{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/", "item": { "id": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/", "slug": "choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group", "url": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group.md", "json": "https://update.dsesecurity.com/api/v1/posts/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/" }, "title": "Choose one encryption key mode for an Axis CMAF recording group", "summary": "Axis Recording Group encryption is limited to CMAF and requires one key mode. Verify the fixed-key or rotating-key design and decryption path before using it for retained evidence.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "physical-security", "label": "Physical security", "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.", "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "video-surveillance", "name": "Video Surveillance", "url": "https://update.dsesecurity.com/topic/video-surveillance/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-29T00:10:26+00:00", "modified_at": "2026-10-29T00:10:34+00:00", "reviewed_on": "2026-10-28", "reading_minutes": 3, "word_count": 508, "potentially_affected": "Axis devices exposing the documented Recording group API interface; confirm support and the installed API/software scope before applying the proposed checks.", "dse_recommendation": "DSE recommends approving the write and read sides together before enabling recording-group encryption.", "primary_source": { "name": "Axis Communications — Recording group API", "url": "https://developer.axis.com/vapix/device-configuration/recording-group/", "published_on": null, "authority": "Axis Communications" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Bottom line: Choose one documented recording-group encryption mode, and prove authorized decryption before committing important recordings to that design.

\n

Source fact: documented behavior

\n

The Recording group API documentation states that only recording groups using the cmaf container format can be encrypted.

\n

It requires either encryption.contentEncryption or encryption.keyEncryption; setting neither or both is invalid when the encryption field is supplied.

\n

For the fixed-key mode, the key and key identifier must be agreed by the encryption and decryption sides beforehand because they are not communicated back.

\n

What the source does not establish

\n

Do not treat a successful recording-group configuration as proof of usable recovery. Keep this decision specific to recording-group encryption rather than SD-card formatting or a general encryption claim. Confirm exact device support, approved key handling and the intended reader’s documented capabilities. Do not infer certification, acceptable cryptographic policy or compatibility from the presence of an encryption option.

\n

Applicability questions

\n\n

DSE recommendation: controlled next steps

\n

The following steps are DSE recommendations based on the cited source.

\n

DSE recommends approving the write and read sides together before enabling recording-group encryption.

\n
    \n
  1. Prepare a configuration review for a representative noncritical recording group. Record the proposed container, chosen key mode and intended decryption consumer. Mark the alternative mode as deliberately unused so a later configuration merge cannot accidentally combine both. Have the integration owner compare the actual settings with the exact documented field contract.
    2. \n
  2. Use disposable recording content to rehearse the chosen mode. For a fixed-key proposal, arrange approved transfer or escrow of the required key and identifier without placing either secret material or full recovery instructions in an ordinary ticket. Ask a different authorized operator to follow the agreed recovery process and document whether the test recording can be retrieved and read.
    3. \n
  3. Define the failed-recovery response before extending the configuration. If the receiving side cannot identify or use the required material, keep important recordings on the accepted workflow while the design is corrected. Review changes to the decryption consumer and key-management process as changes to the recording system, rather than assuming an unchanged camera configuration ends the review.
    4. \n
\n

Verification and evidence

\n

Retain sanitized group settings, the selected-mode decision, official support references and the disposable recording’s identity. Store evidence of the authorized recovery exercise without exposing keys. Record who performed the read-side check and which consumer version was used.

\n

For the proposed acceptance cases, review an invalid combined-mode configuration on paper or a safe test fixture, then verify the approved single-mode configuration. Do not deliberately jeopardize required recordings to demonstrate an error. No encryption implementation, interoperability result or recovery performance is claimed by this article.

\n

Official references

\n\n

Source review completed October 28, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings.

