Question

I am currently dealing with securing rtmp streams from Level3 CDN.

The documentation can be found here:
https://rapidshare.com/files/1450549534/Token_Components.html
(looks like you need to be logged in to view, therefore i re hosted on rapidshare. the original url is:
https://mediaportal.level3.com/mediaWeb/help/Content/ServicesDocs-Streaming/StreamingTokenAuth/TokenComponents.htm )

Scoll down to On Demand Streaming Input / Output Example ( For MP4 Files )

I am trying to reproduce the example and to get the same url with the same values. I wrote a little function for that:

function flimmithash($file) {
    $streamer = 'pmsales';
    $host = 'pmsalesfs.fplive.net'; 
    $start_time = '20080101120000'; 
    $end_time = '20101231235900'; 
    $customer_secret = 'Secret'; // in the documentation there is also secret with a non capital s, i tried both

    $resouce_path = "/$streamer/$file";                                                     echo "resouce_path: $resouce_path <br>\n";
    $message = "$resouce_path?start_time=$start_time&end_time=$end_time#$customer_secret";  echo "message: $message <br>\n";
    $digest = md5($message);                                                                echo "digest: $digest <br>\n";
    $tokenvalue = "start_time=$start_time&end_time=$end_time&digest=$digest";               echo "tokenvalue: $tokenvalue <br>\n";
    $token = base64_encode($tokenvalue);                                                    echo "token: $token <br>\n";
    $url = "rtmp://$host/$streamer?token=".($token)."/mp4:$file";                           echo "url: $url <br>\n";        
    return $url;
}
echo "url: ".flimmithash('support/lvlt300kbps.mp4')."<br>\n"; 

I use the exact same values as in the example but just cannot get the same digest.

I used md5, because it matches the length. I also tried secret with capital and non capital s.

You can go to sample scripts here: https://rapidshare.com/files/2581196874/Appendix.html (Original: https://mediaportal.level3.com/mediaWeb/help/Content/ServicesDocs-Streaming/StreamingTokenAuth/Appendix-SampleScripts.htm )

But there is absolutely no md5 used, they use sha1. But sha1 is longer then the digest from the example.

Of course I tried to populate both versions with my values, but neither worked.

So my question is: Can anybody reproduce the example and/or tell me the digest or alter my function to work according to the example?

Answer 1

Their example is incorrect. The digest they give is for the file /support/lvlt300kbps.flv and can easily be generated with md5 for that filename, using the lowercase secret as the shared secret. You can see it’s identical to the digest given in the FLV example just above it in their documentation.