Common Encryption (CENC)

CENC (ISO/IEC 23001-7) is the standard that lets one encrypted copy of a video work with multiple DRMs. Content is encrypted once with a content key, and per-DRM signaling lets Widevine, PlayReady, and FairPlay license servers each deliver that key to their own CDMs. It defines two cipher modes, CTR and CBCS.

What is CENC?

CENC (Common Encryption, ISO/IEC 23001-7) is the standard that lets a single encrypted copy of a video work with multiple DRM systems, instead of encrypting the file separately for each one.

How CENC Works

Content is encrypted once with a content key. The packaging then carries per-DRM signaling, called pssh boxes, so Widevine, PlayReady, and FairPlay license servers can each deliver that same key to their own Content Decryption Modules. This is what makes multi-DRM economical: one encode, many DRMs. CENC defines two cipher modes, CTR (the classic Widevine and PlayReady mode) and CBCS (required by FairPlay and now broadly supported), and CBCS is the basis of single-encode CMAF workflows.

Why CENC Matters

One encode, all DRMs: Avoids storing and delivering three separately encrypted copies.
CMAF efficiency: CBCS enables a single CMAF encode that serves both Apple and non-Apple devices.
Future-proofing: Adding PlayReady later reuses the same encrypted assets.

For Platform Owners

CENC is the plumbing behind any credible multi-DRM setup. You rarely configure it directly, but it is the reason a good provider can protect your library for Chrome, Safari, and smart TVs without tripling storage.