Slashdot Mirror


The Great HDCP Fiasco

Toasty16 writes "According to an article on Firingsquad, our shiny new Radeon and Geforce cards won't be able to play HDCP-encrypted content, even though they have been advertising HDCP support as a feature for a few generations. Want to watch that new Blu-ray movie on your custom built PC at full resolution? Sorry, retail graphics cards won't be able to do that; only OEM-built computers from Dell, Sony, HP and the like will have that functionality built in."

32 of 728 comments (clear)

  1. Legallity? by massivefoot · · Score: 3, Informative

    Now over here in the UK I we have a phrase for this sorta thing: "false advertising".

    And I'm pretty sure we have laws against it too...

  2. Just a thought by oc-beta · · Score: 2, Informative

    But when has vendor lock-in ever enhanced the propogation of a certain technology? Isn't that why Betamax wasn't adopted? Also, Sony's AC3 format comes to mind. Say hello to HDDVD

    1. Re:Just a thought by Dion · · Score: 2, Informative

      Sigh.

      Bluray is worse than HDDVD for one reason: B+.

      Bluray has an additional layer of pr. disk programmable DRM called B+, which means that to play bluray you need to be able to emulate an entire player so the B+ code can run and help decode the content.

      The problem with this is that it's much harder to make a working player for Bluray than for HDCP which has only AACS.

      AACS will never be 100% broken like CSS was as it's based on AES not some dinky home made crypto, like the stuff used in HDCP.

      --
      -- To dream a dream is grand, but to live it is divine. -- Leto ][
  3. Good by BrookHarty · · Score: 2, Informative

    If nobody can use it, then using blue-ray without it will be the standard.

    I dont see everyone going out and buying all new systems for this artifical mandatory key authorization crap.

    What isnt clear, so hardware H.264 wont support DRM'ed media either? Huh?! I thought that was just mpeg4 standards.

  4. Re:Hmmmm... by AJWM · · Score: 4, Informative

    Close, s/card/GPU/ throughout your comment. From TFA, the graphic chips may support it, but the graphic cards don't, so if you bought a graphic card because the GPU claimed HDCP support, you're SOL even if (the rest of) the host hardware does support it.

    --
    -- Alastair
  5. Rabbit hole goes deeper -- existing HDTVs w/ compo by green+pizza · · Score: 4, Informative

    The requirement of HDCP via DVI/HDMI is also a major issue for those who bought the first few generations of HDTVs equiped with component inputs, or in some cases, DVI without HDCP support.

    Cases in point, I know of several major HDTV purchases made about 2 years ago, late 2003 / early 2004. All of these were CRT or CRT projection based and have the ability to do full 1080i resolution, in fact most are currently being used with DVHS D-Theater, Dish Network HD, and XBOX360 at full 1080i, 720p or similar HD resolutions. Mostly via 3x RCA component input, but plain computer style DVI in a few cases. But since none of these TVs support HDCP, they will most likely be unable to display full HD resolution material from BluRay or HDDVD.

    Many Dell 20" LCD monitor users are in the same boat. They love their sweet pivoting DVI monitors. But without HDCP support, they will never be useful as, say, a bedroom TV connected to a BluRay player or a future Comcast HD cable receiver.

    HDCP is to protect the world from the pirates... who will work around this limitation somehow anyway.

    It used to be that one had to buy an illegal converter/filter in order to make copies of Macrovision protected DVDs and VHS tapes. Now we're going to need to buy illegal converters/filters just to *use* our older HDTVs to their full resolution potential.

  6. Hi, I RTFA by HeavensBlade23 · · Score: 2, Informative

    Retail video cards do not support HDCP != Retail video cards cannot support HDCP. The graphics card you own now most likely does not support it, but that doesn't mean the next one won't.

