CD Copy Stopper
CTho9305 writes "Technology Review has an article about a new CD and DVD copy protection system by Doc-Witness, where the disc itself has a smart card on it. The card checks if a request is valid, and then returns a key to decrypt the contents of the disc. It apparently works with standard drives."
"What is this chip supposed to do -- decrypt on the fly and send a new optical pattern to the read head? I don't think so. "
Well, yes apparently:
The technology works by turning an ordinary CD drive into a smart-card reader. A photodetector at the edge of the CD turns the drive's laser light into electrical pulses, which travel to the embedded smart card and request the key. If the card deems the request legitimate, it returns the key as an electronic signal that an onboard light-emitting diode converts into light and beams back to the drive.
Well that would be a stupid bet.
A few years ago I worked for a smart card company and we thought about doing this very thing. We realized very quickly, however, that the key securely stored on the smart card has to get passed out of the smart card and into software to be useable. Once the key is in software, it is vulnerable and can be hacked to decrypt the contents of the CD.
If everything were done in hardware and the key was transferred securely through hardware it would be much more difficult to hack the key, but who cares? After passing the key securely from the smart card to the decryption hardware, the hardware has to put out a stream of unencrypted data to make the content actually usable and the data can be recorded AFTER being unencrypted. What if the hardware outputs the data in analog format? Big deal. It's a high quality stream so we record it again and digitize it and we really haven't lost that much quality wise.
Adding a smart card to a CD or DVD doesn't really make it more secure. It just makes us jump through more hoops.
Of course, this whole post is probably illegal anyway due to the DMCA. I would post anonymously but the karma is worth time in prison and $1/2 million fine.