Playable but Private

Hardware-Encrypted, Tamper-Proof Video for Home Cameras

Comment

Inspiration

Home cameras, video doorbells and baby monitors stream our homes over Wi-Fi and networks we don't control. Encrypting the whole stream (TLS/SRTP) hides it from every standard player and recorder, while the "lightweight" selective-encryption schemes in the literature still leak the outline of the scene. We wanted video that plays everywhere but is private to its owner, and that proves no frame was edited, replayed or injected.

What it does

Playable but Private is a JPEG/MJPEG encoder on an FPGA (Zynq-7020, PYNQ-Z2 board) that encrypts the video while it compresses it:

  • It XORs a keystream from Ascon-AEAD128 (the NIST lightweight-crypto standard, SP 800-232) onto the sign and amplitude bits of DCT coefficients inside the entropy coder. Code lengths never change, so every frame is still a valid JPEG that any player opens, but without the key the picture is scrambled.
  • A 128-bit tag per frame rejects modified, replayed and forged frames.
  • Six protection levels (E0–E5). The strongest, E5, also shuffles the 16×16 blocks in a new key-derived order every frame, so no outline leaks, and it needs no frame buffer.
  • An authenticated feedback loop raises the protection level and rekeys automatically when the receiver detects an attack.

How we built it

  • Hardware: Verilog-2001 RTL (colour conversion, DCT, quantiser, Huffman, selective-encryption stage, Ascon keystream and tag units) in 1, 2 or 4 parallel lanes, built with Vivado for the PYNQ-Z2.
  • Verification: a Python golden model is the referee. It passes all 1089 official Ascon known-answer tests, and every RTL block is checked bit-for-bit against it with cocotb + Icarus and Vivado XSim.
  • System: the ARM cores add headers, reorder E5 segments and run the key ratchet and the policy; a receiver, an attacker channel and a live dashboard run over UDP.
  • Evaluation: we re-implemented four published schemes and attacked all of them, and ours, with the same attacks: replacement, non-zero counting, known-frame attacks, jigsaw solvers and a trained U-Net.

Pre-existing work vs. work during LaunchPad Hacks (16 Oct – 20 Nov 2026)

Our public repo has a dated commit history, which shows this split.

Before 16 Oct (pre-existing): the Python golden model, the first encoder RTL with Ascon encryption and the frame tag, the E5 block-shuffle mode (model), cocotb testbenches, the UDP link with attacker and receiver, the attack benchmarks and the first Vivado runs.

Built during the hackathon (16 Oct onward): final timing-closed Vivado images for the PYNQ-Z2 (1, 2 and 4 lanes; 4 lanes at 125 MHz), bring-up on real hardware with bit-exact results in all six levels, the board-side software (headers, E5 reordering, key ratchet), our encoder in C on the ARM cores as a baseline, the tamper injector built into the FPGA, a post-quantum session-key exchange, frame-size padding, all board measurements, the attack suite with the board as sender, and the write-up of the project as a paper submitted to IEEE ICCE 2027 (under review).

Challenges we ran into

  • Keeping the stream format-compliant: only bits whose change cannot alter a Huffman code length may be encrypted.
  • Building the block shuffle without a frame buffer: we encode one restart segment per macroblock in hardware and let the ARM reorder them.
  • Hiding the outline: sign and amplitude encryption alone still reveals where the non-zero coefficients are, and our own benchmark showed it.
  • Board bring-up: clocking, DMA timing and matching the hardware byte for byte with the model.

Accomplishments that we're proud of

  • 169 authenticated 640×480 frames per second on the board, 10.4× faster than our encoder in C on both ARM cores, with no extra clock cycles for encryption.
  • The whole encoder uses only 9.5 % of the FPGA's LUTs.
  • Published schemes leak 0.58–0.94 edge correlation under the same attacks; our E5 level stays ≤ 0.02.
  • All 11 modelled network attacks mitigated in 0.91 s on average, with 0 false alarms in 375 windows; all 25 bit flips injected inside the board were rejected.

What we learned

Visual scrambling is not security until you attack it yourself. A golden model plus bit-exact tests catches hardware bugs that "looks right" never would. And standard cryptography (Ascon) fits comfortably inside a small FPGA.

What's next for Playable but Private

A live camera feed with real-time tamper alerts on the dashboard, measured board power with a meter, a 1080p version, and an extended journal paper.

Limitations

  • Power is Vivado's estimate for the whole Zynq chip (2.22 W), not a meter reading.
  • Frame sizes still identify a video unless frames are padded.
  • Side-channel attacks (power analysis) are out of scope.
  • The Python driver starts the DMA late, which costs 0.62 ms per frame.

AI assistance and credits

Parts of the software, test scaffolding and the first draft of the write-up were prepared with Claude (Anthropic); the team reviewed, tested and verified all of it. Cryptography: the Ascon-AEAD128 design (NIST SP 800-232). Tools: Vivado, Icarus Verilog, cocotb, Python. Test material: Kodak images and the Sintel trailer (© Blender Foundation, CC BY 3.0). Mentor: Dr. Chethana G, RV College of Engineering.

Built With

  • ascon
  • c
  • cocotb
  • cryptography
  • fpga
  • icarus-verilog
  • jpeg
  • pynq
  • python
  • pytorch
  • udp
  • verilog
  • xilinx-vivado
  • zynq
Share this project:

Updates

Submission history