Method of providing an encrypted data stream

A method of providing an encrypted data stream, includes obtaining a first data stream (17;41;63;78;92), partitioned into sections corresponding to key periods (18-22;45-48;71-74;80-84;96-99), each of a plurality of the key periods (18-22;45-48;71-74;80-84;96-99) being associated with a respective value of a key, wherein each section corresponding to a key period associated with a value of the key includes at least one encrypted data unit (10) decryptable using that associated key value, obtaining a sequence of key messages, at least some of which carry key information for obtaining at least one of the key values, obtaining a replacement data stream section (30-31; 42,43; 65,66; 85,86; 93,94), forming an encrypted output data stream (39; 44; 69; 88; 113), corresponding at least partially to the first data stream (17;41;63;78;92), by inserting the replacement data stream section so as to replace a corresponding part of the first data stream with a tail end of the replacement data stream section preceding at least part of a section of the first stream corresponding to a certain key period (21;48;71;83;99), and providing as output the encrypted output data stream (39;44;69;88;113) in synchrony with an associated stream (40;54;70;89;114) of key messages. A key message carrying key information for obtaining the key value associated with the certain key period (21;48;71;83;99) is included in the stream of key messages (40; 54; 70; 89; 114) so as to coincide with a point of the encrypted output data stream (39;44;69;88;113) preceding the tail end of the replacement data stream section. 36 CLAIMS 1. Method of providing an encrypted data stream, including obtaining a first data stream (17;41;63;78;92), partitioned into sections corresponding to key periods (18-22;45-48;71-74;80-84;96-99), each of a plurality of the key periods (18-22;45-48;71-74;80-84;96-99) being associated with a respective value of a key.