A KDM, or key delivery message, is a small encrypted file that acts like a digital key. It unlocks your film so it can play on a specific cinema server, at a specific venue, and specific window time.
That’s because your film file, the DCP (Digital Cinema Package), is very often encrypted to prevent unauthorised copying or playback. Your DCP can be mastered, delivered, and ingested correctly, yet playback can still fail without the matching key.
Think of the DCP as a safe and the KDM as the combination. Without the right key, the screen stays dark, no matter how well your film was mastered.
Because every cinema server has a unique certificate, a KDM made for one screen won’t work on another. Getting it right is a core part of DCP and KDM support, and getting it wrong can mean a black screen instead of a premiere.
How does a KDM work?
A KDM is an encrypted, XML-based message containing the information an authorised cinema system needs to access the content keys required for playback. SMPTE ST 430-1 defines the KDM standard, while SMPTE ST 430-2 covers digital cinema certificates.
The KDM doesn’t contain the movie. Instead, it securely delivers the relevant encrypted keys to the authorised playback equipment. The cinema’s secure media block processes the KDM and checks that it applies to the intended device. When the certificate, composition identifier, and validity period all match the protected content, the system can unlock the film and begin playback.
What information does a KDM contain?
A properly generated KDM typically contains:
- a composition identifier (UUID) linking the key to the intended composition playlist (CPL)
- the target device’s digital cinema certificate
- the encrypted content keys required for playback
- a not-valid-before date and time
- a not-valid-after date and time
- digital signature information that protects message integrity
- details identifying the authorised playback equipment.
Validity times use UTC date-time values, and DCI compliance documentation checks that the CPL identifier matches the identifier referenced by the KDM.
Why does a cinema screening need a KDM?
The primary purpose is security. Encryption stops a protected film package from being freely played on unauthorised equipment. A cinema can successfully ingest an encrypted DCP and still be unable to play it, because having the files isn’t enough: the system also needs authorisation to access the content keys.
That gives cinema playback security several layers:
- the DCP contains encrypted picture and sound files
- the content keys stay protected
- the KDM identifies the authorised playback equipment
- the validity window controls when playback is permitted
- the secure playback environment handles decryption.
Protect your film with secure DCP and KDM services.
What can go wrong with a KDM?
Most screening problems don’t come from a failure of the encryption itself but mismatched information or rushed delivery.
1. The wrong cinema server certificate
Each playback device has its own certificate. If the key is generated against the wrong one, the cinema can’t use it, even though the DCP itself is perfectly valid.
2. Incorrect screening dates
Every key has a defined validity period. If a screening moves from Friday to Sunday, the original key may no longer cover the new booking, so a reschedule usually means a replacement KDM.
3. The wrong CPL or UUID
A DCP can contain several compositions or versions. The UUID of the DCP’s CPL must match the UUID referenced in the KDM. If they don’t, the KDM won’t unlock the DCP, even if the certificate and dates are both correct.
4. Requesting the KDM too late
Generating a key is only one step. The cinema must receive it, process it, and confirm the system can use it before the screening begins.
5. Assuming a finished DCP is “ready to go”
A completed DCP isn’t automatically ready for projection. The screening also depends on correct KDM delivery, successful ingest, and a compatible playback environment, so always confirm ingest with the cinema in advance.
Can I make my own KDM?
The cinema doesn’t create the KDM, and neither can anyone who doesn’t hold the content keys. In practice, it’s generated by whoever encrypted the DCP, using the exact server certificate, playback dates, and DCP details for each venue. If you encrypted the DCP yourself, you can generate keys yourself, but every certificate, date, and UUID still has to be exactly right. If a mastering company encrypted it, you’ll need it to issue the keys.
KDM workflow: from master to cinema
Final master → DCP authoring → DCP encryption → CPL creation → certificate collection → KDM generation → KDM delivery → cinema ingest → playback
The process gets more complicated when a film travels between venues. Each target device needs its own key, and screening schedules can differ from one location to the next. For a festival tour or a multi-venue release, keeping certificates, CPL identifiers, and booking details organised is what prevents a last-minute failure.
