MOQT uses secure transports that provide confidentiality and integrity protection. However, media objects are accessible to relays, and are subject to both intentional and accidental modification, unless they are additionally end-to-end protected.
The media objects transported by MOQT in various tracks from various original publishers are subject to several considerations. The first is source authenticity, i.e. to know that the received media objects are what the original publisher actually published. In addition to the media objects, it can also be important to authenticate some Track and Object Properties. For example, timestamps are crucial to understand where on the timeline this media fragment belongs.
The second aspect is content confidentiality. Beyond direct relay access to media objects, object sizes and traffic patterns enable analysis of content. Track namespace and track name can also be analyzed and correlated between end subscribers by relays.
Consistent with the principle of confidential operation by default, publishers can apply end-to-end object encryption, for example using Secure Objects ([I-D.ietf-moq-secure-objects]), so that relays retain access only to the metadata required for forwarding. Such end-to-end security mechanisms are external to this specification and additionally provide source authenticity. MOQT's object model enables both the object data and Object Properties to be confidentiality and integrity protected, or integrity protected only.
Secure key distribution for end-to-end encryption is specific to the encryption system and deployment, and outside the scope of this document.