Media over QUIC (MoQ) is emerging as a new foundation for low-latency live streaming, promising a simpler, more scalable way to move media in contribution, and from production to audiences. But for premium video to move confidently into a MoQ world, performance is only part of the equation. Content also needs robust security, authenticity, and provenance.
The theme of the work illustrated by Ateme and EZDRM is significant: it shows that DRM and C2PA content provenance can operate end-to-end within a standards-based MoQ workflow; and importantly, it works across implementations from different technology providers. We will expand on these benefits in a session at the SVG summit on 20th Oct.
EZDRM adds another important layer: C2PA-based content provenance. Its technology can dynamically sign live video segments, creating a cryptographically verifiable record of content integrity and origin. EZDRM's Video Signature Service is built around the open C2PA specification and has achieved Level 2 conformance verification. This means it has been independently validated to assure that its signing capabilities support interoperable, standards-based provenance for real-world video workflows.
Together, DRM and C2PA address complementary requirements. DRM controls who can access protected content. C2PA provides evidence about where content came from and whether it has been altered. Combining them creates a stronger trust model for premium live media: content can remain protected while also carrying verifiable provenance through the delivery chain.
By transitioning traditional HLS and DASH ingest workflows to Media over QUIC (MoQ), broadcasters and content distributors can significantly reduce end-to-end latency while improving the efficiency, scalability, and flexibility of live video distribution. Unlike traditional HTTP-based HLS/DASH delivery, which relies on segment availability, playlist updates, and repeated HTTP requests, MoQ enables continuous, low-latency media delivery through a cloud-native publish/subscribe architecture.
Built on QUIC, MoQ benefits from integrated TLS 1.3 security, efficient 1-RTT connection establishment, support for 0-RTT session resumption, and connection migration, providing advantages for dynamic cloud environments compared with traditional point-to-point SRT workflows. Equally important, EZDRM and Ateme leverage the industry-standard Common Encryption (CENC) framework, negotiated as a univeral algorithm for DRM-protected media, to deliver secure content distribution with granular entitlement and access control. Rather than relying solely on transport-level encryption, Common Encryption enables content to be encrypted once using standardized encryption schemes, including AES-CTR (cenc) and AES-CBC (cbcs), while maintaining compatibility with established DRM technologies such as Widevine, PlayReady, and FairPlay.
By leveraging DRM-based key management, licensing, and entitlement mechanisms, content owners can authorize individual affiliates, manage access rights, rotate encryption keys, and revoke access at a granular level without requiring dedicated encryption hardware or proprietary conditional access systems. The encrypted CMAF media can be distributed across HLS, DASH, and MoQ workflows without requiring decryption and re-encryption at each network hop, preserving content-level protection across cloud providers, CDNs, and MoQ relays.
Unlike traditional satellite conditional access or SRT link-level encryption, this architecture combines standardized content encryption with individualized, policy-driven access control, allowing content owners to manage exactly who can access specific content and under what conditions. Combined with C2PA content provenance, scalable one-to-many relay distribution, and cloud-native infrastructure, MoQ and Common Encryption provide a secure, interoperable, hardware-independent alternative to satellite and dedicated point-to-point contribution networks, reducing latency, lowering operational costs, improving scalability, and eliminating dependence on proprietary distribution hardware and vendor-specific encryption systems.
The most important aspect of the demonstration, however, is not any individual component. It is the fact that the workflow can cross organizational and infrastructure boundaries using MoQ.
MoQ is being developed as an open IETF protocol. Its publish/subscribe architecture deliberately separates media producers, relays and consumers, allowing independent implementations to exchange media through a common transport. A relay does not need to understand the business logic of the content it forwards; it simply moves the media between publishers and subscribers.
That architectural model changes the economics of streaming infrastructure. A content provider should not have to select its encoder, DRM provider, relay, CDN and player from one vertically integrated stack simply because those components need to communicate. Instead, standards provide the common language.
The Ateme and EZDRM workflow demonstrates that principle in practice. A protected and signed stream can enter one MoQ implementation, pass through another, and reach a subscriber using a different standards-compliant component. In a demonstration involving EZDRM, Ateme, Qualabs and Cloudflare, moving the workflow onto Cloudflare's relay network required changing the MoQ endpoint and configuring the relay appropriately. It did not require creating proprietary media-processing workarounds or negotiating a custom bilateral protocol.