  7. Re:Well now by mrchaotica · · Score: 2, Informative
    I admire your optimism, but I don't share it. You should read up on Treacherous Computing. There are two key aspects of it that pretty much blow the idea of "getting the keys involved" out of the water:
    • It's hardware based. The key that you need is embedded in a chip such that you need a million-dollar laboratory to get at it.
    • It includes a thing called "remote attestation." The short version is that it will let the Powers That Be remotely revoke the privilages of any hardware with keys that are known to have been cracked. So if you do somehow get the key, as soon as you tell anybody about it Microsoft (or whoever) will be able to brick your hardware.
    --

    "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  8. Re:Windows Vista requires HDCP? by Jugalator · · Score: 3, Informative

    No, HDCP in hardware won't be "required" for Vista, but *supported*. That part was a bit sloppily written. It's the old news though; if your monitor doesn't support HDCP, Visa will play it in a reduced resolution. In comparison, other OS'es may not be able to play it at all, especially if they don't want to violate the DMCA.

    --
    Beware: In C++, your friends can see your privates!
  9. Re:Well now by mrchaotica · · Score: 2, Informative
    Crack the key once, and it's cracked for good
    NO, IT'S NOT! Jeez, how many times do I have to repeat this?! Microsoft et. al. figured out a way around this. If the key gets cracked, they shut it off and any hardware that uses it stops working. It's called "Remote Attestation," and it's part of Treacherous Computing. Read up on it and then you'll be able to make an intelligent contribution to the conversation!
    --

    "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  10. Re:Calling DVD Jon by Ours · · Score: 4, Informative

    He's preped and ready for it: http://deaacs.com/.
    As soon as he can get his hands on the hardware, he'll get on it.

    --
    "You superiour intellect is no match for our puny weapons" - The Simpsons
  11. Re:Well now by mrchaotica · · Score: 3, Informative
    Ahem. Perhaps you should read the article you linked to, especially the bit where it mentions "Key Revocation Lists":
    Well... there's a bigger problem looming ahead. Unfortunately, the good people behind HDCP weren't complete idiots. If you thought that the idea of OPM was a little scary, you're going to love Key Revocation Lists. Consider revocation HDCP's version of the History Eraser Button.
    [snip]
    This is where key-revocation lists come into play. The third aspect of HDCP security is "device renewability." This is the ability for media, streaming content, or even other devices to invalidate keys known to be a problem. For instance, let's assume that you've purchased a DVIMAGIC. That little device is sitting between your cable box and your television. Everything is going fine. Then, one day, you wake up to discover that your television is no longer working with all the channels. What happened? Your cable box just used System Renewability Messages (SRMs) to invalidate the keys used by your DVIMAGIC. From that point on, your cable box will treat your DVIMAGIC as a rogue device. As such, it will not allow it to pass AKE.

    Will your DVIMAGIC work with a HD-DVD player? That depends: what discs have you tried to play? Revocation lists are encoded onto the DVDs. The newer the disc is, the larger the revocation list will be, and, once you're "caught," that playback device should never pass AKE.
    --

    "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  12. Re:you seem to think that J.K. Rowling is an Ameri by mrchaotica · · Score: 2, Informative

    No, I'm well aware that J.K. Rowling lives in Great Britain (although I'm not sure which particular kingdom).

    However, that's irrelevant. All creative works originating in other countries are Public Domain too; it's only international treaties which extend [the U.S.'s, not whatever other country's] copyright terms to them.

    In other words, J.K Rowling only gets the same privilage of lease as a native author, and that's only because her country negotiated a bargain with us for it.

    --

    "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  13. Re:The day is here already.... by mrchaotica · · Score: 2, Informative

    No, you didn't own them before she wrote them. We all acquired ownership when she published them.

    --

    "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  14. Re:Well now by FireFury03 · · Score: 2, Informative

    Does anyone have an idea as to how hard it would be to break the encryption scheme being placed on the next gen technology?

    From what I've previously read in the HDCP Wikipedia article it seemed like HDCP was already as good as cracked anyway - big vulnerabilities in the design of the protocol _and_ hardware available which strips the HDCP protection out of the data stream.

