Encryption Error (Error 35)
ERROR
Encryption Error (Error 35) can happen in two cases:
On input: "Double encryption" error - source is enrypted Zixi push/pull, and there is encryption configuration on the input
On output: "No decryption key" error - input is encrypted Zixi push/pull, output expects clear data (UDP/RTP/RIST/SRT/ASI/RTMP/TCP...), and there is no decryption key defined.
Note: Mismatch in keys will not generate this error, payload will simply be corrupted. Since the is no assumption on payload structure, a mismatch on encryption key simply shows up as corrupted data.
RESOLUTION
In order to detect decryption key mismatch we recommend adding 3 counters on outputs:
- Number of corrupted compressed packets (a.k.a null-packet-optimization, although the name is misleading)
- Number of total compressed packets
- Number of non-TS packets, post-decryption
If counters 1 or 3 increase, and there is a decryption key defined - this is a strong indication of a wrong key. Corrupted compressed packets are a clear giveaway, especially if it happens to a high proportion of the compressed packets (counter 1 out of counter 2). Although compression is the default - it is not always enabled. In that case, when counters 1 and 2 are not growing, counter 3 can play a role.
Counter 3 can still increase when using non-TS payload, with compression disabled, and a correct static-key decryption, although this combination is a less likely scenario than simply a mismatch in keys.