[Bug] ISA uses a different KID than the default_KID mentioned in the mpd file

[cralin]

Describe the problem

Hi,

I have a Raspberry Pi4 running Kodi 22 (the LibreELEC (community): nightly-20260105-c4ca2ce image) and while trying to play a Widevine encrypted stream the audio is played correctly but the image on the screen is black.

At the same time in kodi.log there are multiple error <inputstream.adaptive>: Decrypt Sample returns failure! messages.

After enabling the debug logging and trying to play the stream again, in the kodi.log the following lines are visible:

2026-01-05 23:52:53.442 T:1013    debug <inputstream.adaptive>: LogDecryptError: Decrypt failed with error code: 2 and KID: 3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3b
2026-01-05 23:52:53.442 T:1013    error <inputstream.adaptive>: Decrypt Sample returns failure!

I've checked the downloaded mpd file and the same 3C3C3C3C-3C3C-3C3C-3C3C-3C3C3C3C3C3C is listed as default_KID for both audio and video.

To my understanding, the following lines in the kodi log shows that KID 3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C is valid while the KID 3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3B is not

2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: [WV-CDM-Library] OnSessionKeysChange: KID 3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C31, Status: 1, System code: 5
2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: CDM message: type 3 arrived
2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: [WV-CDM-Library] OnSessionKeysChange: KID 3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C32, Status: 1, System code: 5
2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: CDM message: type 3 arrived
2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: [WV-CDM-Library] OnSessionKeysChange: KID 3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3A, Status: 0, System code: 0
2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: CDM message: type 3 arrived
2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: [WV-CDM-Library] OnSessionKeysChange: KID 3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3B, Status: 1, System code: 5
2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: CDM message: type 3 arrived
2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: [WV-CDM-Library] OnSessionKeysChange: KID 3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C, Status: 0, System code: 0
2026-01-05 23:52:53.002 T:1013    debug <inputstream.adaptive>: CDM message: type 3 arrived
2026-01-05 23:52:53.021 T:1013    debug <inputstream.adaptive>: License update successful

This would explain the error message "Decrypt failed with error code: 2 and KID: 3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3b", however (at least for me) it does not explain why the the 3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3b is used instead of the 3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c mentioned in the mpd file.

I can only assume that the usage of the KID: 3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3b to decrypt the stream is probably related to a bug since this KID is not mentioned in the mpd file and it looks like it is marked as invalid in the response from the license server.

Possible fix

No response

Steps to reproduce

No response

Debug log

kodi.log with debug logging enabled: kodi.log

Stream manifest file(s)

Stream manifest file: manifest_1767653571.txt

Zip archive containing the .challenge, .init, .request and .response files: EDEF8BA9-79D6-4ACE-A3C8-27DCD51D21ED.zip

Additional info

No response

Operating system(s)

Linux

Operating system version(s)

LibreELEC (community): nightly-20260105-c4ca2ce

InputStream Adaptive version(s)

inputstream.adaptive v22.3.6.1

Kodi version(s)

Kodi 22

[CastagnaIT]

i can suspect that the mp4 files provide a default KID that differs from the manifest one
please manually download and attach here a mp4 segment downloaded by ISA just before that the first LogDecryptError error happens
for example:

2026-01-05 23:52:53.267 T:1021 debug : CurlFile::Open - https://edgetm05.rcs-rds.ro/V7-VVQ5YVRlYU54YlRmV3hGb0ZPWENZNTlFUmp3WnRZQnVKRFU5VEFCZ0RwMzQvb1R2dG9GV2FLcHZ5Nlk1cHBMWSsrS1l6MzBDSnhVRk42YmNQN0NIdW9zWW1pcjloUmdOTGwvL3N1REV2MG5obVBTSC91QUxxR01hY0VhV1FETWtwQTJqVHlJZUFTeHUycUpjZlN2RThSZkJLbTBoMTVYbldldmYyekNrN2kyUFpXMHRHdnlxbnlwR2ZOZ3hTNkh6RVFGelM2SlFhL2pGcVI2S0F4TjdtWmM3M3c9PQ==-YzNhZDNjN2EwMTQ1YjJjNQ==/dash1iptv/axnhdcenc2/axnhd_hd_1080p_307364763472.m4v

so i can try to verify whether this theory is correct

[cralin]

The axnhd_hd_1080p_307364763472.m4v was is no longer available for download so I've triggered the play again just to get the names of more actual files.

