Encrypting Digital Music With Multiple Keys

Orne writes: "The New York Times has an article about mathematicians at Brown who have patented a new music encryption system that is based on cycling encryption keys. '... a typical three-minute song could be scrambled into 180 different codes; anyone taking the time to break a single code would be rewarded with only one second of music.'" I'm not going to try to parse the math behind it, but advances like this are why I advocate laws to protect fair use of copyrighted materials -- sooner or later a successful crypto-system to prevent all non-permitted use of materials will be developed, complete with tamper-proof hardware in your PC, and then where will we be?

Comments

They KNOW their crypto sucks, that's not the point

[defile]

Here, let's demonstrate why this sucks. Example:

Some asshole once stated that "You're going to force us to make songs that can only be played on one walkman". How would they do this?

You would go to their web site, you would plug in your walkman. Your walkman would send the web site it's public key. The web site will charge you $5.95 and encrypt the song with your walkman's public key and then let you download it. That song can now only be sent to your walkman, which decrypts it with it's private key moments before sending it to audial output systems.

Now, most keen people will say "Uh, big deal, I'll just record the output". Uber-leet hackers will go "Cool, a challenge" and take apart the walkman and yank out the private key, or simply figure out the algorithm and determine how to best crack it. If possible.

Now, here's the point. They know you'll crack their encryption. The entire point of encrypting it is so that they can point to the DMCA and say "Cracking cryptographic systems is illegal, and he did clearly this, using these steps." and the fun-loving hacker is carted off to prison and given a sentence that would make the sentence for rape seem like a slap on the wrist.

Mr. Asshole of the MPAA simply argued that DeCSS breaks CSS. The DMCA says breaking cryptography is illegal, whether you distribute the protected work or not. In fact, you would think that it was deliberately easy to crack so that you DID crack it simply to get you into a larger legal mess.

Cryptography kicks ass, but not when it's used to strip people's rights away.

This is just the beginning

[scenic]

I don't like doomsday articles, but this is something that is just the beginning of a path that leads to absolute control of everything we listen to and watch by companies which have no reason to answer to us. Most of the "workarounds" people have posted to this forum deal with re-digitizing the playback audio stream through a variety of means.

What worries me, though, is technology that companies like IBM is developing where a digital watermark actually becomes part of the playback audio, reproduced by every component, including your soundcard and speakers, but which cannot be heard by human ears. IBM has developed such a system which is part of the EMMS system (also known as madison), which they claim has passed what they call "golden ears" tests. These tests have people with exceptionally good hearing try to differentiate between recordings with the watermark and without. (I've been to IBM research and heard the files. I couldn't tell the difference, either, FWIW).

The next step, of course, is to have the watermarks generated on the fly for each electronic transaction that purchases the music (how far away do you think we are from hardware that can do that in a second or two?), encoding your personal information or a transaction ID into the stream. Then, if you upload the music, they will be able to track down the source of the new digital copy of the music to you.

That's pretty scary to me, at least, because we're back to that total control picture. I personally don't believe that artists should have total control of their works, let alone abitrary "copyright holders" like labels and publishing companies, because fair use is an important part of the knowledge chain.

Imagine tuition bills for higher education once professors can't photocopy small excerpts to pass out in class, or you can't actually pick up a book from the Library, copy a few pages, and go home to write you papers. Or that to actually read the book *in the library*, someone has to pay.

What happens to free libraries with perfect copyright control?

I could go on, but I think I've made my point. Different pieces of the technology puzzle to enable full copyright control exists already. I think that all the pieces will be there soon. And that scares me.

Mostly Useless

[Silver A]

The system talked about will be useful only to send out previews of unreleased music - once the CD hits the shelves, MP3s will become readily available, and unstoppable. For that matter, high bandwidth connections will soon become common enough to make practical downloading uncompressed CD audio - 1.2 Mbit/sec allows real-time transmission.

Near the bottom of the article was mentioned a token that could be moved from device to device, but that would be customized for each user's devices, so it couldn't be loaned out. It also couldn't be used on any new hardware you buy without reprogramming, making it even less convenient than Circuit City's DivX. This is one idea for a consumer app that's going to sink without a trace.

The cryptosystem may have a useful application, but preventing music trading isn't it. Maybe it would be good for high-bandwidth military applications.