    I think this is the case for pretty much any DRM system - they are putting a decryption system in the hands of the public and _someone_ is going to have the inclination and technical ability to crack it. And once you've rolled out a DRM system it's going to be pretty hard to change it... "oh, that 2000ukp TV you bought a year ago? Yeah, you're going to have to buy a new one coz the DRM protocols have all changed"

    Of course the content providers are doing their level best to make cracking the DRM illegal, but even then I still expect cracks to be written and published (possibly anonymously) and what are they going to do about it? Arrest anyone found playing a blu-ray disc they _own_ on hardware they _own_ for their _own_ entertainment? I don't think so.

  15. Re:Stallman and GPL III by mrraven · · Score: 2, Informative

    It would be pretty funny if a 3 year old p.c. costing 150 with any monitor running a free operating system would be able to view content at a higher resolution (re-ripped) than a new Vista box which will probably cost at least 800 + a new 400 dollar LCD looking at LEGAL paid for content. Us dedicated hobbyists might get the last laugh after all.

    --
    Tired of all the isms, don't exploit people as an employer, or a government, mmmmK?
  16. Re:The day is here already.... by shmlco · · Score: 4, Informative
    Even if J.K Rowling was a US citizen (she's not) your understanding of the law is lacking. Let me explain using short sentences...

    A work is the property of the author. Rights to that work can be transferred and sold. Copyright exists to provide incentive and protection for creation of new work, such incentive and protection deemed to be in the public's best interests. That protection exists for a limited time, AFTER which it's no longer enforced, and upon which that work is said to enter the public domain.

    Major erorrs: It's not a "lease". Rights do not "revert", because they were never the public's rights to begin with. The public can not sell licenses to public domain works.

    And while media can be your property, your rights regarding that copy are limited. You don't "own" that work, just the physical representation of it. Those aren't your words, that isn't your film, and that's not your music.

    --
    Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
  17. Re:The day is here already.... by paeanblack · · Score: 1, Informative

    Rights do not "revert", because they were never the public's rights to begin with. The public can not sell licenses to public domain works.

    Of course they do...how else do you think the public has the right to expire a copyright?

    IP, once published, no longer belongs to the author, it belongs to society. Society then gives somes rights of ownership back to the author, details depending on the jurisdiciton. Obviously society can't give and revoke rights it doesn't have.

  18. Re:SuperAudio, over again by xtracto · · Score: 2, Informative

    SuperAudio (it had some other names too) were a Sony technology for higher quality sound than CDs, basically, a DVD where all the capacity were used for high quality sound.

    Not true, SACD (Super Audio CD) is something different from DVD-Audio:

    "SACD uses a very different technology from CD and DVD-Audio to encode its audio data, a 1-bit delta-sigma modulation process known as Direct Stream Digital at the very high sampling rate of 2.8224 megahertz."

    Unlike DVD-Audio which is the one you where writing about:

    "DVD-Audio is a format for delivering high-fidelity audio content on a DVD. It offers many channels (from mono to 5.1 surround sound) at various sampling frequencies and sample rates. Compared to the CD format, the much higher capacity DVD format enables the inclusion of either considerably more music or far higher audio quality (reflected by higher linear sampling rates and higher vertical bit-rates, and/or additional channels for spatial sound reproduction)."

    Of course you are correct in your point that they didnt take off, or they have not yet. Although I doubt they will take off soon (SACD), I believe they *will* in the near future as they have better sound quality than CDs and consequently than any kind of MP3. If you believe you can not distinguish between a normal CD sound and a SACD sound you just have to wait until you listen to one of those.

    This kind of reminds me of the Atari/Nintendo/SuperNintendo graphics, when I saw the Nintendo graphics (compared to Atari ones) I thought they where the best graphics I have never seen and they where like cartoons. Then I saw SNES graphics and I thought the same.

    You will have to judge HD content after you have seen it. Same as 2.1 vs 5.1 vs 7.1 vs holophonic sound. You may think it is not better enough for you but at the end you will see differences.

