HD-DVD and Blu-Ray AACS DRM Cracked

EGSonikku writes "According to this article on Endgadget, the AACS DRM used in HD-DVD and Blu-Ray has been cracked. The program allows one to decrypt and dump the video for play on a users hard drive, or it can be burned to a blank HD-DVD and played on a stand-alone player. According to the accompanying video, a source release for the program will be made available in January. Time to get that $200 Xbox 360 HD-DVD drive?" Warning: this link contains video.

Comments

Not really cracked, more like circumvented

[sith]

As best as I've been able to gather from what I've read today, the very clever fellow just implemented that publicly available decryption routine, and also discovered an (as of yet unreleased) method for obtaining decryption keys. It seems very likely from everything I've read that he is pulling the keys from the PowerDVD program - perhaps they're left unencrypted similar to the original DeCSS obtained a key from the Xing player?

In any case, it will be interesting to see how this is dealt with, and whether key revocation can/can't break this. The author thinks it can't - the cat is out of the bag and is staying that way.

We'll see. I think it's good news for us though, no matter what.

Re:Not really cracked, more like circumvented

[Myen]

Yes, and the Engadget article that is TFA is mistaken... He didn't supply any keys, just disc IDs (to map to human readable names of the discs). The place where the keys would have been were all stubbed out with all nulls.

If this is a crack for the DRM, then GPG is a crack for PGP.

Re:Not really cracked, more like circumvented

[FuturePastNow]

According to the program's creator:

I was very surprise to realize that the title key is there, in memory!

Older systems make Trusted Computing their bitch. Oh yeah.

Re:Not really cracked, more like circumvented

[Rufus211]

As best as I've been able to gather from what I've read today, the very clever fellow just implemented that publicly available decryption routine, and also discovered an (as of yet unreleased) method for obtaining decryption keys. It seems very likely from everything I've read that he is pulling the keys from the PowerDVD program - perhaps they're left unencrypted similar to the original DeCSS obtained a key from the Xing player?

Exactly. I've read the source code he released and it's less than 500 lines of Java. All it does is open each file on an HD-DVD and call the built-in Java AES decryption functions on each "pack" of HD data. There's a slight bit of handling for the pack format and all, but it's straight from the AACS spec.

Now the interesting thing I found from the "pre-recorded video book" spec were these two quotes (page 18):

A licensed product shall treat its Device Keys as highly confidential, as defined in the license agreement.

and

Except where otherwise provided for in these specifications, the values used to enable playback of AACS content (e.g. Title Keys and Volume ID) shall be discarded upon removal of the instance of media from which they were retrieved. Any derived or intermediate cryptographic values shall also be discarded.

So it seems that PowerDVD (or whatever player was used) was fully within the spec to no protect the Title Keys that are assumed to have be swipped by this prog.

Re:Not really cracked, more like circumvented

[Junta]

Looks like from his FAQ that he figured a deterministic way a particular piece of HD-DVD software stores the key in memory. Of course, it's always going to be the case the key is in memory during playback, finding the address would be the pain.. Wonder how he knew what to look for so quickly... Well, suppose he did have a couple of distinct movies, he probably had a set of addresses that obviously changed between discs or titles, and probably some tell-tale strings...

So he probably doesn't have the program's key (it would be in memory a short time probably if well implemented, but ultimately probably gettable, if the program can read it's own key, anyone can). However, expect content providers to audit how easily the key material is locatable in memory (i.e. how deterministic the key memory address is relative to program base address) and revoke keys in future pressings and force upgrades to software users.

Of course, with a few keys out it becomes problematic to hide the locations. Ultimately, the program has to know the offset to the key to use it, so there are going to be hoops to jump through, but using a known title with known key means the address of the key can be found and sampled over a few playback attempts, the memory address of the program analyzed to see if some pattern emerges or some variable points the right way....

BTW, if it was PowerDVD (which he never explicitly said), he is cocky actually showing that program running in his demonstration. PowerDVD is going to be under careful analysis now and his job will be made more difficult likely.

Of course, he could be more clever than I'm guessing, but the indications seem to be memory analysis of HD-DVD playback software.

Anyway, beyond making more hoops to go through, content providers cannot be so stupid as to think the problem technically insurmountable. It's all about demonstrating clear intent to violate DMCA and take legal rather technical measures to 'deal' with the problem.

Re:Not really cracked, more like circumvented

[Bios_Hakr]

It's pretty early in the rollout. The execs will kill off the format and release a new system within a year. HD-DVD-2 or something like that.

Then, they'll just not give the keys to PowerDVD.

Note to all future hackers. Wait till you have critical mass before you release a crack.

Re:Not really cracked, more like circumvented

[Rufus211]

program's key (it would be in memory a short time probably if well implemented, but ultimately probably gettable, if the program can read it's own key, anyone can).

True, but they can make it extremely difficult to the point of absurdity. Only ever store parts of the key in memory. Load those parts from memory into registers and generate the key programatically entirely within a register. Once you're done with the key (a few 100 instructions) blow away that register.

In order to aquire the key you'd have to control the scheduler from within the kernel, schedule a context switch to occure exactly within the vulnerable window, and figure out which register actually contains the value you want. Certainly possible, but once you've gotten to that level of detail you've already reverse engineered the entire player so you can just calculate out the key ourself.

Re:Not really cracked, more like circumvented

[Anpheus]

It's an infinite regression of cats and mice, not turtles! But seriously, it seems to me a lot easier to find the function that performs the decryption, which should be easy to find because AES is a common algorithm, see which argument is the input key, and then insert assembly to output that key somehow, store it in a known location in memory, etc. Of course, then it would be their turn to respond by either revoking the key in new releases, or obfuscating the decryption function at a low level, etc. However, it still seems to me that it would be much easier to edit the machine code than to screw around with context switching and hoping to grab a useful pointer or the key itself. It sounds like the first battle was won, but it'll be interesting to see what the DRM guys do next.

Re:Not really cracked, more like circumvented

[SickLittleMonkey]

In order to aquire the key you'd have to control the scheduler from within the kernel, schedule a context switch to occure exactly within the vulnerable window, and figure out which register actually contains the value you want.

Um, this is usually called debugging. ;-)

SLM

Re:Not really cracked, more like circumvented

[dtfinch]

They have many keys now, one for each model of player. I don't remember the exact terminology, but the player private keys are used to decrypt the disk key stored on the disk. There are many copies of the disk key, each encrypted with a different player's public key. If they want to revoke a player, they just don't include a copy of the disk key encrypted with that player's public key on future disks. So that player can play old disks, but they'll need to replace it to play new disks.

Re:Not really cracked, more like circumvented

[Sancho]

The fallout from that would be pretty big. Even though only a few people have next-gen players (compared to, say, DVD or VHS) if people find out that the format was killed and replaced very quickly, they'll be hesitant to buy into the second format. Why should they, if the industry is so quick to obsolecense?

This is dangerous timing for all parties involved. The content providers want to make sure the format is secure, but they don't want to have to scrap it so soon. Revokable keys supposedly fixed this, but time will tell. PC players will always be crackable, if someone wants to spend the time to do it.

A more likely scenario is that they revoke the PowerDVD (if that's what he used) keys and refuse to reissue. Kill the PC format, settle the inevitable lawsuit (the cost to do this will be considered less than the piracy losses) and move on. Leave DVDs for PCs and next gen formats for standalone players that are far harder to crack. They shouldn't need to change the entire format.

Re:Not really cracked, more like circumvented

[deroby]

Not quite sure I understand how this works then =(

If each disk contains a (limited) set of keys, one for each model like you say, what will then happen when a new model comes out next year and I put my 'old' DVD-HD disk in there ?
=> the model didn't exist yet, hence, there is no key, hence, my 'newest' player can't play my 'oldest' movies anymore ? Or did they just foresee 10.000 keys and assign them to models as they get released ? (plenty of space on these shiny disks after all).