\n", "content_text": "Bottom line: Choose one documented recording-group encryption mode, and prove authorized decryption before committing important recordings to that design.\nSource fact: documented behavior\nThe Recording group API documentation states that only recording groups using the cmaf container format can be encrypted.\nIt requires either encryption.contentEncryption or encryption.keyEncryption; setting neither or both is invalid when the encryption field is supplied.\nFor the fixed-key mode, the key and key identifier must be agreed by the encryption and decryption sides beforehand because they are not communicated back.\nWhat the source does not establish\nDo not treat a successful recording-group configuration as proof of usable recovery. Keep this decision specific to recording-group encryption rather than SD-card formatting or a general encryption claim. Confirm exact device support, approved key handling and the intended reader’s documented capabilities. Do not infer certification, acceptable cryptographic policy or compatibility from the presence of an encryption option.\nApplicability questions\n\nWhich recording-group container and encryption mode does the design require?\nWho controls the key material and its association with the key identifier?\nWhich authorized tool or integration will decrypt the retained recordings?\nCan a second authorized operator recover a disposable test recording using the documented process?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends approving the write and read sides together before enabling recording-group encryption.\n\nPrepare a configuration review for a representative noncritical recording group. Record the proposed container, chosen key mode and intended decryption consumer. Mark the alternative mode as deliberately unused so a later configuration merge cannot accidentally combine both. Have the integration owner compare the actual settings with the exact documented field contract.\nUse disposable recording content to rehearse the chosen mode. For a fixed-key proposal, arrange approved transfer or escrow of the required key and identifier without placing either secret material or full recovery instructions in an ordinary ticket. Ask a different authorized operator to follow the agreed recovery process and document whether the test recording can be retrieved and read.\nDefine the failed-recovery response before extending the configuration. If the receiving side cannot identify or use the required material, keep important recordings on the accepted workflow while the design is corrected. Review changes to the decryption consumer and key-management process as changes to the recording system, rather than assuming an unchanged camera configuration ends the review.\n\nVerification and evidence\nRetain sanitized group settings, the selected-mode decision, official support references and the disposable recording’s identity. Store evidence of the authorized recovery exercise without exposing keys. Record who performed the read-side check and which consumer version was used.\nFor the proposed acceptance cases, review an invalid combined-mode configuration on paper or a safe test fixture, then verify the approved single-mode configuration. Do not deliberately jeopardize required recordings to demonstrate an error. No encryption implementation, interoperability result or recovery performance is claimed by this article.\nOfficial references\n\nRecording group API — Axis Communications; official VAPIX documentation.\n\nSource review completed October 28, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings.", "content_markdown": "Bottom line: Choose one documented recording-group encryption mode, and prove authorized decryption before committing important recordings to that design.\n\n## Source fact: documented behavior\n\nThe [Recording group API](https://developer.axis.com/vapix/device-configuration/recording-group/) documentation states that only recording groups using the cmaf container format can be encrypted.\n\nIt requires either encryption.contentEncryption or encryption.keyEncryption; setting neither or both is invalid when the encryption field is supplied.\n\nFor the fixed-key mode, the key and key identifier must be agreed by the encryption and decryption sides beforehand because they are not communicated back.\n\n## What the source does not establish\n\nDo not treat a successful recording-group configuration as proof of usable recovery. Keep this decision specific to recording-group encryption rather than SD-card formatting or a general encryption claim. Confirm exact device support, approved key handling and the intended reader’s documented capabilities. Do not infer certification, acceptable cryptographic policy or compatibility from the presence of an encryption option.\n\n## Applicability questions\n\n- Which recording-group container and encryption mode does the design require?\n\n- Who controls the key material and its association with the key identifier?\n\n- Which authorized tool or integration will decrypt the retained recordings?\n\n- Can a second authorized operator recover a disposable test recording using the documented process?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends approving the write and read sides together before enabling recording-group encryption.\n\n- Prepare a configuration review for a representative noncritical recording group. Record the proposed container, chosen key mode and intended decryption consumer. Mark the alternative mode as deliberately unused so a later configuration merge cannot accidentally combine both. Have the integration owner compare the actual settings with the exact documented field contract.\n\n- Use disposable recording content to rehearse the chosen mode. For a fixed-key proposal, arrange approved transfer or escrow of the required key and identifier without placing either secret material or full recovery instructions in an ordinary ticket. Ask a different authorized operator to follow the agreed recovery process and document whether the test recording can be retrieved and read.