That is what interoperability looks like when it moves beyond a slide deck.
By transitioning traditional HLS and DASH ingest workflows to Media over QUIC (MoQ), broadcasters and content distributors can significantly reduce end-to-end latency while improving the efficiency, scalability, and flexibility of live video distribution. Unlike traditional HTTP-based HLS/DASH delivery, which relies on segment availability, playlist updates, and repeated HTTP requests, MoQ enables continuous, low-latency media delivery through a cloud-native publish/subscribe architecture.
Built on QUIC, MoQ benefits from integrated TLS 1.3 security, efficient 1-RTT connection establishment, support for 0-RTT session resumption, and connection migration, providing advantages for dynamic cloud environments compared with traditional point-to-point SRT workflows. Equally important, EZDRM and Ateme leverage the industry-standard Common Encryption (CENC) framework, negotiated as a univeral algorithm for DRM-protected media, to deliver secure content distribution with granular entitlement and access control. Rather than relying solely on transport-level encryption, Common Encryption enables content to be encrypted once using standardized encryption schemes, including AES-CTR (cenc) and AES-CBC (cbcs), while maintaining compatibility with established DRM technologies such as Widevine, PlayReady, and FairPlay.
By leveraging DRM-based key management, licensing, and entitlement mechanisms, content owners can authorize individual affiliates, manage access rights, rotate encryption keys, and revoke access at a granular level without requiring dedicated encryption hardware or proprietary conditional access systems. The encrypted CMAF media can be distributed across HLS, DASH, and MoQ workflows without requiring decryption and re-encryption at each network hop, preserving content-level protection across cloud providers, CDNs, and MoQ relays.
Unlike traditional satellite conditional access or SRT link-level encryption, this architecture combines standardized content encryption with individualized, policy-driven access control, allowing content owners to manage exactly who can access specific content and under what conditions. Combined with C2PA content provenance, scalable one-to-many relay distribution, and cloud-native infrastructure, MoQ and Common Encryption provide a secure, interoperable, hardware-independent alternative to satellite and dedicated point-to-point contribution networks, reducing latency, lowering operational costs, improving scalability, and eliminating dependence on proprietary distribution hardware and vendor-specific encryption systems.
Cloudflare's MoQ infrastructure provides an especially important piece of this ecosystem. Cloudflare now operates MoQ relays across its global network and supports multiple versions of the evolving IETF MoQ Transport specification. Its relay architecture is designed so that the infrastructure can forward media without needing to inspect the contents of the stream.
This matters because a MoQ ecosystem does not need a single "official" relay.
Cloudflare can provide relay capacity and global distribution, while another company can provide encoding, packaging, DRM, provenance signing or playback. An OpenMoQ implementation can participate in the same broader ecosystem. The value comes from speaking the same protocol—not from belonging to the same vendor stack.
The OpenMOQ Software Consortium reinforces this model by focusing on open-source implementations and practical software for the MoQ ecosystem. Its stated goal is to accelerate development while enhancing interoperability through standardized, open-source implementations.
That approach is particularly important while MoQ continues to evolve. Multiple independent implementations give the industry a way to test the protocol in real-world workflows, identify interoperability issues and improve the technology collaboratively.
For customers, this creates an important form of future-proofing.
A streaming operator should be free to choose the encoder that best fits its workflow. Similarly, it should also be able to select the DRM provider that meets its security requirements, the relay or CDN that delivers the desired geographic reach, and the player technology that best serves its audience. Those choices should not force a complete architectural redesign.
The broader lesson from the Ateme and EZDRM demonstration is therefore not simply that "DRM works with MoQ" or that "C2PA works with MoQ."
It is that security, provenance and delivery can remain interoperable as the media moves across an ecosystem of independent implementations.
That distinction matters. The future of streaming should not replace one set of proprietary silos with another. MoQ offers the opportunity to create an open transport layer where different vendors can compete and innovate while remaining compatible.
With Ateme providing media processing, EZDRM providing DRM and C2PA capabilities, Cloudflare providing global relay infrastructure, and OpenMoQ contributing to the open-source ecosystem, the pieces are beginning to demonstrate that vision.
For content owners and service providers, the benefit is straightforward: adopt MoQ for its latency and scalability without surrendering architectural choice.
Open standards make interoperability possible. Interoperability gives customers choice. And choice is the foundation for avoiding vendor lock-in as the next generation of live streaming takes shape.