    --
    Ubuntu is an African word meaning 'I can't configure Debian'
  19. Re:Blame Hollywood by Zarhan · · Score: 2, Informative

    It should be noted that at least on some TV's (from Sony) if you take a look at the circuit board, the HDCP decoder chip has ANALOG outputs (RGB). The analog signal is then taken to your standard A/D-converter matrix (that all the other analog inputs, such as S-Video are connected) and RE-digitized for LCD.

    So, you cannot get a bitwise copy of the original stream - and yay, neither can the viewer.

    "Great digital picture quality - brought to you by analog path in the middle"

  20. Re:Pirated content by Richard+W.M.+Jones · · Score: 2, Informative
    Yes, I was a bit surprised myself that it came originally as R1 - even through it was ordered through the Apple UK store. Of course the reason it is now locked to R1 is that I've changed the region code 5 times to play disks from various parts of the world... I may have only myself to blame for this, but my point is that region coding has turned me into someone who had to go through the process of finding out how to rip DVDs - I would never have bothered otherwise.

    Rich.

  21. Re:Well now by Alsee · · Score: 2, Informative

    I'm not certain on this point, but the RAM may be encrypted. However even if the RAM is not encrypted, they have a new DRM enforcing EFI system and new a "compartment" system for the RAM, which means that you cannot read the RAM. If any of the ever RAM gets saved to disk, it will *only* be saved in an encrypted mode.

    And even if you do get the software from RAM, it doesn't matter. The keys you need do not exist in RAM. That's right - the decryption keys do not exist in the software. Each Trusted Computing chip has a unique key locked inside, and it uses that key and the hash of the software to generate an encryption/decryption key for the content. If you change even a single line of the software, the Trust chip gets a different hash for the software and then gfenerates a completely different - and useless - key.

    ciphertext+cleartext, attack is made much simpler: proceed to recover keys

    As others have noted, having ciphertext+cleartext does not help you recover an AES key. What they didn't mention was that it also does not help you recover RSA keys either. And of course Trusted Computing is built on AES and RSA.

    I have studied the Technical Specifications for Trusted Computing and compiling a list of potential attacks against it. Trusted Computing is extremely nasty. It is unlikely that there will be ANY strictly software attacks capable of fully cracking the system open. The only likely attack modes will fall into one of the following catagories:
    (1) Very limited software attacks that will be restricted to getting into a single flawed application and the data linked to that app. Such an opening will most likely also be extremely time-restricted, as they have the capability of locking out a program and forcing you to patch your software to close the hole before you will be permitted to access the data any more.
    (2) Ugly hardware attacks. You can completely break the system open with the right hardware attack, but you pretty much have to pay for genuine DRM-compliant hardware and you have to physically extract the unique key out of a boobytrapped self destructing microchip. You must buy another genuine peice of hardware and do a seperate physical key extration for each "liberated" computer you want to make. If you attempt to rip one key and clone it into multiple computers or into multiple devices they will immediately spot that duplicatyed key and place it on a revokation list. All hardware using that key then drops dead, and you need to pay for another new genuine device and rip it again to get a new key. You also have to be insanely careful that your machine never leaks the fact that it can do things it is not supposed to be able to do, or they will again place the key on the revokation list and your hardware again drops dead, and you again need to purchace another compliant device with a new key.
    (3) Software attacks that *kill* the system, without cracking it open. The system is extremely fragile - deliberately fragile. If anything goes wrong anywhere it is explicitly designed to "failsafe" into a broken nonfunctional mode. It is trivial for any software to disrupt the system. A program could easily kill the system until the next reboot... could easily wipe out all of your current keys forcing you to "reinitialize" the system and causing the destruction of all of your Trusted-secured files (repurchase your software and media files). It is also potentially possible for software to physically and permanantly destroy the Trust chip itself. This is a more challenging attack, and they are putting in some safeguards to try to prevent it, but there are in fact multiple documented vulnerabilities of this sort in the specification. There are ways to "burn out" the chip through software.

    -

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
  22. Re:Well now by v1 · · Score: 5, Informative

    The current scheme is a little more complex, and the planned methods are a LOT more complex.