Additionally, wouldn't finding 1 private key (say for example from PowerDVD) allow for a (maybe not so brute as it seems ?) exhaustive search for all the other private keys of all the other players ? They might decide to 'disable' a certain key from a certain model, but I very much doubt they can keep on doing this ... I think.
(I guess if someone set something up like Distributed.Net for finding these keys, it wouldn't take that long to decrypt them all. After all, if you know the result, it's just a matter of trial & error. Yes it will be HUGE task (not sure how many bits the key holds, didn't watch TFA, nor am very educated on the subject) but the amount of CPU-power allocated to it might be tremendous here... Finally a "good" use for all those botnets =)

(I might be missing something (or even a lot) here ... )

Re:Not really cracked, more like circumvented

[mrchaotica]

PC players will always be crackable, if someone wants to spend the time to do it.

For very small values of "always," that is -- right up until the computers start implementing Trusted content paths, which will happen in a few months when Vista comes out. At that point, cracking the DRM could very well require looking at the innards of the TPM with an electron microscope.

Re:Not really cracked, more like circumvented

[mlk]

So if X cracks common-player Y, and I (and 1000s others) own player Y who replaces it when it gets "disabled"?

That is really worrying, I don't think I'll be buying into that just yet.

Re:Not really cracked, more like circumvented

[oggiejnr]

There was a method of extracting SSL Keys out of a web browser which may be able to be used here. It works on the principle that code is not random but crypto keys appear to be random. So in order to find the key in memory all you have to do is find the areas of the applications memory that has highest entropy and that is highly likely to be the crypto key.

Re:Not really cracked, more like circumvented

[javilon]

When a couple or three keys for _hardware_ players leak the content providers will have to make their minds up and decide if they revoke them.

If they decide to do so, I can tell you that the whole scheme will go down. There will be people with bought and paid hardware made useless. This will be a very good example when explaining to people why DRM is a problem.

Also, if I have learned something in this thread is that if you hack a player, you just have to keep it secret and only release the disk keys for every disk that comes out to the market. If the RIAA doesn't know what player has been hacked, they can't revoke its key. Having one player hacked will invalidate the whole schema as long as the RIAA doesn't know wich one is it.

I am the owner of a High Definition 50 inches TV, with only DVI input. That I see as a good thing. I will not be tempted by the new High Definition *paid* content. There is no way I will be paying another 3000 for a new set just because the content providers refuse to show their content on my perfectly good one. This is also a good way to explain people what DRM is about.

Re:Not really cracked, more like circumvented

[darien]

Surely I can just hack the player from within a virtualised Windows environment? (I mean, not me, obviously, but someone good at programming.)

Re:Not really cracked, more like circumvented

[Splab]

if it's already possible to decrypt blueray/hd-dvd, won't they have to wait for next generation untill next round? The fun thing is, the DRM guys gets one swing at it, while the hackers can poke around untill they beat it. It's a lost war.

Re:Not really cracked, more like circumvented

[sunny256]

If they want to revoke a player, they just don't include a copy of the disk key encrypted with that player's public key on future disks. So that player can play old disks, but they'll need to replace it to play new disks.

Oh, it's the MS Word method... "We need to make some money. Let's create a new format which the current version of the program can't read. All our current victi^H^H^H^H^H customers then have to buy a new version."

Re:Not really cracked, more like circumvented

[gutnor]

It was something like there is a premade tree of keys available from the beginning. Not all the keys are used.
The circumvented keys only get removed, nothing is added.

At least, that's what I remember. From memory, they were also talking about a hierarchical set of keys.

Re:Not really cracked, more like circumvented

[Kjella]

When a couple or three keys for _hardware_ players leak the content providers will have to make their minds up and decide if they revoke them.

If I recall correctly, the decision tree is very large (possibly down to a single player) so no, a few hardware keys released means only a few players will die. Of course, if you have a credible threat that you can keep posting new keys (should be too hard if you've found a method) then it's pretty much shot.

Re:Not really cracked, more like circumvented

[kruhft]

Soon, only criminals will posesess old systems...

Re:Not really cracked, more like circumvented

[cortana]

AFAIK that's how it works. Compare to DeCSS which has ~400 pre-generated keys, one of which is assigned to each manufacturer.

The difference with AACS is that there are many more keys--enough to have one per model of player. So it will be pretty easy for them to 'revoke' a compromised model of player by neglecting to include its key on future movie releases. Whether they will actually do so will depend on whether they think they can get away with it.

Re:Not really cracked, more like circumvented

[pla]

Of course, it's always going to be the case the key is in memory during playback, finding the address would be the pain

Not really... Even without any better strategy, you can narrow the potential range down QUITE a bit (within one process' address space), and exhaustively try every machine-aligned keylength-block in just a few seconds. And it would surprise me greatly if we can't do a whole lot better than that



and revoke keys in future pressings and force upgrades to software users.

Revocation accomplishes nothing (except, as with most DRM, annoying legitimate users) if the cracker can get the key dynamically. This problem WILL result in the eventual blacklisting of XP for HD content, at which point the protection of AACS will reduce to the security of Vista's kernel (ie, already cracked).



It's all about demonstrating clear intent to violate DMCA and take legal rather technical measures to 'deal' with the problem.

Bingo. Although it does look like they at least tried to make it somewhat hard this time, no solution (not even quantum) exists to the cryptography problem where "Bob" and "Carol" (the "man-in-the-middle") count as the same entity.

Re:Not really cracked, more like circumvented

[Opportunist]

In this case, the next targets are invariably the X360 and the PS3. Simply because neither Sony nor MS will simply sit and shrug when the content industry decides that their machines are no longer "worthy" of being supported. Both machines will have a significantly higher market share than any other single HDDVD/BluRay player line out there, so this would hit a significant market segment. And for both of those machines a lot of people are already and will be working on cracks and hacks, because of the chipping market for copied games.

Re:Not really cracked, more like circumvented

[bnavarro]

I believe that Microsoft already has debugging protection built into the kernel. From what I have read on other message boards, newer versions of Windows Media Player refuse to run if loaded into a debugger.

No, grandparent is right, this would require some sort of kernel level debugger. Unfortunately, once Win64 is mainstream, this might also be difficult or impossible for a hacker to create, since all kernel modules in Win64 will have to be digitally signed by Microsoft before they will run. Unless, of course, the digital signature for kernel modules is in turn cracked...

Re:Not really cracked, more like circumvented

[afidel]

Nope, unlike CSS keys AACS keys are revocable, so the keys for the cracked version of PowerDVD (or whatever player has been compromised) can be denied by new media. Basically they encrypt the media's decryption key with the public keys of all of the licensed devices and once a player has been compromised they no long use that tainted key (It's actually kind of the reverse of this process, but it gives you an idea of what they accomplish and the general idea of how). Of course if many players are compromised it is unlikely that the content companies will be able to revoke all of their keys, because that would lead to a backlash against the format as consumers devices suddenly stop playing new titles. What I'm personally waiting for is an industrious hacker to expose the key of a popular hardware player, forcing an upgrade of a software player is one thing, requiring naive users to upgrade the firmware of their hardware player is going to be labor intensive. Either they will need lots of helpdesk type staff, or lots of depot technicians to actually do the upgrades for the users. Either way lots of users won't figure out what the problem is and will simply blame the hardware vendor/format.

Re:Not really cracked, more like circumvented

[Splab]

The movie is encrypted with a single key, so if only the movie key gets put on the intarweb, they can't figure out what key to revoke. And as lots of others has pointed out, while in theory it sounds like a good solution to revoke a key, you can't do that in the real world.

Perhaps in the US where the consumer watch dogs are less fierce than those in my neck of the woods you can cripple a paid for product. But here in Denmark the company would be forced to ship replacement units should the key be revoked, and let's see how many times you can go do that until the consumers demand their money back (yeah, you can do that here if the product is broken for up to two years).

Even with the trusted hardware paths it's only a matter of time until the consumers realize what a bad thing DRM is. It's a lost fight, they should spend their money on making a better product rather than trying to find the holy grail.

Re:Not really cracked, more like circumvented

[mrchaotica]

Nope. The whole point of "Trusted" (more properly called "Treacherous") Computing is that you can't fool it because it requires access to the TPM hardware. Incidentally, this means virtualized Vista will not be capable of playing "protected" content unless the virtualization technology has a "hole" in it for the TPM, which probably means that the host environment would have to be "Trusted" as well. Unless I'm mistaken, it's probably also the mechanism by which the "lesser" versions of Vista disallow themselves from being virtualized.