Re:It would never work...

[AtariDatacenter]

I wish I could moderate you up. One way or another, the audio reaches a format that is accessable. (Say, someone could read a dolby digital output. Or they could pick an analog signal off of the wires to the speakers.)

You mention signal degradation. Well, with audio cassettes, you get more loss with each generation copied. But if you (worst case) record an analog signal, your only loss is at the first recording. All subsequent copies are just as good.

I'm not an audio nut, but this is fine with me. My imperfect human ears cannot distinguish the difference between an MP3 that was sourced from a digital CD, versus an MP3 that was sourced from an FM station or a digital sampling of the analog output of a stereo.

Re:Enmcrypted Hardware

[Tackhead]

> You[r] sound card will have hard ware encryption. It will only connect to special digital speakers

The only way to stop people from using current technology in favor of a new one is to force them to throw out the old stuff. Yes, force. It's been what, 50 years, and there are still people using vacuum tubes, fer chrissake!

And although our benighted Republic has spent much time of late wiping its arse with its Constitution, even I, in my most paranoid delusional fantasies, don't forsee RIAA and MPAA linking arms with DOJ and conducting house-to-house sweeps to smash and burn all "insecure" audio gear. Hell, DOJ can't do it for (some :) drugs and guns, what hope do they have in taking our stereos!

And where's the justification? DiVX (the pay-per-view DVD, not the video compression codec!) died because the consumer realized it was a value-subtracted technology. Somehow "home tapers of music" don't quite rank up there with Eeeevul druggiez and militia whackos on the Scapegoat-Of-The-Day scale. RIAA and MPAA may think they're just as dangerous, but even the general public (who are dumb enough to swallow the War On Some Drugs and War On Some Guns) isn't that dumb. Nobody will buy copy-protected audio gear because it's demonstrably worse than what they already own!

As of now, you can still buy 15-year-old PCs for $10 in surplus stores for peanuts. If every manufacturer stopped building unprotected AV gear today, there would not be a serious shortage of non-secured gear for at least 20-30 years.

And even if there was, so what? Do you believe that there'll be no hardware platforms in 20 years on which open-source operating systems can run? Do you propose that there'll be no MP3, CDDA, or similar unprotected decoder software on the face of this earth, even though the hardware platforms of 20 years from now will be able to emulate today's P166-level boxen in their idle cycles?

RIAA and MPAA can lead the consumer to their poisoned wells all day long, but the demise of DiVX proved they still can't make us drink.

Use licensing is cutting up a product into pieces

[Rares Marian]

I don't care about the RIAA, MPAA, etc. I don't like the idea that fair use is not being considered. Fair use is above any group and individual. But then I'm biased. Everything I work on will be preleased in XM or IT or MOD or some other tracker format. Then MP3s on miniCDs.

Maybe out on vynil next. And then for backup purposes on CD.

If I have stereos all through my house and back yard, I'd like to access my music from anywhere using a wireless palmtop running a Unix.

All this protecting is going to annoy anyone who actually does something with music and that includes a lot of music buyers not just signed bands. This whole listen and shut up attitude bugs me.

I especially hate the bullshit about USE licensing. That's breaking up a product into multiple pieces. Frankly I expect to pay less if I'm not allowed full use.

This is quite likely not a big deal...

[X]

Reasons why this is not a big deal:

• It's not the first time someone thought they'd come up with a new, ultra-fast encryption algorithm which proved to be completely useless once it was rigorously tested by the outside world.
• Having tons of keys to encrypt mutliple parts of a piece of music is essentially indistinguishable from just using one really long key to encrypt the same material. Perhaps this helps skirt encryption export laws, but beyond that it really doesn't buy you significantly better protection.
• It's quite likely there is a brute force attack that allows you to attack all keys simultaneously. Indeed, from the sounds of it you would think the individual key lengths would be quite short, making this approach much more viable.
• I see nothing with this technique that provides protections for music after it's been decrypted, so I don't know why they are talking about applying it to music specifically. There must be something more that the article missed. Nonetheless, this doesn't prevent people from intercepting the playback signal and recording that. For that you'll need tamper-proof speakers.
• Can you imagine the key-management insanity of generating and transmitting all these keys? I would imagine it would signficantly increase the total download size of whatever you were grabbing to the point where people would get annoyed. They say that this is based on PK-crypto, but I don't see how it'd would work (does someone publish 50,000 personal public keys or something? doesn't this crowd the keyspace?).
• No link to a white paper. Not a good sign.

