Encrypted or Unencrypted: Which DCP a Festival Actually Needs

Encryption Is the Exception, Not the Default

Most filmmakers who ask us whether to encrypt their festival DCP are really asking a different question: which choice looks more professional. The honest answer is that it's not the filmmaker's call to begin with. It's whatever the festival's tech spec says, and for the overwhelming majority of festival slots, the spec says leave it unencrypted. There are two paths a DCP can take out the door — unencrypted, playable on any compliant server the moment it loads, or encrypted, locked behind a Key Delivery Message that has to be generated, targeted, and delivered on its own schedule. Picking the wrong one doesn't just cost you a delivery headache. It can cost the screening.

What Encryption Actually Locks Down

The AES + RSA layer

When a DCP is encrypted, the distributor encrypts the picture and sound media (MXF) files with AES to stop unauthorized access. Those AES keys can't be handed out directly — that would defeat the point — so the AES keys are themselves wrapped in 2048-bit RSA, tied to the unique public/private key pair burned into a specific cinema server's secure hardware. The private half never leaves the server.

The KDM as a scoped key

A Key Delivery Message is the thing that actually unlocks playback: an XML file containing the RSA-encrypted AES keys, decryptable only inside the one server it was generated for. KDMs also carry their own validity window — the server won't play the content outside that date/time range, which is how a rental agreement gets technically enforced rather than just contractually promised. That precision is exactly what makes a KDM fragile under festival conditions, where server assignments change and screening times shift by a day.

Why Most Programmers Ask You Not to Encrypt

Sundance's published technical spec for festival presentation permits either format but states its preference plainly: submissions may come in encrypted or unencrypted, and the festival strongly prefers unencrypted. DCP mastering houses see the same pattern from the other side. Encryption gets treated as a supplementary service, added only when a specific festival or distributor requests a secure DCP — not as a default step in the workflow. That preference isn't arbitrary caution, either. A programmer running a multi-screen, multi-day schedule with volunteer projectionists doesn't want a KDM validity window as one more thing that can silently expire between the tech check and the house lights actually going down. It's one more variable stacked on top of an already long deliverable list most festivals hand filmmakers before a submission ever ships.

What tips a festival toward requiring it

Encryption earns its complexity back for titles that genuinely need the rental-window enforcement — a pre-release cut playing ahead of a distribution date, say, or a market screening where the rights holder needs the technical guarantee that the file can't play a day early or a week late. For a standard festival competition slot, that guarantee is rarely the point.

If a Festival Does Require It, the DKDM Comes First

When a festival does mandate encryption, the clock that matters isn't the DCP delivery deadline. It's the DKDM deadline, and it comes earlier. Sundance's process is a useful model: the distributor-held master key (the DKDM) has to reach the festival's lab partner, Deluxe, before that lab can issue the venue-specific KDMs each cinema server needs. Miss that handoff and the DCP itself can arrive on time while every server in the building still sits locked. Worth confirming this step alongside everything else on a DCP house's checklist before you commit to a vendor — ask directly whether they handle DKDM routing or expect you to manage it yourself.

Common KDM failure points

The failure modes are mundane and they repeat across festivals: a KDM generated against the wrong server certificate, a validity window that expired before the actual screening time, a timezone miscalculation (daylight saving is a frequent culprit). The fix is procedural, not technical — request keys valid from a day or two before the screening to a day or more after, and ask for a test KDM the moment the real one is issued so a bad key surfaces during tech check, not during house open. Some festivals sidestep the whole failure surface by requiring unencrypted DCPs outright, or by asking filmmakers to also hold a Blu-ray or ProRes backup so a corrupted key doesn't force cancelling a screening.

Working Note

The rule we give directors is simple: default to unencrypted unless the invitation explicitly says otherwise. If it does say otherwise, start the DKDM handoff the day you get that invitation, not the week of the festival. We've watched one bad festival submission turn into a scramble over exactly this kind of scoped, single-server key, and it was a wholly avoidable one. It's a small decision, but it's the kind of delivery detail we walk through with a director before a festival cut ever leaves the room. The film is only as ready as its last, most boring technical step.