Re:Not really cracked, more like circumvented

[gmack]

Or a load it in a virtual machine and debug that.

Re:Not really cracked, more like circumvented

[Anonymous Coward]

Older systems make Trusted Computing their bitch.

That's actually quite an insightful comment.

No matter how much DRM they try to cram down our throats, the fact remains that CD-audio, MP3, and other older formats will forever remain out of their grasp.

The new formats just can't compete with the old formats, because the old formats have the overwhelming advantage of being non-crippled.

The pirates are circumventing DRM; but the rest of us are doing something that's much more devastating: we're ignoring DRM. Try releasing a new player that doesn't support MP3 -- it will be dead on arrival.

Old versus New: it simply isn't a fair fight. Old wins without even trying.

Re:Not really cracked, more like circumvented

[m50d]

Unfortunately we're not quite there with video yet. If we'd had a couple more years DRM would be a lost cause, like it is with audio - CDDA is perfect as far as humans are concerned. DVD video isn't, and it's already got some (very weak) DRM on it. Unlike new audio formats, HD-DVD et al do offer a genuine improvement in quality. And this could be enough for them to succeed.

Re:Not really cracked, more like circumvented

[Junta]

Revocation accomplishes nothing (except, as with most DRM, annoying legitimate users) if the cracker can get the key dynamically. Well, the assumption is that the approved software they are using to acquire the keys won't manage to make it impractical to exploit it to grab keys. If they somehow manage it (cannot think of how they would, but I'm not in the field and this is for sake of discussion), the party is over for new pressings of discs. Of course if that key is extracted from/shared with a set top box, the industry would have to piss people off more thoroughly than just demanding a software update. On the other hand, I wonder if they mandate all boxes must be upgradeable, and any company who's key is compromised is required to send to customers update media...

Here's the other part I don't understand about the described methodology. Someone said in a nutshell that the disc's keys are stored encrypted in all the players' keys. If each vendor has their own key, what happens 6 months down the road when a new vendor gets into the market, needs a key, and wants to play already released discs? Or have they already allocated a whole bunch of keys and not released them?

Re:Not really cracked, more like circumvented

[Danse]

Unlike new audio formats, HD-DVD et al do offer a genuine improvement in quality. And this could be enough for them to succeed.

As someone else mentioned, HD-DVD's improvements are lost on about 95% of TVs out there today. People buying cheap new HDTVs won't benefit. You actually need a fairly good one that does at least 1080i. I don't see it as a real advantage for HD-DVD.

Re:Not really cracked, more like circumvented

[hardburn]

I thought this confusion was cleared up years ago.

RIAA = Music
MPAA = Movies

Although they share many of the same member corporations, they're not the same. The evil overloads in this case would be the MPAA.

Re:Not really cracked, more like circumvented

[Asm-Coder]

I understand your confusion over the pre-determined keys, but another post explained that.

However, You say you would like to do an exhaustive search for the other keys, but I'm afraid that won't work. They use public/private key encryption, similar to PGP. This system is designed to prevent you from discovering any other private key. Simply, the fact that we already have the key for the whole disk just saves us the trouble of trying each key against the disk, a very small detail. (however when repeated 10^128 times the time savings may be significant) However, the method to find this key may be applied to other players, I don't know.

I'm interested in further development in this project, although, I doubt that I ever find the need for HD DVD content myself. I like seeing the *AAs trip over them selves.

Re:Not really cracked, more like circumvented

[penguinbrat]

So what is to stop things when 1 DVD will play on player A and not player B, but another DVD will play on B and not A?

Re:Not really cracked, more like circumvented

[jZnat]

That's why we refer to them by the more accurate acronym MAFIAA (Music and Film Industry Association of America).

Re:Not really cracked, more like circumvented

[drdaz]

How about the other side of this coin? Are all the players that will ever be released now registered and their keys noted?

I ask since I assume a new player necessitates a new keyset, and thus a new player won't be able to play releases older than the date of it's release / key-generation + validation.

I admit I haven't looked at the spec sheets on the next gen video disks so I'm not sure if / how this issue is covered. /drdaz

Re:Not really cracked, more like circumvented

[ajs318]

And the best programming language in which to implement that would be 63% tin, 37% lead with five cores of rosin flux.

Muck about with the hardware. Take advantage of manufacturers' test points (they have to put in test points! If they stop putting in test points, it will be impossible to detect and correct faults; meaning anything that doesn't work first time will have to be scrapped, and that is going to drive prices through the roof). Underclock everything to manageable speeds. Gate the processor's clock, put the rest of the motherboard into WAIT, and poke about with the processor directly. Park the processor on a totally separate bus, where you can read out all the registers into your own bit of private RAM. It's got no way to tell you've been poking about under the bonnet, as long as you put everything back how you found it.

Something like a Multiface, in other words.

Re:Not really cracked, more like circumvented

[ajs318]

What stops you from emulating the TPM within the Virtual Machine? So the software thinks it's talking to a real TPM, but in actual fact it's talking to an emulated TPM.

Re:Not really cracked, more like circumvented

[mrchaotica]

You need a private key (or whatever bit of proprietary information -- I'm not an expert on this stuff), and you can't get one unless you're a member of the Trusted Computing Group. And even if you were a member, they wouldn't let you do something contrary to their goal, which this most emphatically would be.

Re:Not really cracked, more like circumvented

[justthinkit]

What I'm personally waiting for is an industrious hacker to expose the key of a popular hardware player

What I'm personally waiting for is revoked players appearing on eBay in "Like new!" condition.

Re:Not really cracked, more like circumvented

[Dare nMc]

in Denmark the company would be forced to ship replacement units should the key be revoked, and let's see how many times you can go do that until the consumers demand their money back

actually they just need to ship a firmware update. Currently their are just a few different HD Players, so that firmware updates could even be included on the HD/blue-ray movie disk. Although once the firmware updates are hacked as well the chase will get ever more difficult.

Re:Not really cracked, more like circumvented

[Splab]

No they don't. Mr and Mrs Denmark doesn't know how to use / apply a firmware upgrade. So when the movie won't play, something is broken and will be returned to whatever outlet they bought it from.

Ohh and auto updating firmwares? No way. All sorts of bad things happen if you loose power during upgrade. Besides, most places void warranty if a firmware upgrades screws you up. Doesn't sound like a good solution to me.

Re:Not really cracked, more like circumvented

[Pharmboy]

More importantly, 95% of the people just don't care how much better HD-DVD is better than DVD. DVD is plenty good enough on any TV for most people. Not everyone "desires" the coolest/biggest/fastest/bestest. Look, it was only this year that DVD players finally outnumber VCR players in the US.

DVD doesn't have snow, degrade, etc. On the newest, bestest TV's, DVD still looks great. I am not going to go out and buy all new copies of my old favorite movies again just for HD-DVD/Blueray/etc. and most people will not either. Think about it: Regular audio CD's have "much better" sound than MP3s, yet most people are plenty happy with MP3s.

Someone asked me the other day, "which format will win, HD-DVD or BluRay. I said "Neither. The format is irrelevent, it is the delivery system that matters now" which is why everyone is using bittorrent or pay per view.

Re:Not really cracked, more like circumvented

[ConfusedVorlon]

You don't need to _see_ a difference to _percieve_ a difference.

the placebo effect is a powerful thing

Re:Not really cracked, more like circumvented

[rabtech]

From what I can tell AACS either uses a different key for each model/version of a player or actually assigns individual keys to each individual player. I'm having trouble finding out from the documentation, but it would appear that revoking a very small set of users is possible with AACS, overcoming the chief reason the CSS revokation was never used: there were too few keys and revoking one would kill hundreds of thousands or even millions of players all at once.

Re:Not really cracked, more like circumvented

[Soul-Burn666]

Actually, they can revoke a key of a SINGLE player for a quite low cost.

