Widevine: what it is, DRM and security levels explained

What is Widevine?

Widevine is a proprietary DRM technology acquired by Google in 2010 and has become the de facto standard for protecting video content in the Android ecosystem. It is used by major streaming services, including Netflix, Amazon Prime Video, Disney+, and Hulu, to prevent unauthorized copying and distribution of content.

Widevine supports AES-128 CBC encryption using content keys that are transmitted only to authorized devices through a secure licensing channel. The system provides end-to-end protection from encryption on the server to decoding on the user's device.

History and development of Widevine

Widevine Technologies was founded in 1999 and originally developed solutions for content protection on cable television platforms. After being acquired by Google in 2010, the technology was adapted for mobile platforms and integrated into the Android OS starting with version 4.4 KitKat. Since 2015, Widevine has been a mandatory component of Google Mobile Services certification.

In 2018, Google introduced Widevine Modular DRM, which allowed device manufacturers to implement different protection levels in hardware without modifying the OS code. Today, Widevine Modular is supported on over 4 billion devices and is the primary DRM mechanism on Android.

Widevine architecture

The Widevine architecture consists of three key components: the Content Decryption Module (CDM), the license server, and the content encryption tool. CDM performs decryption on the client side and interacts with the hardware Trusted Execution Environment (TEE) for secure key storage.

The Google license server manages key issuance based on content provider policies, which define restrictions on time, number of devices, and playback quality. The encryption tool prepares content on the provider side, packaging it into MPEG-DASH or HLS format with CENC encryption.

How does Widevine DRM work?

The protection process begins at the content packaging stage, when the media file is encrypted using a content key on the provider's server. The encrypted stream is transmitted to the user's device via CDN, where the CDM requests a license from the license server.

The license server verifies the device authenticity and the right to access the content. If the check passes, the server issues a license with a key that the CDM uses for decryption. The license may contain restrictions on viewing time and resolution.

License exchange protocol

License exchange in Widevine is implemented through the EME (Encrypted Media Extensions) protocol in browsers or via SDK on mobile platforms. The license request is generated by the CDM and sent to the license server over HTTPS, ensuring protection against key interception in transit.

The server processes the request and returns a license that is also encrypted and can only be decrypted by the device's CDM. Hardware binding of the key to a specific device prevents its transfer to other platforms.

Encryption standards support

Widevine uses Common Encryption (CENC) standards defined in ISO/IEC 23001-7, ensuring compatibility with MPEG-DASH and HLS formats. AES-128 encryption in CTR or CBC mode is used to protect media streams.

For key derivation, HKDF (HMAC-based Key Derivation Function) is used, allowing the generation of unique keys for each content segment. HLS support in Widevine was added with Modular version 2.0, expanding compatibility with Apple platforms.

License request example on Android

@Throws
fun requestLicense(): ByteArray {
    val drmSessionManager = mediaDrm.createSession(
        sessionId,
        List("keyRequestType", "init")
    )
    val request = mediaDrm.getKeyRequest(
        sessionId,
        schemeData.get("mimeType"),
        KeyType.STREAMING,
        mutableMapOf()
    )
    return licenseService.acquire(request.data)
}

Widevine security levels: L1, L2, L3

Widevine defines three security levels that differ in the way cryptographic operations are performed and content is processed. Level L1 provides maximum protection, L3 provides minimum protection, and L2 occupies an intermediate position.

Level L1 — hardware encryption

Level L1 requires a Trusted Execution Environment (TEE) at the hardware level, where all cryptographic operations are performed. Content keys never leave the TEE, preventing their extraction even if the main OS is compromised.

Devices with L1 certification can play content in 4K quality and HDR, as the decrypted video stream is sent directly to a protected video output without access from user processes.

Level L3 — software encryption

Level L3 performs all cryptographic operations in software within the normal user space. This is the least secure mode, where keys can be extracted from the device's RAM.

Widevine L3 limits playback quality to 720p, making it suitable for viewing on low-end devices or desktop browsers without hardware protection.

Checking the security level on a device

fun getSecurityLevel(): String {
    val mediaDrm = MediaDrm(UUID.fromString(
        "edef8ba9-79d6-4ace-a3c8-27dcd51d21ed"
    ))
    val level = mediaDrm.getPropertyString(
        "securityLevel"
    )
    return level.ifEmpty { "L3" }
}

Integrating Widevine into mobile applications

Widevine integration into mobile applications is done through standard MediaDrm (Android) and AVContentKeySession (iOS) APIs. In most cases, the developer does not need to work directly with DRM — player libraries such as ExoPlayer and AVPlayer handle licensing automatically.

Integration on Android

On Android, Widevine is integrated through the MediaDrm class, which provides direct access to the CDM. For streaming applications, it is recommended to use ExoPlayer with the DrmSessionManager module, which automatically manages license requests.

When initializing the player, you need to specify the Widevine scheme UUID (`edef8ba9-79d6-4ace-a3c8-27dcd51d21ed`) and the license server URL provided by the content provider. ExoPlayer handles the license request and renewal cycle automatically.

ExoPlayer configuration for Widevine

val drmLicenseUrl = "https://license.service.com/wv"
val mediaItem = MediaItem.Builder()
    .setUri(Uri.parse(streamUrl))
    .setDrmKeyRequestUrl(drmLicenseUrl)
    .setDrmKeyRequestHeaders(
        mapOf("Authorization" to token)
    )
    .build()

val exoPlayer = ExoPlayer.Builder(context)
    .build()
exoPlayer.setMediaItem(mediaItem)
exoPlayer.prepare()

Integration with web players

On web platforms, Widevine works through Media Source Extensions (MSE) and Encrypted Media Extensions (EME). Chromium-based browsers have Widevine CDM built-in, and the developer just needs to initialize an EME session with the correct configuration.

To use Widevine in a browser, you need to specify a license initiator with the keySystem type `com.widevine.alpha`. After creating a MediaKeys instance, the browser automatically handles license requests.

Handling licensing errors

When integrating Widevine, it is important to correctly handle licensing errors that occur due to lack of access rights, subscription expiration, or device incompatibility. TYPE_EXPIRED_LICENSE error requires updating the license through a re-request to the server, while TYPE_OUTPUT_NOT_ALLOWED indicates incompatibility of the video output with DRM policies.

It is recommended to implement a retry mechanism with exponential backoff for temporary network errors and show the user a clear message for permanent licensing failures. DRM session error logging helps content providers identify device issues and optimize policies.

Widevine and alternative DRM

Widevine competes with Apple's FairPlay and Microsoft's PlayReady, forming the three main DRM solutions on the mobile platform market. Each technology has its own advantages and limitations related to the platform ecosystem.

DRM solution comparison

Choosing a DRM for a project

DRM selection depends on the target platforms of the application. For Android-first projects, Widevine is the natural choice as it comes pre-installed on all certified devices with Google Mobile Services and requires no additional license fees.

For cross-platform projects, a multi-DRM approach is often used with license aggregators such as Axinom, EZDRM, and Vualto, which provide a unified API for working with all three DRM systems. This reduces integration complexity and centralizes license management.