\n\n- Define the failed-recovery response before extending the configuration. If the receiving side cannot identify or use the required material, keep important recordings on the accepted workflow while the design is corrected. Review changes to the decryption consumer and key-management process as changes to the recording system, rather than assuming an unchanged camera configuration ends the review.\n\n## Verification and evidence\n\nRetain sanitized group settings, the selected-mode decision, official support references and the disposable recording’s identity. Store evidence of the authorized recovery exercise without exposing keys. Record who performed the read-side check and which consumer version was used.\n\nFor the proposed acceptance cases, review an invalid combined-mode configuration on paper or a safe test fixture, then verify the approved single-mode configuration. Do not deliberately jeopardize required recordings to demonstrate an error. No encryption implementation, interoperability result or recovery performance is claimed by this article.\n\n## Official references\n\n- [Recording group API](https://developer.axis.com/vapix/device-configuration/recording-group/) — Axis Communications; official VAPIX documentation.\n\nSource review completed October 28, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/", "url": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-28" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Choose one encryption key mode for an Axis CMAF recording group", "item": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/#article", "identifier": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/", "url": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/", "headline": "Choose one encryption key mode for an Axis CMAF recording group", "description": "Axis Recording Group encryption is limited to CMAF and requires one key mode.", "abstract": "Axis Recording Group encryption is limited to CMAF and requires one key mode. Verify the fixed-key or rotating-key design and decryption path before using it for retained evidence.", "articleBody": "Bottom line: Choose one documented recording-group encryption mode, and prove authorized decryption before committing important recordings to that design.\nSource fact: documented behavior\nThe Recording group API documentation states that only recording groups using the cmaf container format can be encrypted.\nIt requires either encryption.contentEncryption or encryption.keyEncryption; setting neither or both is invalid when the encryption field is supplied.\nFor the fixed-key mode, the key and key identifier must be agreed by the encryption and decryption sides beforehand because they are not communicated back.\nWhat the source does not establish\nDo not treat a successful recording-group configuration as proof of usable recovery. Keep this decision specific to recording-group encryption rather than SD-card formatting or a general encryption claim. Confirm exact device support, approved key handling and the intended reader’s documented capabilities. Do not infer certification, acceptable cryptographic policy or compatibility from the presence of an encryption option.\nApplicability questions\n\nWhich recording-group container and encryption mode does the design require?\nWho controls the key material and its association with the key identifier?\nWhich authorized tool or integration will decrypt the retained recordings?\nCan a second authorized operator recover a disposable test recording using the documented process?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends approving the write and read sides together before enabling recording-group encryption.\n\nPrepare a configuration review for a representative noncritical recording group. Record the proposed container, chosen key mode and intended decryption consumer. Mark the alternative mode as deliberately unused so a later configuration merge cannot accidentally combine both. Have the integration owner compare the actual settings with the exact documented field contract.\nUse disposable recording content to rehearse the chosen mode. For a fixed-key proposal, arrange approved transfer or escrow of the required key and identifier without placing either secret material or full recovery instructions in an ordinary ticket. Ask a different authorized operator to follow the agreed recovery process and document whether the test recording can be retrieved and read.\nDefine the failed-recovery response before extending the configuration. If the receiving side cannot identify or use the required material, keep important recordings on the accepted workflow while the design is corrected. Review changes to the decryption consumer and key-management process as changes to the recording system, rather than assuming an unchanged camera configuration ends the review.\n\nVerification and evidence\nRetain sanitized group settings, the selected-mode decision, official support references and the disposable recording’s identity. Store evidence of the authorized recovery exercise without exposing keys. Record who performed the read-side check and which consumer version was used.\nFor the proposed acceptance cases, review an invalid combined-mode configuration on paper or a safe test fixture, then verify the approved single-mode configuration. Do not deliberately jeopardize required recordings to demonstrate an error. No encryption implementation, interoperability result or recovery performance is claimed by this article.\nOfficial references\n\nRecording group API — Axis Communications; official VAPIX documentation.\n\nSource review completed October 28, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings.", "datePublished": "2026-10-29T00:10:26+00:00", "dateModified": "2026-10-29T00:10:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/choose-one-encryption-key-mode-for-an-axis-cmaf-recording-group/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose one encryption key mode for an Axis CMAF recording group" }, "articleSection": [ "Cybersecurity", "Video Surveillance" ], "keywords": [ "Cybersecurity", "Video Surveillance", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Video Surveillance", "url": "https://update.dsesecurity.com/topic/video-surveillance/" } ], "wordCount": 508, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Axis Communications — Recording group API", "url": "https://developer.axis.com/vapix/device-configuration/recording-group/" } } ] } }