# MoQ-Secure Encryption & Signing
[](https://crates.io/crates/moq-secure)
[](https://crates.io/crates/moq-secure)
[](https://docs.rs/moq-secure)
A fixed format for end-to-end secure **media payloads** carried by **Media over QUIC (MoQ)**.
Encryption algorithms:
- **ChaCha20-Poly1305**
- **AES-256-GCM (added from v0.1.4)**
Signature algorithm:
- **Ed25519**
> **Payload-Only Encryption:** MoQ is a content-agnostic transport format. MoQ-Secure encrypts only the frame’s media payload bytes. Transport framing and routing remain unchanged. **Metadata such as broadcast name, media codec and resolution remains unencrypted and visible to the relay.**
## Purpose
People increasingly want to protect their communications from pervasive monitoring and mass surveillance. At the same time, audiences need confidence that media is genuine: in an era of deepfakes, you often can’t tell whether a video or audio clip truly came from the person it claims to be.
MoQ-Secure is designed to provide:
- **Privacy** for the media payload - so content can’t be inspected in transit
- **Integrity** - so tampering is detected
- **Authenticity** - so frames can be verified as coming from a particular publisher
- **Flexibility** - balancing security and performance
Publishers are able to use **any** public MOQ CDN, with the hosting provider unable to see the content. Consumers can verify the publisher of the content, wherever they receive it from.
## A moq-secure frame is nested entirely within the payload of a moq frame.