    A pool of device keys were rolled up randomly to start with. I don't know how many. Probably a few thousand.

    For each DVD, a random key is rolled up. (it's possible for them to roll up a new key for each production run) This master key is used to encrypt the content. The master key is then separately encrypted many times, once with each device key, and the result stored on the disk in a key dictionary. Note that each disk has a different master key.

    Each device manufacturer that wants to make a DVD player has to sign a contract with the MPAA/RIAA or whoever it was that runs this madness. They agree that in exchange for one of the device keys, they agree to protect and keep the key secret.

    Two of the manufacturers did not follow the terms of the contract, and stored their device keys in their players' firmware in easily retrievable format. Once these keys had been discovered, any disk that had been pressed up to that time contained the master key for that disk encrypted using that device key, so all disks up to that date had their security defeated.

    Due to the nature of the encryption, once you know the master key, it is possible and practical to reverse engineer the remaining device keys. As a result of this, all device keys are now known to a number of people. If this had not happened, the MPAA/RIAA would have just deleted the compromised device keys from the dictionary for future releases. But since all device keys to date are now known, the only thing they could do is make a new device key dictionary, which would render all DVD players made to date unable to play new DVDs.

    Among other improvements, the new system, it's designed in such a way that the compromise of one device key does not reveal all the other device keys. Also, I know little about the remaining technology, but one of them allows a "kill list" to be placed on a disk. They have added a way to obtain a "serial number" of sorts from the DVD player based on a ripped movie. They then would place that DVD player in the kill list for their new DVDs, and when placed in the targetted player, would deactivate it. Hard to say if this is rumor or true, it'd be a trick but certainly not out the realm of possibility. This way, if a sing;e player was compromised, they could deactivate it eventually. I doubt this would be very effective, but they are apparently going to try it anyway.

    --
    I work for the Department of Redundancy Department.
  23. Re:you seem to think that J.K. Rowling is an Ameri by Jon+Chatow · · Score: 2, Informative
    But, the Queen rules over several kingdoms.

    Correct.

    England, Wales, Scotland, and Northern Ireland. Places like that. Combined they are the United Kingdom of Great Britain and Northern Ireland.

    No, sorry, that's wrong. The Queen has 16 different kingdoms, known as the Commonwealth Realms. The United Kingdom is just one of these, a single kingdom; the name comes from the fact that it used to be 2 kingdoms before 1801 (the Kingdoms of Ireland and of Great Britain), and before that, since 1607, 3 (Ireland, Scotland, and England), though all three were in personal union for a few hundred years. Note that Wales hasn't been a kingdom for a rather long time - about 900 years or so; it's currently a principality (which is more than can be said for Northern Ireland, Scotland, or England).

    --
    James F.
  24. Re:Well now by MasterC · · Score: 3, Informative

    You should read this:

    http://apache.dataloss.nl/~fred/www.nunce.org/hdcp /hdcp111901.htm

    I'm certain it was a story in itself on /. not too long ago, but I'm too lazy to go find it. Here's there conclusion:


    HDCP's linear key exchange is a fundamental weaknesses. We can:

            * Eavesdrop on any data
            * Clone any device with only their public key
            * Avoid any blacklist on devices
            * Create new device keyvectors.
            * In aggregate, we can usurp the authority completely.

    The weaknesses are not easy to repair. Two proposed modifications are broken and still susceptible in O(n^2) work and n sets of keys to:

            * Eavesdrop on any data
            * Clone any device with only their public key
            * Avoid any blacklist on devices


    So even if they use copious amounts of keys (a unique one per device), HDCP will fail all the same and their blacklists won't matter.

    But this is the video stream, not the data encrypted on the disk (analogous to CSS) so the "per disk" comment you made isn't applicable. HDCP & AACS are two separate issues/battles.

    --
    :wq
  25. Re:The day is here already.... by Ngwenya · · Score: 1, Informative

    If you check http://www.spatz-tech.de/spatz/spatz.htm the website, you see that the devices are still on sale - just more of them and newer kit. I think it's called the HDMI3X, HDTVX and so on.