It is done like this:
There are keys on the nodes of a binary tree where the leaves are each individual player.
Each player has all the keys on the route from the root node to itself.
In the beginning, the movie encryption key is encrypted using the root node key -> everyone can decrypt it.
When a player key is found and needs to be revoked they then stop encrypting using the root node but rather choosing to encrypt, multiple times, using the keys which are NOT on the route from the compromised player to root node.
For example:
            1
      2/ \3
    / \ / \
  4 5 6 7
/ \ /\ /\ /\
8 9101112131415

User 9 knows the keys 9,4,2,1.
Movies are originally encrypted with 1.
Everyone can decrypt it because they know key 1.
Lets say 9 is revoked.
Next movies are encrypted in multiple copies with the keys: 3,5,8
That way, everyone except 9 can decrypt the movie key.
8 has 8
10 and 11 have 5
6,7,12,13,14,15 have 3

It's actually a pretty neat system.
Surely, each single movie's key can be publicized, completely sidestepping the whole key-encryption system.......

Re:Not really cracked, more like circumvented

[jelton]

"Either way lots of users won't figure out what the problem is and will simply blame the hardware vendor/format."

If this happened to me, I'd blame the format even more if I knew what the problem was.

Re:Not really cracked, more like circumvented

[HTH NE1]

That could only happen if there was a race condition over when keys get revoked by different manufacturers, or if a revoked key becomes reauthorized. Having a single authority establish the key with which the title key is encrypted prevents that.

That is unless someone decides to create a player that refuses to play discs lacking any encryption (my bet is on Sony).

Re:Cheers!

[Anonymous Coward]

Not to me, it isn't. This will help speed up the adoption of these formats. I'd like them both to totally fail, due to their restrictive DRM. As long as the formats enjoy some success, the content providers will keep pushing for the strong DRM.

It takes a while...

[FuturePastNow]

The site's Farked, Digged, and everything else already, but here's the forum this was first posted to: http://forum.doom9.org/showthread.php?t=119871

It contains a download link to the program.

Re:It takes a while...

[interiot]

Duggmirror has a copy of the doom9 thread, as well as a link to the source code.

As another poster said, the package contains several title keys already extracted via some method. It's not clear how the author extracted the keys, or whether it's possible for the AACS people to revoke a player in order to prevent future keys from being leaked the way they currently are.

Re:It takes a while...

[minus_273]

AACS was designed so that keys could be revoked fro future titles.

Re:It takes a while...

[interiot]

I don't really know much about it, but keys included in the package are title keys (eg. download the source code, see Readme.txt and TKDB.cfg, and see the list of keys for specific titles: Full Metal Jacket, Van Helsing, Tomb Raider 1, Apollo 13, The Last Samurai, and The Fugitive). Those keys probably can't be revoked (those specific titles are already mastered and are in release). But do the included keys give the AACS people enough information to identify the specific player that the author is using to extract the title keys from?

Re:It takes a while...

[Anonymous Coward]

By giving out the actual per-disc keys, the guy has avoided the fate of the original decss hack which used a player key that was "revoked". Unless the "AACS people" can figure out what player key he used to get those disc keys, they can't revoke it, though they can re-author the disc with a different disc key for the next batch (which one supposes could be leaked the exact same way as the first, whatever that way is).

(For those that don't know, every disc's content is encrypted with a key particular to that disc. That key is then encrypted repeatedly with all of the device keys that are currently authorized to play that disc. Presumably there are dozens or hundreds of spare unassigned device keys in there for future use, as well. Thus, the player uses it's device key to decrypt the matching copy of the disc key, then uses the disc key to decrypt the disc. In the DVD days, device keys wouldn't be "revoked" as such, they would simply quit being used on new discs, so the device could play all old discs, but would be unable to get a disc key for new ones. Not sure if AACS actually added an actualy revocation list for device keys that would completely disable the device, as it is apparently able to do for other cryptographic keys like the HDCP keys)

Re:It takes a while...

[qbwiz]

Wouldn't it suck to have your HD-DVD player stop working for new titles, because someone was using its key? Or are all HD-DVD players networked, so their keys can be changed at any time?

Re:It takes a while...

[evilviper]

AACS was designed so that keys could be revoked fro future titles.

So was DVD CSS...

Would you care to guess how well that worked?

Re:It takes a while...

[interiot]

Most likely the author was using a PC-based software player, so most likely, legitimate end-users just need to download an update to be able to play new movies. (the update would both include new player keys, and an attempted fix for whatever way people are pulling title keys from the software)

Re:It takes a while...

[skiflyer]

oooo yeah, that's going to be a great way to help the adoption of HD-DVD/BluRay right now.

Sorry your brand new laptop with a built in drive won't play the newest movies, but some people have hacked the software on your laptop, yes that's right the software we licensed and approved, and now you must update the same software with new keys to watch new movies.

AKA, you're on an airplane, you have no connection, and things just plain don't work.

Re:It takes a while...

[Datasage]

True, but whats to stop a key from a hardware based player from being compromised? You could release a firmware update, but how many people would expect to install it?

If a large number of device keys become compromised, revoking all of them would be a nightmare. I don't see how its possible to keep a key secret forever. Especially in software.

Re:It takes a while...

[Jeremy Erwin]

But CSS can be brute forced. Although it uses a 40 bit key, flaws in the algorithm reduce it to about 25 bits strength, and the correct key can be found in 18 seconds on a PIII-450. It doesn't rely on anything that can be revoked.

We don't know if this system is as vulnerable to such an attack. Key revocation could protect future titles from this particular program.

Re:It takes a while...

[bigberk]

Wouldn't it suck to have your HD-DVD player stop working for new titles, because someone was using its key? Sure it might suck, but it's one of those little annoyances we live with because we know that Theft is Theft. We're only too happy to pay for a product and then have it cripple apart before our eyes. Sure, I might no longer be able to use the equipment I paid big money for, but will sleep comfortably at night knowing that at least the companies have protected their profits, just a little bit.

Re:It takes a while...

[mrchaotica]

I was under the impression that DeCSS came with a key, rather than using an algorithm to brute-force the key.

Re:It takes a while...

[sxpert]

That key is then encrypted repeatedly with all of the device keys that are currently authorized to play that disc.

This is a classic error in cryptographic software implementation, that can lead to revealing of all keys.
once you know the title key, you can then get all the player keys by using a known plaintext attack... and instantly crack all keys encoding your title key

Re:It takes a while...

[RAMMS EIN]

``Wouldn't it suck to have your HD-DVD player stop working for new titles, because someone was using its key?''

Yes. That was my first thought, too. But then, by acquiring a player, you subject yourself to the rules of the game. Note that this is nothing new; it applies to any system where you get a key that They can revoke. This was happening on Battle.net years ago, and has been happening with Windows Genuine Advantage, too.

Re:It takes a while...

[Splab]

Yes, but in this case you don't have one legal user for every compromised key, you got thousands, if not millions potential users of a single key.

Re:It takes a while...

[simm1701]

Actually thats only true in secret single key cyphers - having the plain text (the disc key) and the cypher text (the encrypted disc key) gives you a point of comparison.

Obviously if you are using something like a ceaser cypher its now trivial to get the player decryption key.

With public/private key cyphers you are given the public key. This means you can have an unlimited number of plan text, cypher text pairs and in theory it will still not get you any closer to discovering the private key than when you just had the public key.

I doubt that these data points will be particularly useful in decoding the entire collection of player keys.

However given the size of zombie networks out there.... what do you think profession dvd pirates are going to do?

Re:It takes a while...

[Kjella]

Would you care to guess how well that worked?

Actually, they did revoke DVD-Jons key (from the very first DeCSS 1.0), but since the key was only 40 bit and using a terrible algorithm which reduced it down to pretty much instant brute force the whole system was broken. If the algorithm had been published, it would have been broken before the first player hit the market.

This time they're using 128bit AES, so if a single key is compromised (say, stolen from a production facility) the revocation will work. Obviously, it won't work very well if you have a method so you can keep getting new keys, or if you just release title keys without revealing which player is compromised etc., but the revocation itself will work - if they find a compromised key, they can revoke it.

Re:It takes a while...

[cortana]

I think that is correct. It's libdvdcss that brute-forces the key during playback.

Re:It takes a while...