Streamline your KDM workflow before screening day arrives.
KDM vs DKDM: what’s the difference?
A DKDM, or Distribution KDM, plays a different role from an exhibition key. A DKDM isn’t simply another cinema key; it belongs to a different point in the secure distribution chain.
| KDM (exhibition key) | DKDM (Distribution KDM) | |
| Purpose | Authorises a specific cinema system to play an encrypted DCP | Supports controlled distribution and later KDM generation |
| Typically targets | The playback equipment that shows the film to an audience | An approved distributor or facility in the secure chain |
| Time-limited? | Yes, with a defined start and end | Depends on the workflow |
In some workflows, a post-production facility or distributor uses a DKDM to support later KDM generation without going back to the original mastering stage for a new set of content keys.
How much does KDM generation cost in the UK?
KDM pricing varies by provider, number of venues, delivery requirements, and release complexity. As a practical example, DCP-Solutions charges £20 per additional screening venue for KDMs, so ten additional venues would add around £200.
Treat published figures as starting points: urgent changes, additional screenings, and complex delivery arrangements can affect the final invoice. KDM work often sits alongside DCP production too, and our published pricing lists feature DCPs from £214 for 60–89 minutes, with additional KDMs charged per venue.
Get a tailored quote for your cinema release.
How to avoid KDM problems before your screening
A simple pre-screening check prevents most avoidable problems:
- obtain the cinema’s current server certificate
- confirm the correct CPL and composition identifier (UUID)
- check every screening date and start time
- make sure the validity window covers the whole planned screening period
- send the key by the agreed delivery method
- confirm the cinema has received and processed it
- keep a record of every venue, certificate, CPL, and key
- request replacement keys whenever booking details change
- allow extra time before premieres and festival screenings.
Why professional KDM management matters
KDM work sits across mastering, encryption, distribution, and exhibition. A professional workflow checks the protected DCP, matches the CPL, validates certificates, and coordinates keys across every venue before screening day.
At DCP-Solutions we handle DCP mastering, encryption, and KDM generation, collect the correct server certificate from each venue, troubleshoot issues before they become emergencies, and manage multi-venue deliveries where dozens of keys need tracking. For first-time filmmakers, that’s the difference between walking into a screening with confidence and discovering a missed technical detail too late.
If you’re still deciding which files to prepare, our guide to DCP vs DCDM vs ProRes explains which master format each recipient needs.
Final thoughts
A finished DCP isn’t the last step before a cinema screening. The key connects the protected film with authorised equipment and a defined playback period, and an incorrect certificate, CPL identifier, or date can stop an otherwise finished film from playing. For important screenings, arrange your keys early, check every venue carefully, and confirm delivery before the audience arrives.
Talk to DCP-Solutions early, so your keys and your screening are ready when the lights go down.
Frequently Asked Questions
What is the purpose of a KDM?
A KDM authorises an approved cinema playback system to access the cryptographic keys needed to play an encrypted DCP during a defined validity period.
What is a KDM in cinema?
A KDM, or key delivery message, is an XML-based security message that links protected content to authorised playback equipment and a specific CPL, and contains the cryptographic information needed to unlock it.
Does an encrypted DCP need a KDM?
Yes. An encrypted DCP needs the appropriate KDM, because the cinema system needs the protected content keys to decrypt and play the composition.
Can a KDM expire?
Yes. Every KDM has a validity period with start and end times, and the authorised system can only access the protected content within that window.
What is the difference between a DKDM and a KDM?
A KDM authorises playback of encrypted content on exhibition equipment. A DKDM (Distribution KDM) is used within controlled distribution workflows to support authorised downstream access and KDM generation.
Can I use the same KDM at more than one cinema?
No. Each cinema server has a unique certificate, so a KDM made for one screen won’t work on another, even for the same film on the same night.