Mnemonica DCP KDMs
Learn how DKDMs and KDM deliveries work in Mnemonica, who can do what, and where to download the Mnemonica distribution certificate.
- Projects
- Archive
- Roles
- ManagerOperatorPower GuestGuest
- Updated
Mnemonica includes an integrated KDM management system. Distributors and exhibitors use it to handle the entire key delivery workflow in the platform: from the upload of master keys to the generation and distribution of device-specific KDMs to cinema projectors.
The system has two modules that work in sequence. First, Managers upload a DKDM (Distribution KDM) for each encrypted DCP. The DKDM authorizes the platform to generate keys. Then any authorized user can create a KDM delivery: select the content, the target projector certificates and the validity window, and send the delivery to a recipient.
A role-based approval workflow keeps sensitive key deliveries in the right channels. Managers can issue KDMs directly. Operators and Power Guests submit requests, and a Manager reviews each request before Mnemonica generates the key. Guests cannot create or request a KDM. They see the KDM module only when someone sends them a KDM delivery, and then they can download the KDM.
If you are new to KDM management, start with DKDM management to make sure your content is ready. Then continue with Deliver a KDM if you are a Manager, or Request a KDM if you are an Operator, a Power Guest or a Guest.
Mnemonica KDM download
Mnemonica can create KDMs only for DCPs mastered with the Mnemonica distribution certificate. If you master a DCP with a different certificate, its DKDM does not work in Mnemonica.
Download the Mnemonica distribution certificate to use in your mastering system. The certificate is in PEM format.
Download the Mnemonica distribution certificate
Guides
- DKDM Management: for Managers. Learn how to upload, view, download and delete the master keys (DKDMs) that enable KDM generation for encrypted DCPs. Read the DKDM management guide.
- Deliver a KDM: for Managers. Learn how to register projector certificates, create KDM deliveries and approve or reject requests. Read the Deliver a KDM guide.
- Request a KDM: for Operators, Power Guests and Guests. Learn how to request a KDM, follow the request until a Manager approves it, and download the KDMs sent to you. Read the Request a KDM guide.
How the two modules relate
DKDMs and KDMs work in a clear sequence. A DKDM is a master key that the content provider supplies and the distributor holds. It never leaves the platform, and Mnemonica never sends it to cinemas. It only authorizes Mnemonica to derive device-specific KDMs. Mnemonica generates each KDM for a specific projector certificate and a specific validity window, and delivers it to the recipient cinema.
If a CPL does not appear in the KDM creation wizard, the DKDM is almost always missing for that asset. Before you start a KDM delivery, verify that the DKDM is available.
Role overview
| Role | DKDM Management | KDM Creation | Approval Authority |
|---|---|---|---|
| Manager | Full access | Direct (no approval needed) | Yes |
| Operator | No access | Request (requires approval) | No |
| Power Guest | No access | Request (requires approval) | No |
| Guest | No access | Cannot create or request a KDM | No |
Roles are assigned for each Project. A user can have different roles in different Projects.
Glossary
| Term | Definition |
|---|---|
| KDM | Key Delivery Message: a cryptographic key that unlocks encrypted cinema content on a specific device for a specific time |
| DCP | Digital Cinema Package: the encrypted film content delivered to cinemas |
| CPL | Composition Playlist: a specific version of the content (language, audio, subtitles) |
| DKDM | Distribution KDM: a master key held by the distributor, used to generate device-specific KDMs |
| Certificate | A DCI/SMPTE X.509 file (.pem) that identifies one cinema projector |
| DN Qualifier | Distinguished Name Qualifier: a unique hash that identifies one certificate in the DCI trust chain |
| Validity Period | The time window in which a KDM allows playback |
| Delivery | One KDM distribution: one CPL, one or more certificates and a validity window, sent to a recipient |