[IamTheRealMike]

Yes. The major difference between AACS and CSS is that every player in the world can have a unique key, rather than just the 20 or so keys that CSS used. If PowerDVD is not adequately protecting the key then it will be barred from accessing new titles and a software upgrade will be required for PowerDVD players. For hardware DVD players, the key is usually far better protected anyway, but if it is somehow extracted then a firmware reflash and/or a physical hardware swap (paid for by the manufacturer) is the way it'll be done.

Basically, the summary is totally misleading, as per usual with Slashdot + DRM. AACS has not been cracked. A single badly protected player was cracked and its key will be revoked, as the AACS spec provisions for. The scheme was designed to be "damage resistant" and that's what we're seeing at work.

Re:It takes a while...

[afidel]

Actually, if they are title keys then it probably is NOT enough to finger the player. The player key is used to decrypt the title key, which is used to decrypt the content. The content is only encrypted with one title key, and has no relation to the player key. So as long as you only release title keys there is no way for them to know what player(s) have been compromised. Of course most hackers will probably release their findings as cracks to the software program, but eventually a smart one will simply setup a CDDB style database with title keys and any program will be able to read the media ID, download the title key, and use the reference decoder implementation to decrypt the content. THAT is how you get around key revocation =)

Re:It takes a while...

[squiggleslash]

Of course, unless there's truth in advertising, the people "subjected to the rules of the game" will be completely unaware there's a game to begin with.

Imagine, in 2009, buying an HD-DVD, and having to check the list of players listed on the back under "This disc will not play under the following players". If only two or three keys get compromised, this might be managable, but...

Contrary to what has been claimed above, CSS had the same mechanisms in place. Supposedly AACS makes this more practical because there are more keys, and therefore keys can be assigned to each model of player, and because some NG DVD players will have mechanisms to update themselves. In practice, this is absolute rubbish. Half the people buying such devices will not be able to set up those mechanisms, most of them find it hard enough just setting up a DSL connection, and revoking a key will be a major issue that will effect huge numbers of people. Any attempt to revoke keys, especially for more popular players of the type that are the most likely to be cracked due to sheer numbers, will cause permanent damage to the credibility of the format.

What a terrible idea you've come up with, MPAA. The sooner you and your DMCA promoting selves self destruct the better.

Re:It takes a while...

[Jeremy Erwin]

Strictly speaking, decss is a windows program (often distributed without source) that decrypts some DVDs onto the hard drive. libdvdcss is the truly interesting library.) Granted, decss was useful in writing linux dvd players-- it provided test data while kernel hackers implemented the necessary key exchange algorithms, but it's obsolete.

Windows already has dvd players, libdvdcss allowed people to write their own for linux, freebsd, etc. Decss can be defeated through key revocation. libdvdcss cannot.

Re:It takes a while...

[tinkerghost]

Actually you do have some good data points already.

If you have 1 cracked system key & the title key, and copies of the same title key encrypted with 199 other system keys it becomes trivial - though tedius to find the other system keys. That's how public key encryption works - it's not impossible to find the key - it just takes longer than is worth it. Now if a couple of other system keys get cracked, then some of the bright boys with math degrees will start looking at how the system keys were generated to begin with - that lets you narrow down the numberspace you have to look in for the remaining system keys.

Alternately, the fun stuff starts happening when you get to grab all of the title keys for the current titles. Once you have those, you can try to determine the routine for creating the title keys in the first place. Knowing the keygen routine, you can probably get the numberspace down to something suitable for brute force cracking on a per title basis.

Re:It takes a while...

[simm1701]

But the hardware key wasn't cracked.

It was decoded by a piece of software, the result held in memory and this result (ie the disc key) pulled out of memory

So all you have is the title key and lots and lots of copies of the title key crypted by various hardware keys that you dont know

Re:It takes a while...

[minus_273]

i love these slashdot replies where smartass idiots reply with the dumbest stuff. Read a little about AACS the people who made the thing are not idiots.

Re:It takes a while...

[ender-]

Wouldn't it suck to have your HD-DVD player stop working for new titles, because someone was using its key? Or are all HD-DVD players networked, so their keys can be changed at any time?

I'm going to laugh especially hard when the keys for the HD-DVD addon to the Xbox 360, and the BlueRay player in the PS3 are compromised. Does anyone really believe for a moment that Sony [for instance] would be crazy enough to revoke the key to the PS3? If they revoke they key, causing PS3 owners to be unable to play new BlueRay titles, it would be a PR nightmare, possibly killing both BlueRay *AND* the PS3, which are Sony's two biggest products at the moment.

If they choose not to revoke the key they would be hard-pressed to justify revoking any other compromised hardware keys lest they be seen as highly hypocritical, also possibly killing the format.

I suppose there would be a chance that PS3 sales surge as it becomes the player of choice for ripping High-Def movies. But does Sony really want to take that chance? The MPAA wouldn't be too happy to hear that Sony was staking its future sales on the hopes that people will use the PS3 to get around all the protections the MPAA has tried to put on the format.

Re:It takes a while...

[swillden]

Actually thats only true in secret single key cyphers - having the plain text (the disc key) and the cypher text (the encrypted disc key) gives you a point of comparison... With public/private key cyphers you are given the public key. This means you can have an unlimited number of plan text, cypher text pairs and in theory it will still not get you any closer to discovering the private key than when you just had the public key.

This is incorrect.

The feasibility of a known plaintext attack is the same for both symmetric (secret key) and asymmetric (public key) ciphers -- if the cipher is any good at all, then the best possible known-plaintext attack on the cipher is a brute force search of the keyspace.

If there's any hint that there may be a known-plaintext attack that is faster than brute force, the cipher is considered utterly broken, completely unusable, and is discarded. AES is not broken.

Since known-plaintext attacks are too hard, cryptanalysts analyzing ciphers for weaknesses use a whole bunch of other attacks that attempt to stack the deck in their favor in various ways. Some of them are:

• Chosen plaintext. The attacker gets to choose the plaintext and use it and the corresponding ciphertext to try to break the cipher and recover the key. Some ciphers are weaker for some plaintext inputs, potentially allowing some bits of the key to be recovered.
• Chosen ciphertext. The attacker gets to choose the ciphertext and use it and the corresponding plaintext to recover the key.
• Chosen key. The attacker gets to choose part of the key, and usually either the plaintext or the ciphertext as well, and uses all of that to try to recover the rest of the key.
• Related key. The attacker gets to define a new key that is related in some specific way to the (unknown) target key, as well as some ciphertexts or plaintexts.
• Reduced cipher. The attacker modifies the cipher to weaken it, then attacks that, often with chosen plaintext or ciphertext.

If a cipher can be broken faster than brute force by any of these approaches it's considered broken and not usable -- even if the "faster than brute force" is still so computationally intensive it's infeasible. Well, for the last one it depends how much the cipher is reduced. Any symmetric cipher can be broken if you weaken it far enough, but there comes a point where the reduced variant is sufficiently distant from the full version that the break isn't considered cause for concern. A cipher that's weakened only slightly and is broken is considered highly suspect on the theory that someone may find a way to extend the successful attack to the full cipher.

Anyway, the point is that known plaintext attacks aren't going to be of any assistance against AES, and PK ciphers are no different from symmetric ciphers in this respect.

Re:It takes a while...

[swillden]

If you have 1 cracked system key & the title key, and copies of the same title key encrypted with 199 other system keys it becomes trivial - though tedius to find the other system keys. That's how public key encryption works

This is not public key encryption, it's symmetric encryption (AES).

it's not impossible to find the key - it just takes longer than is worth it.

This is correct. It takes much, much longer than it's worth. In this case, the full computing resources of the planet for millions to billions of years. Barring an exploitable weakness in AES, of course.

Now if a couple of other system keys get cracked, then some of the bright boys with math degrees will start looking at how the system keys were generated to begin with - that lets you narrow down the numberspace you have to look in for the remaining system keys.

Very unlikely. Generating good random numbers is fairly easy. Get a source of randomness (doesn't even need to be uniform), grab lots of bits and hash the result with a decent secure hashing algorithm to ensure uniformity. If you're using a Linux box, "cat /dev/random" will give you plenty of very random numbers, for example.

