What is the best encryption protocol to encrypt streaming video? I am building a SoC to capture and encrypt video at once. I would like to understand what encryption protocols are available to encrypt the video stream.

The video stream will be coming from a camera sensor, like a CCD. If necessary it can be pre-processed on the SoC into a particular format (for example to compress it) before being encrypted. It can also be encrypted from its RAW format if possible. The encryption protocol should have an efficient hardware implementation that can be implemented on SoC.

The goal of this embedded system is to achieve the highest possible security by reducing potential hardware or software attacks on the Soc that might expose the clear video stream to the attacker.

Note that this is a self contained chip, and the video data will not be sent over WiFi or network. It stays inside the chip.
I am building a SoC to capture and encrypt video at once. I would like to understand what encryption protocols are available to encrypt the video stream.


Building tiny SoC? Are you sure you're not using a SoC on a larger board like a pi? Do you have video compression acceleration?


  The video stream will be coming from a camera sensor, like a CCD. If necessary it can be pre-processed on the SoC into a particular format (for example to compress it) before being encrypted. It can also be encrypted from its RAW format if possible. The encryption protocol should have an efficient hardware implementation that can be implemented on SoC.


For performance, you'll want hardware AES. Although you could use AES-GCM, this will require GHASH in hardware for performance; instead you can ignore GHASH and use a parallel block cipher based MAC instead, such as PMAC.


  The goal of this embedded system is to achieve the highest possible security by reducing potential hardware or software attacks on the Soc that might expose the clear video stream to the attacker.


So far we have AES-PMAC; which makes a fine AEAD, although you ask for higher security so lets add nonce-misuse resistance. Accidental nonce-misuse may occur in many ways, including but not limited to: power faults, wrapping the counter, or incorrectly handling backup and recovery. I recommend you use AES-PMAC-SIV.

Encrypting raw uncompressed video does not leak anything assuming the raw size is constant. Encrypting compressed data can leak for instance the presence of motion in the video stream.

In either case, you should chop the video stream on segment borders such that no segment crosses multiple ciphertext messages. We now have an unbounded stream of variable-length messages to encrypt. You may use the OAE2 construction family to maximize nonce-misuse resistance. Use CHAIN to force sequential decryption, or STREAM to enable out-of-order decryption. The latter is ideal for video, as it enables seeking and does not rely on previous blocks (critical if you want to use the disk as a ring-buffer).


  Note that this is a self contained chip, and the video data will not be sent over WiFi or network. It stays inside the chip.


If the data never leaves the disk, why are you encrypting the video stream instead of using full disk encryption (LUKS, LUKS2)?

If you'd like to restrict the lifetime of the video stream you can rotate the keys and treat your storage device as a large ring-buffer. This way you never need to waste time zeroing out the disk, which doesn't work well because the HDD or SSD is making sectors inaccessible while managing hardware errors and wear leveling.

Keys should only exist in memory and/or on a HSM.

Miscreant is the only library I've seen to offer AES-PMAC-SIV and OAE2 so far.

Pseudocode in Rust:

let mut file = File::open("video-dump", append);
let mut segments = record_camera();

let key = random();
let mut stream = Stream::new(key, nonce);

for seg in segments {
    file.write_all(stream.encrypt(seg, authenticated associated data))?
}


Notice the safe and simple interface. You do not need to mess with any raw ciphers. However, you'll want a header per message with the length of the segment and a flag for the start of a new stream and a flag for the end of a stream (if it ends peacefully).