Frequently Asked Questions

What does the KDM workflow look like with the easyDCP KDM Generator(+)?

easyDCP Creator+ generates a proprietary DCP digest file along with each encrypted DCP. This digest file contains all encrypted track files’ keys. Whenever you want to generate KDMs, you can load this digest file into easyDCP KDM Generator(+). easyDCP KDM Generator (basic edition) is included in each purchase of easyDCP Creator+. All you need to do is collect your recipients’ public server certificates and put them into a local folder. Use only the “cert.sha256” files. Usually, they have either a *.crt or *.pem suffix. In easyDCP KDM Generator, you merely need to load the digest file, point to the folder with the server certificates and specify the start and end dates of the KDMs’ validity period. Upon clicking the “Generate KDM!” button, easyDCP KDM Generator(+) will create KDMs for all server certificates in a single job. Note, that a digest file may contain multiple compositions, but a KDM only ever contains keys for a single composition. Thus, easyDCP KDM Generator(+) will create <number of compositions in digest file> x <number of server certificates in folder> KDMs. Using the full version of easyDCP Player+, you can test the whole procedure by issuing a KDM to your easyDCP Player+’s public server certificate. By the way, this procedure is the same when you want to issue a Distribution KDM (DKDM) for your client’s mastering station.

The demo version of easyDCP KDM Generator(+) is restricted in that it only generates KDMs with a maximum validity of 48 hours, starting from the time when the KDM is generated.

Where can I get the server certificates needed to create KDMs?

This is different in every country. We can’t send you the certificates. The best way is asking the cinema owner directly. They should either have the certificates of the projection system in their screening rooms themselves or tell you the model and serial number. If they give you the model and serial number, you need to contact the manufacturer and ask for access to their database. This is often a password protected ftp server. We can’t give you the access details. For now, it is a good idea to maintain your own personal collection of certificates so you do not need to repeat this procedure for every job.

Why are there so many public certificates for a single cinema server?

Usually, on the cinema server manufacturers’ ftp servers you can find both the public server certificate and the signature chain that was used to sign the certificate. If you decide to trust the certificate by examining the signature certificate chain, you only need the server certificate to create a KDM. It has either a *.pem or *.crt suffix. easyDCP KDM Generator(+) will accept either, but do not use both. Furthermore, there will be pairs of certificate and chain that state “mpeg”, “sha1” and “sha256”. Like with DCPs, there are SMPTE and InterOp KDMs. Almost all modern servers prefer SMPTE KDMs. It is recommended to use the “Auto-detect” conformity option in order to infer the conformity from the targeted public server certificate (i.e. SMPTE for “sha256” certificates and InterOp for „sha1“ certificates).

Only if you know your recipient only accepts InterOp KDMs, use the “sha1” certificate.

ow can I generate my own digital signature to sign my DCPs or KDMs?

Digital signatures are used to authenticate content. You can sign both DCPs and KDMs. For customers of easyDCP KDM Generator(+) we offer to generate signature chains for free.

We would only need to know your URL (without www), which is stated within the signature, e.g. “fraunhofer.de”. Refer to chapter 5 for a guide on how to import the certificate chain.

We would only need to know your URL (without www), which is stated within the signature, e.g. “fraunhofer.de”. Refer to chapter 5 for a guide on how to import the certificate chain.

A Distribution KDM is technically identical to a regular KDM. The difference is that it targets another mastering station instead of a cinema server. A scenario would be if a post production house is contracted to add subtitles to a finished DCP. The supplier would send a copy of the encrypted DCP and issue a DKDM to the post production house’s mastering station, enabling them to decrypt and alter the DCP. You can generate a DKDM with easyDCP KDM Generator(+). The procedure is identical to generating a regular KDM.

Can easyDCP KDM Generator issue new KDMs based on a DKDM?

Yes, but only easyDCP KDM Generator+ can. Please refer to chapter Distribution KDM