The Ultimate Guide to an Encrypted DCP Delivery Workflow: Film Festivals & Cinemas

Understanding why traditional DCP transfer often fails under pressure, and how cloud-native transfer can help

It seemed so sensible: Relying on an encrypted digital cinema package (DCP) delivery workflow to securely distribute hundreds of physical hard drives, each containing your final film for film festival and cinema projection. 

But then you discover a corruption in your DCP. It won’t ingest, or a security key fails, leaving you staring at a dark screen – all while the audience grows restless. Not only must you recall, fix, and re-ship every other DCP drive, but you also have to deal with the expense and embarrassment of a cancelled screening.

But the situation is above avoidable: High-capacity cloud transfers can eliminate the risks of logistical risks, delays, and expense of physical shipping. In this blog post, we’ll show you how to achieve an efficient, cloud-based DCP process when you send large video files for film festivals.

• Understanding DCP Fundamentals
• The Standard DCP Delivery Workflow: Step-by-Step
• The Logistics Gap: Why Traditional Methods Fail
• The Solution: MASV for Cinema-Grade Delivery
• Encrypted DCP Delivery Workflow: Screening-Ready Checklist

Understanding DCP Fundamentals

If you’re new to the world of encrypted DCPs, here’s a quick recap of the technical process. For a comprehensive deep dive into the topic, read our guide: “DCP: What is a Digital Cinema Package.”

What is a DCP?

A DCP is a correctly named and configured directory of files – not a single, self-contained video and audio file. They’re used to send large video files for film festivals and cinemas.

Most DCPs are created by digital cinema encoding facilities, like Simple DCP, which create and perform quality control on the DCP prior to release. But there are also self-serve tools filmmakers can use, like DCP-o-matic, to convert video, audio, and subtitle files into a DCP.

A DCP folder directory contains the following:

• Video folder: The video track includes an MXF wrapped JPEG-2000 (J2K) lossless image sequence, in the XYZ colour space. 
• Audio folder: MXF wrapped 24-bit linear PCM uncompressed multichannel WAV files, sampled at 48kHz.
• Metadata (XML files): These hold the entire package together and instruct the digital cinema projection system how to parse, synchronize, and play the various assets in the DCP. Most digital cinema infrastructure adheres to universal specifications established by Digital Cinema Initiatives (DCI), a consortium of major motion picture studios.
• Subtitles: If the film requires subtitles, they are included as separate files within the DCP folder structure, allowing easy localization.

Other important elements of a DCP include:

• ISDCF naming convention: Cinema servers use the Digital Cinema Naming Convention to identify metadata; a folder named “My_Film_Final_v2” is a disaster for projectionists. Strict adherence to the official naming specs is essential for successful ingestion into the cinema server.

You can visit the Inter-Society Digital Cinema Forum (ISDCF)’s website for an illustrated guide to the latest DCP naming convention best practices.

• DCP standards: DCPs adhere to two main standards: Interop (2001) and SMPTE (2009). Interop is older, widely supported, and simpler but limited in features. SMPTE is newer, more robust, and standardized, supporting advanced audio, subtitles, and higher frame rates.

How does DCP encryption work?

Encryption is the process of securing your assets with a private key that must be used to unlock them. These are paired with public keys, also known as certificates, used to deliver key delivery messages. DCPs don’t have to be encrypted, but without encryption, they can be easily copied and distributed by anyone with access.

Here’s how DCP encryption works, including the difference between DKDM vs. KDM:

• DKDM (distribution key): The master key kept by the lab or DCP creator and used to generate individual keys.
• KDM (key delivery message): The specific key for one unique cinema server, restricted to a specific projection time window.
• Certificate chain: KDMs are also tied to specific projection hardware via manufacturer-issued server certificates from Dolby, Christie, or GDC.

All this makes the certificate chain incredibly fragile: A single incorrect digit in a server ID or a sudden change in the venue’s equipment can prevent the DCP from playing. This has led some film festivals, such as Sundance, to state that they “strongly prefer” receiving unencrypted DCPs – although that carries a significant element of risk. 