Alternately, the fun stuff starts happening when you get to grab all of the title keys for the current titles. Once you have those, you can try to determine the routine for creating the title keys in the first place. Knowing the keygen routine, you can probably get the numberspace down to something suitable for brute force cracking on a per title basis.

You're confusing AES keys with the registration keys used for software. Registration keys have structure, and must be created in a certain way so that their validity can be checked. Any 128-bit number is a valid AES key, there is no structure to them, and they should be generated by a true random number generator, which means the whole space is equally valid, and brute force searches have to check all of it.

Re:It takes a while...

[IamTheRealMike]

Centralised databases are pretty easy to shut down though. Even if you host them in Russia, or whatever, they can be blocked at the ISP level in the West.

Re:It takes a while...

[swillden]

If there's any hint that there may be a known-plaintext attack that is faster than brute force, the cipher is considered utterly broken, completely unusable, and is discarded.

This is overstated. But only a little.

Re:It takes a while...

[jZnat]

Why would ISPs care about people downloading tiny little keys for their HD content? As long as said ISP isn't also a producer/distributor of HD-DVD or Blu-ray content, I don't think they'd give even the slightest shit.

Re:It takes a while...

[jZnat]

what do you think profession dvd pirates are going to do?

The same thing they always do: make exact copies of the discs in the same factories that make the legitimate copies.

Re:It takes a while...

[tinkerghost]

The 1 cracked system key and the title key allow you to verify a successful hit on one of the other 199 keys. Without that, you would have to move to actual decrypting of the disk to verify the success.
The AES keys for the both the system and title keys are pseudo random 128 bit keys. One of the requirements is that the keys be "Unique" otherwise the deactivation of 1 key may kill more than 1 device/title. Generating random numbers is easy, generating "unique random numbers" is usually more complicated and is usually governed by a formula of some sort - which may or may not be discoverable based on the available dataset.
As for the last bit, any 128 bit number is valid, but not all 128 bit numbers are equally likely - depending on the method of generating the random number. That was the point, if you can rule out certain pieces of the numberspace by making educated guesses as to the algorythm used to make the keys, then you can greatly reduce the time to hit a key, and perhaps refine your next run. That was my point, not that you could hit the keys fast, but that with a dataset, you may be able to reverse engineer the varying number spaces and reduce the boundaries of the search.
It's my understanding that Mercene primes fall according to a formula that indicates where - roughly - they should fall in the overall numberspace. The formulas don't tell you what the number is, just where to go looking. That was the the understanding and intent of my comment.

Re:It takes a while...

[swillden]

The 1 cracked system key and the title key allow you to verify a successful hit on one of the other 199 keys. Without that, you would have to move to actual decrypting of the disk to verify the success.

Which means nothing, for two reasons.

First, it means nothing because the keyspace is far too large to be searchable, so having a quick way to test your trial encryptions is irrelevant.

Second, it means nothing because you wouldn't have to decrypt the whole disk to test a key -- just decrypt one block and see if it has the right packet structure. If so, you've found the key with very high probability. In that (very rare) case, decrypt a second block.

The AES keys for the both the system and title keys are pseudo random 128 bit keys.

Why do you assert that they are pseudorandomly generated, rather than generated from a true random number generator? How do you know that? And if you know that, what PRNG was used?

One of the requirements is that the keys be "Unique" otherwise the deactivation of 1 key may kill more than 1 device/title.

Irrelevant. When choosing 128-bit numbers at random, you don't need to worry about every getting duplicates. The odds are so infinitesimally small that you can very safely ignore them.

Generating random numbers is easy, generating "unique random numbers" is usually more complicated and is usually governed by a formula of some sort - which may or may not be discoverable based on the available dataset.

As I said, there's no need to assure uniqueness. If you did for some strange reason need to absolutely guarantee uniqueness (e.g. the world would explode if you used the same number twice), then there are more than enough bits to fix a few in order to assure cross-vendor uniqueness without seriously impacting the practicality of brute force searches.

You have to keep in mind that 2^128 is a very, very large number.

As for the last bit, any 128 bit number is valid, but not all 128 bit numbers are equally likely - depending on the method of generating the random number.

Unless those generating the numbers are idiots, yes, they're all equiprobable.

It's my understanding that Mercene primes fall according to a formula that indicates where - roughly - they should fall in the overall numberspace. The formulas don't tell you what the number is, just where to go looking. That was the the understanding and intent of my comment.

That is a true statement about Mersenne primes, but it doesn't have any bearing on this discussion.

Re:It takes a while...

[tinkerghost]

Why do you assert that they are pseudorandomly generated, rather than generated from a true random number generator? How do you know that? And if you know that, what PRNG was used?

Please describe the mathematical theory you use to generate a true random number?
As to your point on why uniqueness is irrelevant, yes, in a practical sense it is. The point is that hardware suppliers and media empires aren't practical. The people who make these decisions don't see that the key is 128bits long and that that translates to 2^128 possible choices. They see that there is the possibility (remote is irrelevant) that they could be harmed by someone else's key being revoked. I have talked to people who make big business decisions, after the numbers go from big to huge, they seem to scale everything back to where they are comfortable. Thus "less likely than dying of heat stroke naked, at the north pole, in december" gets the response - "that bad?" They are not going to go for "It's not likely" they want to hear "no" so the keys are going to be required to be unique - it's a business thing not a math thing.
Combine the 2, you get a formula - somewhere - to generate keys. I didn't say reverse engineering it would be less work than just brute forcing the codes, but given the lack of effort put into the CSS keys, it's not inconceivable that it would be.

Re:It takes a while...

[swillden]

Please describe the mathematical theory you use to generate a true random number?

You don't do it with mathematics, you do it with physics. There are lots and lots of sources of noise in the world, many of which derive their randomness from quantum mechanics. Just pick one and start grabbing bits. Most hardware TRNGs use either a noisy diode or thermal noise, but you can also use radioactive decay, atmospheric noise -- even a lava lamp!

Even without going quite that far, the method used by /dev/random is good enough that no one has been able to find a way to predict it, even when manipulating the environment in order to try to influence it. By "predict", I mean: A function f is a predictor of a random variable X if f(i)=X_i with p > 0.5. The source of the true randomness used by /dev/random is a variety of semi-random sources, such as disk seek times, keypress intervals, mouse movements, network packet arrivals, etc. All of those sources have elements of predictability, but hashing smears out the predictability while retaining the entropy, and there are statistical techniques to estimate the amount of entropy with reasonable assurance. /dev/random does all of this, and limits its output flow to less than the estimated entropy gathered.

As to your point on why uniqueness is irrelevant, yes, in a practical sense it is. The point is that hardware suppliers and media empires aren't practical. The people who make these decisions don't see that the key is 128bits long and that that translates to 2^128 possible choices. They see that there is the possibility (remote is irrelevant) that they could be harmed by someone else's key being revoked. I have talked to people who make big business decisions, after the numbers go from big to huge, they seem to scale everything back to where they are comfortable.

It's vanishingly unlikely that businesspeople are involved at all in the definition of the key generation process. The technical specifications and implementations are created by engineers they hire. Go read the specifications and then tell me that businesspeople wrote them ;-)

Combine the 2, you get a formula - somewhere - to generate keys. I didn't say reverse engineering it would be less work than just brute forcing the codes, but given the lack of effort put into the CSS keys, it's not inconceivable that it would be.

I would bet good money that there is no such formula. And note that there was no "lack of effort put into the CSS keys" -- the CSS keys were fine. The problem with CSS is that the cipher is weak, so it's possible to recover the key with a smidgen of known plaintext and a few seconds of computation on a low-end PC.

Oh, and if there *was* a formula, reverse engineering it would almost certainly be less work than a brute force search of the keyspace. If it existed, the best way to get it would be rubber hose cryptanalysis -- which is a good reason for the designers of the system to avoid such a formula.

Re:It takes a while...

[tinkerghost]

I would bet good money that there is no such formula. And note that there was no "lack of effort put into the CSS keys" -- the CSS keys were fine. The problem with CSS is that the cipher is weak, so it's possible to recover the key with a smidgen of known plaintext and a few seconds of computation on a low-end PC.