    --Ng

  26. Re:The day is here already.... by rcs1000 · · Score: 2, Informative

    In the UK we have The Sale of Goods Act, which states that goods must have "fitness for purpose" - i.e. that they can run on your projector, or whatever. If goods do not have this, then you can demand your money back. The store has no right to only allow swaps or credit notes; you can demand your money back.

    (You might also be able to get them on the "of merchantable quality" - if it doesn't play, it certainly isn't of merchantable quality...")

    The other nice thing about this is that the retailers end up having the fight with the MPAA: if enough people keep bringing back the movies, they'll say something like 'sort it out, or we drop your products with this "feature"'

    --
    --- My dad's political betting
  27. Re:The day is here already.... by ivan256 · · Score: 4, Informative

    "opened discs may only be exchanged for another copy of the same disc"

    Virtually every state has a law saying that return policy is illegal.

    In Massachusetts, for example:

    A store [...] cannot use its disclosed policy to refuse the return of defective merchandise. When the item purchased is defective, you can choose a repair, replacement or refund. This right is contained in the Implied Warranty of Merchantability law. Under that law, merchants cannot limit your remedies.

  28. Re:Well now by Alsee · · Score: 2, Informative

    No, it will work, as long as the emulator properly emulates the Trust chip.

    As I said, without a genuine key authorized and cryptographically signed by the Trusted Computing Group it doesn't work. No genuine key, no emulator.

    As I said, the keys are locked inside the chips. Locked inside boobytrapped self destructing microchips.

    As I said, if you manage to extract one of the keys to use in an emulator, you can only use it on a single computer or device. The keys are unique. The moment you try to use the key and emulator on a second computer they spot that duplicate use and that the key must be compromized. They revoke the key and your emulator drops dead.

    it would be against the law in most countries to remotely disable already-sold hardware ..... since you are not allowed to damage or destroy other people's property.

    I'd *love* to see them get nailed on legal issues like that, but I doubt it will happen. The bastards slip right through a very slick legal loophole on this. Let me run you through a typical example...

    First you buy a computer or device from a manufacturer. Ok, you are correct that this manufacturer has certain legal responsibility to you. They must provide a properly functioning machine and they must not do anything to break it.

    The movie industry publishes movies. They encrypt their movies, and on the disks they include keys that allow certain devices to be able to decrypt and play that movie.

    The movie industry decides they don't like you any more, that they don't like your device any more, that they do not trust you or your device. Well the movie industry simply stops including the key on their movie disks that tell your hardware how to play the movie.

    Guess what? The movie industry has absolutely no obligation to you in relation to the hardware you bought. Their publishing movies that cannot be played on your player is no different than them publishing new DVD movies that can't be played on your VCR.

    Some company other than your hardware manufacturer can publish that key on a revokation list as "untrusted". The publishing industry and Microsoft and websites and every computer on the planet can then decide that they no longer feel like talking to you or your device. Your device drops dead, and your hardware manufacturer is *not* at fault. There is absolutely no one you can sue. No one who has any legal responsibility to you. No one is required to publish their content in a format that can be read on some specific machine. No one is damaging you machine. They are simply declining to publish their content in a format it can read, simply choosing not to talk to it.

    Nasty slimy scummy and as insidious as all hell.

    -

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
  29. Re:Well now by Alsee · · Score: 2, Informative

    There are some much easier "attacks", one of the primary components of these attacks is not caring that you get an exact digital copy.

    DRM'd music and video is the LEAST of the reasons you should be very very afraid. Forget music and video and DRM'd content and forget piracy and fighting piracy. You and I and Microsoft and the Trusted Computing Group all know that this system can't and won't do squat to prevent music and movies from getting onto P2P.

    What good is a "non-exact" copy of software? What good is encrypted software that you cannot run or install except in handcuff mode on a DRM machine?

