diff --git a/src/mux/disc.rs b/src/mux/disc.rs
index ccb1028..0d73606 100644
--- a/src/mux/disc.rs
+++ b/src/mux/disc.rs
@@ -23,6 +23,7 @@ use std::path::Path;
 pub struct DiscStream {
     drive: Drive,
     title: DiscTitle,
+    decrypt_keys: crate::decrypt::DecryptKeys,
 
     // What to read
     mode: ReadMode,
@@ -120,7 +121,9 @@ impl DiscStream {
         }
 
         let title = disc.titles[title_index].clone();
-        let stream = Self::title(drive, title);
+        let keys = disc.decrypt_keys();
+        let mut stream = Self::title(drive, title);
+        stream.decrypt_keys = keys;
 
         Ok(DiscOpenResult { stream, disc })
     }
@@ -155,6 +158,7 @@ impl DiscStream {
         Self {
             drive,
             title,
+            decrypt_keys: crate::decrypt::DecryptKeys::None,
             mode,
             current_lba: 0,
             current_extent: 0,
@@ -293,6 +297,10 @@ impl IOStream for DiscStream {
             ReadMode::Sequential { capacity } => Some(*capacity as u64 * 2048),
         }
     }
+
+    fn keys(&self) -> crate::decrypt::DecryptKeys {
+        self.decrypt_keys.clone()
+    }
 }
 
 impl Read for DiscStream {
diff --git a/src/mux/iso.rs b/src/mux/iso.rs
index e68abe7..421afc1 100644
--- a/src/mux/iso.rs
+++ b/src/mux/iso.rs
@@ -231,13 +231,15 @@ impl IOStream for IsoStream {
         Ok(())
     }
     fn total_bytes(&self) -> Option<u64> {
-        // Read mode: size is known from disc scan
         if self.reader.is_some() {
             Some(self.disc_title.size_bytes)
         } else {
             None
         }
     }
+    fn keys(&self) -> DecryptKeys {
+        self.decrypt_keys.clone()
+    }
 }
 
 impl Read for IsoStream {
diff --git a/src/mux/mod.rs b/src/mux/mod.rs
index 4c8d9a0..67b65a1 100644
--- a/src/mux/mod.rs
+++ b/src/mux/mod.rs
@@ -36,8 +36,8 @@ pub mod resolve;
 pub mod stdio;
 pub mod ts;
 
-pub use disc::{DiscOptions, DiscStream};
-pub use iso::IsoStream;
+pub use disc::{DiscOpenResult, DiscStream};
+pub use iso::{IsoSectorReader, IsoStream};
 pub use m2ts::M2tsStream;
 pub use mkvstream::MkvStream;
 pub use network::NetworkStream;
@@ -63,6 +63,12 @@ pub trait IOStream: Read + Write {
     fn total_bytes(&self) -> Option<u64> {
         None
     }
+
+    /// Decryption keys for this stream. Default: no encryption.
+    /// Overridden by DiscStream and IsoStream for AACS/CSS.
+    fn keys(&self) -> crate::decrypt::DecryptKeys {
+        crate::decrypt::DecryptKeys::None
+    }
 }
 
 // Combined traits for internal trait objects.