But This is Useless...

[dew]

The ultimate point is that crypto is useless in this application. Hackers won't try to break the keys, they'll just record the digital output, such as is trivial to do with a SoundBlaster Live! card - it's a handy and trivial way to break any cryptosystem, because no matter how you protect the music, you've ultimately got to send the raw data to sound card and that's pretty trivial to intercept.

So the sum of this is that it's ultimately a futile endeavor, regardless of how they rotate keys or whatnot. The folks at Emusic are selling hundreds of times more music than anyone else and none of their stuff is encrypted -- did you know that half their board came from PGP: Pretty Good Privacy, the crypto folks? And that Gene, their CEO, is a longtime cypherpunk? So why is it, you should ask yourself, that some of the most knowledgeable crypto people in the world would start the only online music sales outfit to sell *unencrypted* dowloads?

Maybe because they understand what crypto is really for.

Crypto is for keeping secrets between parties that desire to keep that information a secret. If A wants to tell B something, he can use crypto to prevent some C from listening in that both A and B don't want hearing the information. But if B desires to share this information with other parties, there is fundamentally, long-term nothing that can be done to protect B from sharing it. Crypto is only useful at protecting information if all parties who know the secret want to keep it a secret.

So ultimately, any attempt to protect publicly-published data (books, movies, music) with crypto is going to fail; it's fundamentally untenable.

David E. Weekly

BFD.

[griffjon]

Oh, fantastic. another unbreakable cryptosystem to secure digital music. yea. Not that I can't play it, and loop it back directly in with no loss of quality into another system. ooooh. who cares if it's encrypted??? If the consumer can listen to is, the consumer can record it. Simple. No technological controls will ever, ever prevent pirating.

While this cryptosystem sounds really cool technologically (possibly very powerful encryption) a) the cryptographic element of security is never the one broken--if you have five trillion brass-plated locks on your steel, reinforced door, people break through the window, for look for the key in one of those stupid rocks by the side of the door. b) cryptography is great for security and privacy and integrity, but is helpless against willful copyright violation by a cryptographically-authenticated party (like, say, the consumer).

And in any case, there is nothing to get consumers to move 100% to this system, as opposed to trading MP3s. even if bill gates includes DRM into windows, people will use Linux, or FreeBSD, or not throw their 'old' computers away and keep them for functionality sake to play mp3s and whatnot.

in short, cool idea, useless for the purpose.

I thought we LIKED this?

[Kintanon]

I thought slashdotters liked strong crypto and innovative crypto and anything else that could be used to keep the government out of your hair. Why are we getting our panties in a bunch that someone else might get to use crypto too?
If, as we've stated many many times, the RIAA is obsolete then they will have no use for this technology because they won't have any music to encrypt. The musicians will all be using this to encrypt the songs they are selling off of their websites. Does anyone have a problem with the musicians profiting from their work and using this to enforce how something they created is used? Not I.

Kintanon

The first step is denial...

[MostlyHarmless]

Remember, denial always comes right before going kaputski. Remember the disney movies? The Humorous Sidekick always tells the bad guy: "Umm... what if they Exploit Badguy's One Huge Weakness?" The Generic Evil Bad Guy will then laugh and say: "Nonsense. They would never be able to... " At that point, he is obliterated.

This can be extended as an analogy to the recording industry. First, they think "nobody will ever like this mp3 stuff". Then they pretend to ignore its spread. Once they realize that things are going to hell in the proverbial handbasket, they introduce their weak attempt at mimicking this.

It's very simple. Any music released in this format will never be used. Period. As long as they still sell the CD, people will still get it in mp3 format. And if they only release it in a digital encrypted format, then nobody will buy it. No matter what, the recording industry is doomed.

Where well be

[cybercuzco]

sooner or later a successful crypto-system to prevent all non-permitted use of materials will be developed, complete with tamper-proof hardware in your PC, and then where will we be?

We'll be in the same place we are now, very simple, just take audio out from your computer, use a double male line to the audio in port, and record onto mp3 or whatever replaces it, encryption scheme bypassed. if you can _LISTEN_ to music, you can get around any and all encryption of it.