The Standard DCP Delivery Workflow: Step-by-Step

So what does all of this look like in practice? Here’s a four-step guide to an encrypted DCP delivery workflow.

1. DCDM mastering: Finalize the digital cinema distribution master (DCDM), the final source file for making the DCP.
2. Targeting: Collect unique server certificates and IDs from the specific cinema or film festival where the film will be projected.
3. KDM management: Issue keys with the correct certificates and with a specific UTC time window. A common local time pitfall is failing to account for time zone offsets, which can render a KDM invalid at the time of the actual screening.
4. The ingest process: The DCP is loaded into the theatre management system (TMS) or playback server from a physical DCP or cloud transfer. After ingest, a SHA-265 checksum validation automatically runs to verify that the content is identical to the lab source and has not been modified.

If all goes according to plan, the KDM will perform decryption on the DCP to allow it to play correctly.

The Logistics Gap: Why Traditional DCPs Often Fail

One aspect we have so far overlooked is the sheer logistics, timeframes, and risk involved in creating DCP drives and distributing the relevant KDMs for each one, or relying on consumer-grade file sharing tools like WeTransfer or Dropbox. Such reliabce can result in:

• Dead-on-arrival drives: DCP drives need to be shipped, pass through customs, and be free from mechanical failure or file transfer corruption to avoid being dead on arrival.
• Consumer-grade transfer failures: Feature film DCPs can be 200 to 500 GB in size, depending on formats such as 3D, 4K, or IMAX. That means attempting to transfer them with consumer-grade cloud platforms such as Dropbox or WeTransfer just won’t cut it.

Along with being unable to quickly and reliably transfer massive file packages, consumer-grade file sharing tools struggle to maintain the DCP’s critical folder structure. If the folder structure is altered in transit, you’ll almost certainly be greeted with an error message upon playback. 

Comparison Table: MASV vs. standard cloud vs. physical shipping

The Solution: MASV for Cinema-Grade Delivery

There is a better way to move large DCPs over the cloud: MASV’s high-capacity global transfer network overcomes traditional limitations and avoids common bottlenecks, making it the ideal solution for individual or large-scale encrypted DCP delivery workflows.

Transferring a DCP with MASV offers several significant benefits: 

1. Relentless reliability: MASV preserves DCP file and folder structure without time-consuming zipping, ensuring the package remains projection-ready as soon as it’s downloaded. MASV’s built-in, byte-for-byte checksum verification ensures every bit of a 200 GB-plus file arrives intact and protects against unseen corruption.
2. Size: Moves file packages of unlimited size and can readily handle even the largest DCPs, even across large geographic distances or in areas with limited connectivity.
3. Speed: Overcomes browser-based upload limitations, allowing it to fully saturate high-speed connections to ensure faster, more efficient transfers.
4. Security: A TPN Gold Shield member and compliant with ISO 27001:2022 and SOC 2 Type II, providing the enterprise-grade security required for protecting high-value studio content.
5. Global Reach: MASV’s backbone is a global network of 450-plus AWS data centres, ensuring global high-speed delivery by transferring data through the fastest possible routes.

Portals – Drag-and-drop uploaders, perfect for film festivals

If you’re a film festival looking to gather DCPs from hundreds of filmmakers, then MASV Portals browser-based file uploaders make it easy to email collaborators a transfer link and have filmmakers upload their final DCPs directly to your online storage. 

Festivals can spin up as many Portals as they need for free and integrate them with cloud or connected on-prem storage, for easy print traffic management. 

Watch Folders for no-code transfer automations

MASV’s no-code automation features allow DCP labs, filmmakers, distributors, and other stakeholders to automate the DCP delivery process. 

• Filmmakers, distributors, and DCP labs can use Watch Folders – a folder that executes an automation as soon as it detects a new file – to automatically trigger a delivery as soon as the DCP conversion completes.
• Festivals and many cinemas can configure their Portals to automatically send uploaded content to multiple destinations simultaneously, from cloud storage to physical NAS drives. 

These built-in efficiencies save time and money with each and every transfer.