    What do you do when you want to surf to a website, and the website asks for digital proof that you have one of these DRM chips and demands DRM certification that you are running an approved DRM-enforcment webbrowser? When it demands proof that it is impossible for you to run a popup blocker or any sort of ad blocker? When the website gives you nothing but an error message unless you have a DRM chip in order to be able to enforce ad views along with the webpage?

    What do you do when your ISP uses the Trusted Network Connect system?

    Oh, you never heard of Trusted Network Connect? It's a specification documented on the front page of the Trusted Computing Group's website. In fact Microsoft has issed a statement that they are implemnting Trusted Network Connect.

    So what does it do? Well your ISP uses it to check the "health" of your computer. And yes, that is exactly what they call it - checking your computer's health. Your ISP can use the Trusted Network Connect system to check that your computer is not infected with a virus. They can use it to enforce that you computer is running an approved and up-to-date anti-virus software. They can use it to enforce that your computer is running an approved and properly configured firewall. They can use it to ensure that your operating system is properly up to date and patched against virses oir other vulnerabilities.

    But of course before they can check any of those things they first need to check that your computer *has* a DRM enforcment chip. They need to check that you have activated it. And of cource they also need to check that you are running an approved operating system to ensure proper use and communcation with the chip.

    If you do not have a DRM chip in your computer, or if you decline to "opt-in" to the system and turn it on, or if you are running an unapproved operating system, or if it you have not applied the mandatory patches for that operating system, or if you are not running the approved and mandatory and software they want you to run, or if that software does not have the mandatory patches applied, or if that software is not configured the way they want it to be configured, then guess what happens?

    Well according to the specification your computer gets "QUARANTINED" because it is not properly "healthy". And what does quarantined mean? Oh not much... it just means that you are denied internet access. We wouln't want your uncertified unapproved potentially unhealthy potentially infected computer getting onto your ISP's network and spewing out attacks and infecting other computers, now would we? We're not doing anything evil or nasty by denying you internet access... we merely want to make sure that your computer is "healthy" and and not infected, merely making sure that your compute doesn't start attacking other computers, merely making sure your computer doesn't get infected. Trusted Computing and Trusted Network Conect are good for you! We're only doing this for your benefit, to protect you and other people! We're the good guys! Aren't we just swell?

    But don't worry... ISP's can't make Trusted Network Connect mandatory if it means locking out most of their customers. They can't make it mandatory unless at least 80+% or so of their customers already have Trusted Computing compliant machines.

    But considering that starting later this year *every* new PC will be sold with Trusted Compliant ha

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
  30. Re:Well now by Alsee · · Score: 2, Informative

    This really deserves a more detailed reply, but I'm really tired right now. I'll run down some points and issues rapidly, and if you have any questions I'll get into more detail later.

    The music and movie DRM issues of Trusted Computing players absolutely pale compared to the software and internet issues of applying Trusted Computing to computers. Software that cannot be instaleld or run except on a DRM compliant machine. Software that cannot be modified. Websites that are impossible to access except on a compliant machine, and only with approved unmodifable software. In a couple of years (4-6 years maybe?) your ISP may make it mandatory for internet access (this is called Trusted Network Connect, which is documented on the front page of the Trusted Computing Group's website and which Microsoft has announced they are implementing).

    It is impssible to make an emulator unless you have a genuine key signed by the Trusted Computing Group. Software will not work on an emulator without a genuine key. The only way to get one of these keys is to extract it from a boobytrapped self destructing microchip.

    If you do manage to extract such a key, yes you can make an emulator. And yes as you say it will be difficult for them to run enforment against standalone offline DVD players. However they have insane enforment powers against any computer that ever goes online and and any hardware inside of or connected to such a computer. The moment you try to do anything online they will spot the duplicate key and it gets revoked and you're screwed.

    Oh, and as for mod chips... you can't do jack when the Trust Enforcer chip is built into the CPU itself and the CPU is effectively welded to the motherboard. Intel and AMD and IBM have either started shipping this crap embedded into the CPU itself already, or they have publicly documented that they will be doing so by the end of the year. The IBM Cell processor. The Intel La Grande system. AMD Presidio. All CPU embedded DRMM enforcement systems.