I've downloaded 2 chunks and the axnhd_hd_1080p_init.m4v.
video_chunks.zip

Here is the kodi.log from today: kodi.log

[CastagnaIT]

so i confirm
the MPD provide a KID that dont exists on initialization segment
MPD: 3c3c3c3c-3c3c-3c3c-3c3c-3c3c3c3c3c3c
MP4: 3c3c3c3c-3c3c-3c3c-3c3c-3c3c3c3c3c3b

both point to a different default KID value
i need to do more investigations to figure out how to do it

[CastagnaIT]

It seems that this is due to website packagers having bugs, which provide conflicting data

Despite the MPD DASH specifications seem to say to initially refer to the values provided by MPD, which is what ISA does until today,
other players seem to do the opposite (which would also make sense for managing key rotation)
so the PSSH/KID provided with the segments should take precedence over the one provided by the MPD manifest

Before considering extensive code changes to change ISA behavior,
which could take more time (weeks or more) let's try this fast solution,
which requires adding a new property to the add-on you are using, and use a patched ISA build

i cant provide you a ISA test build for LibreELEC
but if you are able to build by yourself the code changes are onPR: #1975

steps are:

1. if you are able to build by yourself ISA, you can using PR Implement "ignore_drminfo" parameter to "manifest_config" property #1975
   Otherwise if you can test over any other operative system, here you can download some ISA test builds already done: https://jenkins.kodi.tv/blue/organizations/jenkins/xbmc%2Finputstream.adaptive/detail/PR-1975/1/artifacts
2. modify your python addon, by adding the following property:
   listitem.setProperty('inputstream.adaptive.manifest_config', '{"ignore_drminfo":true}')
   where you have the "play" callback code
3. if the property is set correctly, you will see the following lines printed on log:
   debug <inputstream.adaptive>: DRM::CDRMEngine::ExtractStreamProtectionData: Parse MP4 protection data from stream

this way WV should be initialized with the KID of init segment, so the decryption should match

[cralin]

I was about to suggest the same thing (a flag that could be set as configuration parameter that would signal ISA to use the KID from the MPD and if it is not set the ISA would behave by default as it does today).

I'll test with the listitem.setProperty('inputstream.adaptive.manifest_config', '{"ignore_drminfo":true}') property set in the addon code.

[CastagnaIT]

as said above i cant provide you a LibreELEC build
but you can try download ARM64 test articact for linux
https://github.com/xbmc/inputstream.adaptive/actions/runs/20819861252?pr=1975
most of time works anyway, in the worst case ISA does not start

its double zipped so you need extract once time

[cralin]

I've installed on the existing LibreELEC setup the content from inputstream.adaptive_linux_ARM64.zip archive, added the listitem.setProperty('inputstream.adaptive.manifest_config', '{"ignore_drminfo":true}')to the addon code, restarted the RPI and then tried to play the stream.

The audio still plays correctly but the screen is still black (before the sound start it changes to a deeper black color).

Now there are a lot of <inputstream.adaptive>: DecryptAndDecodeVideo: Returned CDM status "kNoKey" for KID: 3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3b entries in the log

kodi.log

[CastagnaIT]

so ignore_drminfo cannot be useful for your case
i will see to make changes to force use MPD protection data as specified on dash specs

[CastagnaIT]

just for test try this build
https://github.com/xbmc/inputstream.adaptive/actions/runs/20857682473?pr=1977
It's not a fix, it's just to check if playback works before making changes

[cralin]

Stream plays corectly (both audio and video) with the inputstream.adaptive_linux_ARM64.zip taken from the link you mentioned.

kodi.log

[cralin]

it would be great if the fix could also be backported at least to Kodi 21