[Solved] How to decrypt the clearkey?

[adidaz]

The keys are encrypted with the public key in response and will be decrypted with the private key in a JavaScript.




=================Original question:=========================

Hey all! I have a problem in getting the correct key for the mpeg-dash video.
When I requested for the key, I got the following response.

{
"keys": [
{
"kty": "oct",
"k": "h3UnWMdLy79X8yC1KUBSE4srDrY79XrZplsuX-rY2ajpmbwkCdK_CaXOdD3bMLM_oGI8Go_1EGtjZ_l70TXovhp1 dAD2xHk4yUbcMCODk-EKNYLby5s_EN3R-632EAaedwFxBLULpc_Oz2tARdjec7KOBl-7GTlAQEQLrSuRVxB4mLEW09XQP55McMKPOGFcnFkEbnJt0eBjg al1a1LgV5q-SbXZakDfWwkdsHllFUw85OaGpvFMO_9kujGCGqHRJ5m-_FS--0lTAPWKdQQsXyxjwOU_nXcDiCNZaimuVm1ic1UR4l1ImEIFA9H 2vHAenDpZKACS0Oq4gfWjbtjjvA",
"kid": "QsryRWXvMhWZyJJnSQa8uw"
},
{
"kty": "oct",
"k": "P2NinRG9RBapRoVyBL1ev-rUOsyqZp066xj3KMtrz7TpH3ifiAbjyKudAjpBHwf5Yx00WqiP ZP_wgKCUAPVWNA6SddqjITHTzDg7q54QIc8KxhH_oj_IMx7FyY QU7Ks_G52iZkg9u7jgcA83ZLUDLjJX_qhKKUjJha3kejlhUMi6 _Y3HMkJ_m3_eyu0y-QD8OLAdFD80EigpDDKiY9SNwMGBSvb2RvVuJoKF6dx1AcTqO4z uPYJteFKtQmUFoObrFccUZlcMZJSfqhPdZTQtHZOXWuuKYsA_H 64ixxIlI0nPKTAd6yXLtkFs6W8rgAo6HhMIUYR-dNwzHkFoLcODWA",
"kid": "QsryRWXvMhWZyJJnSQa8vA"
},
{
"kty": "oct",
"k": "cumSAebt1_Y861TnZpR9IVuCf0LmRf352PVHVUW0_KF67EqKJ w0Xtu58r7EeU1ZuA49LQ2A7Cwm8OMDeq-n4-g5EllpB9WBQYHfbbN0o1duHmVriIBJDMScQ1nC9D_Kopsw8NdH zdstFFOk-BJYYojeSrTwQTS_r29J3STkxXzz3HVZkTK8gF8wGK0UZ24SwQ5 wt08JKRR724nGS5Fku6xTTf6ksIsZdFxBuyCMpUEzOPYRQd06J 9eDqt-T41nxlRKBLXGzzLXIIqqGHRx5FW0boWJF1mRdTsg1DdUI05qJe ati74b5KlHAhd1wceAaVZ9CEi8TpFDM4JrCGpc27_w",
"kid": "QsryRWXvMhWZyJJnSQa8vQ"
},
{
"kty": "oct",
"k": "d4_feP0G5xaB6R2f3KHaKuQm06u7A57mCSaHtrnAjXUG8_Axp 90whXw3DHMPjZt7-e6QiFEDcM-07r8ai8oUrCoCgsyPCrAvO1a8eGpAXe__FzGDHotXNOVukU_hL 5ksdfkYSHwiH7w1_jxn_p1Uo2j_2HM2SNaX7UN3b0vqG6cbae4 0FoTW8bxP0Kq56Aska1GCZNCrHP5HIeMaHTolUCRgDR464uvIG SpnmH2Hqna1Hgk-tgZxO2p39De_pCTsJJrgB60WYcHSCoZ4bMJB2lGj0Dn6kSte6S DnA12KlQsZDkg9xsouoPqyl98mrD8hgfMgRobrnbPhL0orNPSE 9g",
"kid": "QsryRWXvMhWZyJJnSQa8vg"
}
],
"type": "temporary"
}


The value of "k" seems to be encrypted. Does anybody know how to decrypt it?
Thanks!

[kenyard]

Most likely it's a result of aes or hmac encoding.
Not enough info to give better answer.

[zackmark29]

That might be a required param for another request.
Try to check if there's another license request which required that info

[adidaz]

Thank you both. Here is the follow-up.

The 'k' values in the response seems changed from time to time. And it is confirmed that there is no more request related to the key.

However, I found that the POST data in the request contains something called 'spki'. So it is reasonable to conclude that the 'k' values are actually encrypted by something. The question is if it is possible to decrypt the plaintext of the key from 'spki'.