    Think of it as a Matrix for DRM'd devices.

    The entire POINT of the new system it to make it impossible just do a software emulator and defeat the system. To make it impossible to just set up a Matrix and deceive the system. The entire point is to make software attacks impossible, and to be able to detect and respond to and lock out even hardware based attacks if you do somehow manage to to pull off a hardware attack against the sealed boobytrapped selfdestructing hardware.

    That's why they are collectively spending probably billions of dollars on this. Why they are trying to fundamentally change the very nature of computers. They explicitly want to prohibit people from just setting up their own Matrix where they are in control.

    Very very ugly.

    -

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
  31. Re:Well now by Alsee · · Score: 2, Informative

    You present it with a certain combination of inputs; it responds with a certain combination of outputs. [] intercept anything trying to write to the trust chip, and look up the appropriate outputs.

    Impossible. You can't look up an input you've never seen before. The chip contains encryption and decryption keys. The inputs and outputs get uncrypted and decrypted. It inputs and outputs other crypto keys. The random keys get encrypted and decrypted. It inputs and outputs bulk data to encrypt and decrypt.

    Chip Input: @(Y@H@OHoh2jh2890
    Chip Output: KS(*#oi3#LNjkl2pji

    Chip Input: IU@1b2kb2bjk@@L2
    Chip Output: #)(*#h23uo3uo3@]

    Ok, now you tell me what output you want to give for the input "ojhiZ#IHOiOHioh%"?

    In fact for many of the operations the chip does they ensure you NEVER get the same input or output twice. They explicitly impose that rule to lock out any possibility of the sort of replay attack you suggested. To explicitly make it impossible to ever record one set of input or output data to reuse later. Certain operations where you are never given the same input again, operations where trying to reuse an output doesn't work. This less of an issue in an isolated peice of hardware, but it is a HUGE issue the moment you are talking about a computer going online or a Trust chip on a video card connected to a computer or the trust chip in the new Windopes Vista monitors, or the Trust chip in a HiDefintion DVD player connected to a HiDefinition TV with its own Trust chip. And no, the new HiDefinition DVD players WILL NOT play HiDefinition video on any TV that does not contain a Trust chip.

    So in an isolated peice of hardware connected to nothing else, yes you may be able to replay data that you have seen before. However even in that case a software emulator still cannot decrypt a new movie. You cannot "replay" the inputs and output cryptions for the data you have never seen before on that new movie.

    It's impossible to emulate the chip in software if you do not know the crypto keys inside.

    You also have the problem that Intel and AMD and IBM and building these Trust chips into the CPU itself, and that CPU will basically be welded to the circuitboard.

    If you *DO* manage to intercept and modify the inputs and outputs between a LIVE phsyical chip and a LIVE motherboard in realtime - a very challenging and intensive task involving all sorts of on going headaches - then yes that does pretty well let you crack the Trust system on THAT computer. It only works so long as you are actually sitting in between that single live chip and the rest of the system. You have to use the active chip itself to do all of the crypto work, with you analyzing and recording and modifying the live signals in sophisticated ways to manipulate and deceive it. But the technique is no help for making any sort of crack or emulation for any other system.

    There are ways to get around the booby traps.

    Yes, I thought I acknowledged that it was possible. Very very difficult and requiring some very expensive laboratory equipment extreme skill and a huge amount of work.

    The issue is that ripping one chip like that is only good for making ONE liberated device. One by one, purachacing one genuine device and extracting one key to make one device. If you try to use clones of a key they will spot the duplicated use of that key the moment you go online, or the moment you try to offer cloned devices for sale. They then immediately revoke that key and all devices and all software emulators using that key drop dead. You then need to go pay real cash to buy another retail genuine compliant device and try to rip another key.

    we obviously can block any "phone home" attempts, presenting an artificial "thank you, all is in order, play on" response.

    You cannot decrypt and view a Trusted website until you respond to the validation request they send you. This data is NEVER repeated so you cannot record and replay it. The only way to decrypt and display the webpa

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.