DKDM (Distribution KDM)

An encrypted DCP plays only when a KDM unlocks it, and every KDM is encrypted against one device's certificate. Someone has to be able to cut those KDMs for every booked screen. That someone holds a DKDM.

A DKDM is a KDM whose target is not a projector but a KDM-generation system: a distributor's key server, a delivery platform, or a mastering tool. The key service Mnemonica describes it as a master key held by the distributor that never leaves its platform and is never sent to cinemas. Its only job is to let the system derive device-specific KDMs.

There is no special file format. As one long-standing DCP-o-matic contributor puts it on the DCP-o-matic forum, there is no technical difference between a KDM and a DKDM. The difference is the target certificate and the intent.

Mostly in the failure case. If a key request for a title goes unanswered, the cause is sometimes upstream: the booking agent or sub-distributor in your territory has not yet received the DKDM from the rights holder, so it cannot cut keys for anyone. Asking "do you hold the DKDM for this CPL?" saves a day of chasing.

The second case is festivals and cinemas that make their own encrypted DCPs. If you encrypt a DCP in a mastering tool and later delete the project, you can no longer issue keys for it unless you kept a DKDM targeted at your own tool. DCP-o-matic has a menu entry for exactly that. To let a third party issue keys, you ask for their KDM-distribution certificate and make a DKDM for it, and they can then use any compatible software.

Keep the DKDM safe. It is the only thing that turns a drive of encrypted files back into a playable film.