Actually the 40bit key was reduced to a 32[iirc] key due to an error in the keygen routine. Similar to Sprint's encryption on one of their phones being 24 bit encryption - with the first 10 bits always being 0.

Re:It takes a while...

[swillden]

Actually the 40bit key was reduced to a 32[iirc] key due to an error in the keygen routine.

Do you have a reference for this? I've followed the CSS saga closely and read most of the original cryptanalysis papers and this is the first I've ever heard of CSS keys being generated algorithmically, much less that keygen having a flaw that reduced the effective key size.

In any case, there would be no need to exploit the keygen (if it exists, which I doubt) because there's an O(2^25) attack on the cipher itself.

Similar to Sprint's encryption on one of their phones being 24 bit encryption - with the first 10 bits always being 0.

Do you have a link to this? Was this on Sprint's CDMA phones, or GSM? I suspect that you're referring to the A5/2 cipher used for GSM and, again, the keys are random (though small -- 40 bits) and the cipher is so weak that it can be broken in real time. There's no keygen used for A5/2 (or A5/1) keys. If you're referring to something else, I'd like to read about it.

Re:It takes a while...

[ben there...]

Yeah, but these "databases" will be extremely tiny. Think "up to a couple megs". Give it a standard format, a few namespaces and version numbers and just distribute it any way possible. Rapidshare, overseas hosting, P2P, IRC, anything... Eventually a couple cracker groups (the "namespaces" mentioned previously) will maintain a consistently versioned database that just grows, accepting keys from anyone to keep it up to date.

Re:It takes a while...

[evilviper]

i love these slashdot replies where smartass idiots reply with the dumbest stuff.

So much so that you decided to craft one, yourself?

Read a little about AACS the people who made the thing are not idiots.

I've read plenty about AACS, thanks. They're not idiots, but they aren't magic either.

They can't just revoke a key, and magically do away with this particular circumvention technique, as you so audaciously asserted (without any facts to support your claim, of course).

Re:It takes a while...

[jZnat]

Does the DMCA cover this? The ISPs would argue "Common Carrier", and I think they have a much larger influence in government and politics than the MAFIAA...

Well and good...

[Ekhymosis]

But I would like to know how this will affect the customer as well. I know short term that DRM is bad and all, especially with the "where there's a will, there's a way" mentality in cracking it, but seeing as how these companies invest (or rather waste) millions in copy protection schemes, will they jack the prices up to cover the cost of their mistakes? I think this practice has become mainstream, no?

Re:Well and good...

[Mieckowski]

They set the price to maximize their profit, it doesn't have anything to do with the cost. If they could make more money by raising prices, they would (in reality people would probably by less DVDs).

Re:Well and good...

[Tweekster]

at 30 dollars a title they wont have all that much raising prices and being a successfull format. hell hd dvd and bluray are both up for grabs whether they will even be relevant in a couple of years.

Re:Well and good...

[bm_luethke]

Partly it is going to depend on how long you consider "short term" and "long term".

As of right now, and (in my opinion) another decade or two, there will be a VERY high dollar fight the industry will put on. Both legally and Technically, personally I think we have only seen the tip of the iceberg of what they are going to end up trying to do. Legally I do not know how far it will go, so far the industry sponsored bills pass near unanimously, so while many here like to blame one side the reality is that there is nothing close to a winner on each side (one talks good, but when it comes time to vote doesn't follow through).

During that time period I expect prices to continue to rise (compare the HD disks to DVD's) and quality to degrade (can not take the risk given the cost) and the burden on the consumer to become fairly high (see current state of HD - will my player work with my TV or not?). In the long term (decades) not good. The industry is already starting to see it in declining profits. From what I can tell, you call this "long term" and I call it "short term".

There has to be some case where things are going to stabilize. It is impossible to create something people can view and keep it secretly encrypted where it can not be copied. So, at some point that *has* to become accepted reality. Will they eventually understand this and adapt, or will they be replaced by something that does? Dunno, my money is on eventually adapting, or at the least when the Next Great Thing comes along immediately get absorbed (see video rental stores).

Re:Well and good...

[Dachannien]

They're already suffering gazillions of dollars in annual losses due to piracy, if you believe the content cabal. You'd think that would already be priced in, and a successful DRM scheme would cause prices to drop from their current levels.

Of course, when you consider that this is an industry that claims they're protecting artists/performers/actors/crew/etc. and then stabs them in the back by trying to cut their royalties, I think we can rest assured that your prediction will come true.

Wrong conclusion...

[im_thatoneguy]

The correct conclusion is: 'Finally! Now I don't have to buy an HD-DVD Player.'

I don't mind purchasing an HD-DVD and then just downloading its illegal doppelganger. I DO mind purchasing an overpriced paperweight to keep me legal. I looked at Xbox Live Marketplace from the perspective of:

"Rent 44 HD movies. or Buy HD-DVD Player and a movie." I decided I would get much more HD goodness out of downloads than just a player.

It's sort of like the way I purchase Star Trek for my Xbox and then download a copy for my PC as well. Sure it's illegal, but I look at it from the perspective of: I purchased it so that I could watch it, and watch it I shall.

Re:Wrong conclusion...

[farble1670]

It's sort of like the way I purchase Star Trek for my Xbox and then download a copy for my PC as well. Sure it's illegal, but I look at it from the perspective of: I purchased it so that I could watch it, and watch it I shall.


"I don't like the DUI laws, so drink and drive I shall!"

"I think I deserve more pay, so embezzle I shall!"

"I don't have a problem with heroin, so deal it i shall!"

The most basic acceptance test of any moral or social philosophy is whether it can be applied generally. Yours boils down to: I do what I think is correct. Okay, but please don't call the cops when someone punches you in the face and takes your wallet, because I am sure that it was a perfectly acceptable action to the perpetrator. After all, they really needed the $20 and it's an insignificant amount of $$$ to you, and your nose will heal.

I don't like the way things are going either, but your only morally defensible position is to not purchase your Star Trek movie in the first place if you do not like the implicit agreements attached to it. Go ahead and violate the agreement, your not in the minority in doing so, but please, leave out the lame justification for your actions.

Re:Wrong conclusion...

[Paul Jakma]

Sure it's illegal,

Actually, no, that's not sure at all.

Re:Wrong conclusion...

[spire3661]

Again here we are. The gulf between media and licenses. He paid for legal license to watch said performance. Why on earth should he be charged full price to watch the same performance in a different format. If we could find a way to separate license and format, the digital age could truly begin. But the media companies dont want to make the license and the media separate. If I buy a HD-DVD, and I want a DVD copy of it, I should be able to get one at the cost of manufacturing the MEDIA , not the media AND the license. I could go on and on, but the point is, beyond value added pieces to new formats, the license should be sufficient to be able to watch that performance anywhere, in any format.

Re:Wrong conclusion...

[Chandon Seldon]

There's nothing morally wrong with downloading the content and watching it. It's *data* - not only that, it's an element of our culture. How could accepting someone's offer to share culture be wrong?

Re:Wrong conclusion...

[Ironica]

I purchased it so that I could watch it, and watch it I shall.

"I don't like the DUI laws, so drink and drive I shall!"

"I think I deserve more pay, so embezzle I shall!"

"I don't have a problem with heroin, so deal it i shall!"

Uh... if you really think that drunk driving, embezzlement, and drug dealing are on par with activities which are technically illegal under DMCA, but actually covered within exceptions to copyright (what the OP is talking about is analogous to making a cassette tape of a CD so you can play it in your car), I gotta wonder where you get your crack.

Re:Wrong conclusion...

[j-turkey]

The most basic acceptance test of any moral or social philosophy is whether it can be applied generally. Yours boils down to: I do what I think is correct. Okay, but please don't call the cops when someone punches you in the face and takes your wallet, because I am sure that it was a perfectly acceptable action to the perpetrator.

You make a good argument, and I've heard it before. However, black and white interpretation of the law tends to fail (especially when you equate morality and law). I'll fall back on an analogy here: If you drive, do you ever speed? The law says that you cannot drive at a rate higher than the posted speed limit. However, on most major US highways, traffic tends to move at around 5% higher than the posted speed limit. Driving at the posted speed limit would cause a dangerous situation, whereas operating your vehicle in a manner consistent with the flow of traffic is a safer way to travel. Is speeding immoral? If so, should we just not drive until everyone else slows down?

