[SecureObjects] defines a comprehensive framework for end-to-end encryption of MOQT objects. When using Secure Objects with LOC, the following considerations apply:
3.1.1. Key Identification
The Secure Object Key ID property (type 0x2 in [SecureObjects]) MUST be included as an immutable property to identify the keying material used for encryption. This property is authenticated but not encrypted, allowing relays to forward objects without decryption while ensuring subscribers can identify the correct decryption key.
3.1.2. Immutable Properties
LOC Properties that should be immutable but visible to relays SHOULD be encoded as Immutable Properties as defined in [MoQTransport] to ensure they cannot be modified by relays and are included in the authenticated associated data (AAD) during encryption. This specification does not define any Immutable Properties, but other specifications may define some for use with LOC.
3.1.3. Private Properties for Sensitive Metadata
Some LOC metadata may be sensitive and should not be visible to relays. [SecureObjects] defines a Private properties mechanism (type 0xA) that allows metadata to be encrypted alongside the payload.
The following LOC properties MAY be carried as Private properties when end-to-end confidentiality is required:
-
Timestamp and Timescale - reveals timing information about the source
-
Audio Level - reveals voice activity and audio characteristics
-
Video Frame Marking - reveals encoding structure details
-
Video Config - reveals encoding configuration details
When using Private properties:
-
The LOC property is encoded as a key-value pair within the Private properties payload
-
The Private properties are concatenated with the media payload before encryption
-
Upon decryption, the receiver extracts the Private properties and reconstructs the LOC metadata
This approach allows sensitive metadata to remain confidential from relays while still being available to authorized end subscribers.
3.1.4. Cipher Suite Requirements
Implementations using LOC with Secure Objects MUST support the AES_128_GCM_SHA256_128 cipher suite (0x0004). Other cipher suites defined in [SecureObjects] MAY be used based on application requirements for authentication tag size versus bandwidth overhead.
3.1.5. AAD Construction
The authenticated associated data (AAD) for AEAD encryption includes:
-
Key ID
-
Group ID and Object ID
-
Track namespace and name
-
Serialized immutable properties
This binding ensures objects cannot be replayed across different tracks or contexts.