H.264 in CENC version 1 and CENC version 2

CENC represents “The Common Encryption (‘cenc’) protection scheme”. 

For H.264 in CENC version 1, it has, 

“it is required that at least the NAL length field and the nal_unit_type field (the first byte after the length) of each NAL unit is left unencrypted.” 

And for H.264 in CENC version 2, it has,  

“For AVC video using ‘avc1’ sample description stream format, the NAL length field and the nal_unit_type field (the first byte after the length) of each NAL unit SHALL be unencrypted, and only video data in slice NALs SHOULD be encrypted.  Note that the length field is a variable length field. It can be 1, 2, or 4 bytes long and is specified in the Sample Entry for the track as the lengthSizeMinusOne field in the AVCDecoderConfigurationRecord” 

That is, H.264 in CENC version 1 only requires that NAL length field and the nal_unit_type field to be clear.  

H.264 in CENC version 2 requires that NAL length field and the nal_unit_type field to be clear, and recommend slice header in slice NALs to be clear.  

There isn’t an easy way to tell whether some H.264 content is encrypted with CENC version 1, i.e. only NAL length field and the nal_unit_type field are clear, or with CENC version 2, i.e. NAL length field, the nal_unit_type field and the full slice header are clear.