CMAF-packaged media. This enables interoperability with existing DRM ecosystems by reusing the signaling model established by DASH [DASH] and the DASH-IF Encryption and Content Protection (ECCP) guidelines [DASHIF-ECCP].
Content protection in CMSF differs from the encryption scheme defined in [MSF] Section 4.3. While MSF defines an end-to-end encryption mechanism using MoQ Secure Objects for LOC-packaged content, CMSF uses ISO Common Encryption [CENC] applied at the CMAF media layer. In CMSF, the media samples within CMAF chunks are encrypted as specified by [CENC], and the DRM signaling is carried in the catalog rather than in per-object headers.
A key advantage of CENC-based content protection is that decryption can be delegated to a Content Decryption Module (CDM) operating at a deeper system level, potentially in hardware or a trusted execution environment. This enables robust content protection through commercial DRM systems such as Widevine, PlayReady, and FairPlay Streaming, where the decryption keys and decrypted media are handled within a secure pipeline that is not accessible to the application layer. This hardware-level protection is a requirement for high-value content distribution and is not achievable with application-layer encryption schemes alone.