======================== REQUEST =======================
{
"kids": [
"QsryRWXvMhWZyJJnSQa8uw",
"QsryRWXvMhWZyJJnSQa8vA",
"QsryRWXvMhWZyJJnSQa8vQ",
"QsryRWXvMhWZyJJnSQa8vg",
"AAAAAAAAAAAAAAAAAAAAAA",
"eyJ2IjoiMiIsImZpZCI6Ig",
"aF8xMTAwaHpnZDAwMTY0Ig",
"LCJwbCI6ImV5SndhV1FpTw",
"aUpvWHpFeE1EQm9lbWRrTQ",
"REF4TmpRaUxDSmtaV3hwZA",
"bVZ5ZVY5MGVYQmxJam9pYw",
"M1FpZlEiLCJzdmlkIjoiZA",
"aWdpdGFsIiwiY3MiOiIxOQ",
"ODQ3MjY2OGZlZmNhYTBiNw",
"MjYzZTRkNjkyZjNiMDkifQ"
],
"type": "temporary",
"spki": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtrssB FmKI3y40Lnh2WVWGHb3qJKzgC2GRRY_75MxRO63CI92BribiGg tP-i8QxjpoHzopqFhGYWZfDuZNc-mO57XYOwIZpFCg6IwGh0f5VeiPMv4dxR82NYHnhWkMAyVeDEH0 QuUzJGi8haiqMf7mcqiDsfZpCdiqrQyaX_sNX1uGrSk71I0Ttc r2rDwgNxKixjAaF5TA1o1OwjZQChABVNdmx_kye8pHE-Nna2dQ_3sJGeXrdOQUCQIZPNArrW8lFTqGLROkq8rUV6QzUKTX ReC04mJvQajiuO4nijw8KRQlq744n9bQFRmUzrXe85zuD9EKbE BfIFg7LOsDtnfLQIDAQAB"
}



===================== RESPONSE ======================
{
"keys": [
{
"kty": "oct",
"k": "fxCoEvpbdmtqVE-PAN3hjT8YrfpyxBmQFHgQyRN7kPkV8N2zfLr3ewPuWLcjSioKb 7TWr6O75dKNQczu9o7J8cutUbOcmxKOSwxR2S6QCHYgSA0glCr zBJFRwrEUHWitam9yqM81PIJF-XZCaajTYo_n1NkaA39qS44Mopq4mVakIxihBq-1wn35XSrNQBj3AshphPJ0rhYQ7-y57jOreIJNwC16wIITK_f9j7gzhpmjcEw20o-I_gZNviG3ToWL5dB4VV7dUsQKJ2ynwRhrnHJCFj2CzXHIL0kZe 7_0KqSiFBwmH5mEy-L7s71A9isBT4JIHPr3XvKxKXXJmCLaDg",
"kid": "QsryRWXvMhWZyJJnSQa8uw"
},
{
"kty": "oct",
"k": "DrWe2MQeNyWNCCTfqDXAD3ffoR6oC7UIgf9pOBII6AxU5EBEM nPkbzFHu63Y9gucSw6R5Zd_QS55wbjyIT4f6thoA-ourYg5zV3YTgOPlm7kBtLxKh522h9tRxoaGZwK1iFk1ys96Gs8 BtpFQDV7XZiFDNBGKYT7p6owp5lIvEnoRdpSrkBhyZqtfvN6if 4t39zHV8qZ94Xw1j079aNThZonrkS0TBlmL3v_WujIzp9m-T636DYsjxjjWZ964iBjAamK3nKzlcL79cFoBI_ESTe9fRYnqIb c6EvjV6ENsP_EE0JiFzuA5LlmUOCpi5H-djrNlVeYce_v05KsuNoQJA",
"kid": "QsryRWXvMhWZyJJnSQa8vA"
},
{
"kty": "oct",
"k": "T1fd5JG_OcGDU0OycR_PThudX0hgFlXmMHDgQ8vOMVx0XTE_I ulD6eITOZ_tAubNB0l6QJ7GXqJCj8N3CezcGsdTLF6t0et-F9RiuX34sp-1lVOJjhbp0OQ2Y-hVhnT1vOSIbP8pd7IZTxzgUqXVOde1LKTUFSkUDC4eQ1QdlVNr-9ah1_uZxczQAVOtAgD5SNElHdzJtN4a78Wat_2OiRP6zfkw05a Yy2uG0GJkXF3gxDdAlFVgXW_X4nfUz6p6D0zefkGJTRP_QlEVV 8twD5um4B6Pp9ZUNEezHhs6BPq7W3iTZr4TbseQO07_n25QZuk s_zKmUYsVZPNy47jHrA",
"kid": "QsryRWXvMhWZyJJnSQa8vQ"
},
{
"kty": "oct",
"k": "qOBDiUsZovqPcv6Z0wSB69FtfB4OU5gTu9fia6MYZtqye w-yRwnEzDhYkLFmbqkBC2uoQPVfP42IDVeLuRvRQZr5CuIxCCFtH XJSk39ZSI6F2oOrQjKLGwE28lu5w7cMeBvJ8gXPUEj7LmjIu1R WFpAo54eXn6npww_BmDrKU_-CmBJ2woAY1uOZlXrPetQmCeDAZ3_Cq0jD9rPvdYTumpvYR7q44 8q8xRF12luNMByEaW64TSESFALcgRLSmZD8912X-N23hOaoOEtHUT8fcv4f3ZJ2bpQqLTiuqH0YgCxX_5yftQEh788 KpOkkrlmQBodMhm2r4pjEQSKDcfHI7g",
"kid": "QsryRWXvMhWZyJJnSQa8vg"
}
],
"type": "temporary"
}