Many people make informed decisions to break the law. Whether or not this is a conscious act of civil disobedience, it is (in many cases) still a form of civil disobedience. Putting this into the context of the American alcohol prohibition, a large scale amount of civil disobedience fueled organized crime to fulfill the demand for alcohol, and the law was eventually shown to be unreasonable. A freedom limiting law was abolished because sufficient numbers of people chose to break that law. This did not cause any crumble of society, and did not turn morality upside down.

In any case, I respect your position, but disagree with your absolute reasoning. IP license violation isn't the same as DUI, and it's not punching someone in the nose and running off their wallet. Laws like the American DMCA have unjust provisions. The grandparent poster is acting in good faith, and harming nobody. Perhaps the gpp is partaking in a phenomena of culture redefining law.

Re:Wrong conclusion...

[im_thatoneguy]

I would equate it with using an FM transmitter to transmit from my mp3 player to my radio. In a way, I've created an analog reproduction to play on a secondary device. If you wanted to, I'm sure an argument could be made that I created a reproduction and broadcast it to the public. And yet it's illegal to digitally 'transmit' a program to my non-component-accepting PC monitor. If I could, I would just plug my Xbox straight into my monitor, unfortunately that's impossible, therefore, my 'Component Cable' is The Internet(tm).

Also I call bullshit on your challenge of: 'The most basic acceptance test of any moral or social philosophy is whether it can be applied generally.'

By that reasoning all I have to do is create a counter example of a generalized accepted 'moral' principle to undo the original statement! Wow I bet this will be hard... oh wait...

How about:
"Holding someone against their will is illegal, therefore prisons are illegal."
"Men should be free, therefore they can do whatever they want and laws shouldn't exist."
"I must follow the law in order for society to function, even if the law requires me to murder my grandmother with a blunt instrument."

So as I hope can you see kids, things should only be applied generally when indicated. Otherwise, what's not prohibited is permitted seems to be a pretty general rule our society lives by.

And to quote Star Trek TNG. "There can be no Justice in Absolutes!" (moments after Picard busts Wesley out of some draconian Nazi paradise.)

Re:Wrong conclusion...

[mrchaotica]

Hey, ignoring the stupid law worked for Prohibition!

It just goes to show that there's a huge difference between some nominally illegal act being acceptable to a few people and being acceptable to nearly everyone. In the long run the DMCA cannot stand, because breaking it is indeed acceptable to nearly everyone.

Re:Wrong conclusion...

[walt-sjc]

When I buy a DVD, I buy a disk that has a movie on it - not a license.

Re:Wrong conclusion...

[Anonymous Coward]

When I buy a DVD, I buy a disk that has a movie on it - not a license.

I believe the company that manufactured that disk disagrees with you.

You might not realize this but but your statement doesn't do anything to clarify what you own -- Do you actually own the disk? Can that ownership be revoked? Are you entitled to a copy of the disk if that disk is damaged or destroyed? Do you own the contents of that disk? Are you licensed to watch the contents of that disk? Are you no longer a licensed viewer of the contents of that disk when that disk is no longer viewable (destroyed/damaged)? Are you licensed to show the contents of that disk to non-licensed viewers? Can you charge non-licensed viewers for the privilege of viewing the contents of that disk? Can you derive profit from displaying ads from showing the contents of that disk? Can you copy the contents of that disk? Can you copy and change the format of the contents of that disk? Can you destroy that disk? Can you resell that disk? Can you resell that disk after having made personal copies of that disk? Can you copy portions of that disk to create derivative works? Can you distribute dirivative works from that disk? Can you charge people to watch works created from derivative works from that disk?

By the way... you're an idiot. Think harder in the future. Thanks.

Re:Wrong conclusion...

[Geccie]

I agree with your conclusions and would like to add the following insight. Whether or not a law is broken fairly easy to distinguish. Driving faster than the speed limit is speeding which is breaking the law.

However, just because a law is broken does not mean a crime has been committed, nor that the person who broke the law should be charged with breaking that law. They can be charged rather than must be charged

Consider two cases of J-Walking where one causes an accident and the other occurs without incident. In all likelihood, the person that caused an accident would be charged with J-Walking and the other would not have charges brought.

This gives a lot of leeway, and potential abuse of power, to the persecuters in our litigation systems. It also gives them the ability to bring, and subsequently drop, alot of charges in exchange for a plea agreement which basically means they own your ass.


Geccie

Re:Wrong conclusion...

[Dunbal]

DUI, embezzlement, drug dealing. Those are pretty extreme examples you put there, examples that could put life and limb at risk, or cause great financial hardship to someone.

I wonder why you didn't compare this to something like jaywalking, or not feeding a parking meter instead? Tell me, are you a MPAA shill, or are you one of those people who were "put out of work" by piracy?

He paid for the damned movie. Having to pay again and again and again for the same crap just to see it in a different format is extortion. Why doesn't Hollywood allow him to download the movie direct, iTunes style, in the format he wants, in return for a small fee? Because they are milking this cow until it dies.

Re:Wrong conclusion...

[jedidiah]

> I believe the company that manufactured that disk disagrees with you.

What that company would like to believe doesn't mean squat.

They would also like to think of all of the audio recordings they distribute as their own property produced as works for hire. It's not necessarily a bright idea to follow the MPAA or the RIAA over some logical cliff like some lemming.

Media moguls are also bound by the law and what they can get a judge to put up with. They will likely have a very hard time getting any judge to buy into the idea that a CD or a DVD is meaningfully different from a physical book.

Re:Wrong conclusion...

[Quarters]

I'd call your analogy flawed, too. A better one would be, "Do you rent a car and then keep it?" or "Do you rent a movie at Blockbuster and then crow manaiacally about 'sticking it to da man' because you have no intention of ever returning it?

DRM sucks, yes. But if you are agreeing to pay for a rental of a movie you have no right; legal, moral, or otherwise, to keep it permanently. Yes DRM sucks. Yes we should be able to watch content on a device of our choosing. But, if we know the content we purchased is only valid for a limited time (or number of viewings) we should happily put the content on whatever device we want and then agree to the rental terms.

Re:Wrong conclusion...

[cpt kangarooski]

I believe the company that manufactured that disk disagrees with you.

No, they don't. Consumer-level copyright licenses are extremely rare, limited pretty much to the software industry, and in fact, there's no good reason for them to exist, even there. That they do is basically just inertia and misunderstanding of the legal system.

Do you actually own the disk?

Yes.

Can that ownership be revoked?

No.

Are you entitled to a copy of the disk if that disk is damaged or destroyed?

Only to your copy, unless there's some manner of warranty that's applicable (e.g. if it is damaged when you get it from a store, the store will have to replace the bad copy with a good one), or perhaps if someone tortiously damages it, they might have to pay damages equal to the value of the disk, which could be applied to replacing it.

Do you own the contents of that disk?

No, but then, no one does. That's impossible.

Are you licensed to watch the contents of that disk?

No, not that it's even necessary to be.

Are you no longer a licensed viewer of the contents of that disk when that disk is no longer viewable (destroyed/damaged)?

That's moot per what's directly above.

Are you licensed to show the contents of that disk to non-licensed viewers?

No, but that's not always necessary.

Can you charge non-licensed viewers for the privilege of viewing the contents of that disk?

Maybe. It largely, but not entirely, depends on what's on the disk. Alternatively, it depends on whether it'd be fair or not, which will vary according to the totality of relevant circumstances.

Can you derive profit from displaying ads from showing the contents of that disk? Can you copy the contents of that disk? Can you copy and change the format of the contents of that disk? Can you copy portions of that disk to create derivative works? Can you distribute dirivative works from that disk? Can you charge people to watch works created from derivative works from that disk?

Ditto.

Can you destroy that disk?

Yes.

Can you resell that disk?

Yes.

Can you resell that disk after having made personal copies of that disk?

Yes, but it may be taken into consideration as a relevant circumstance as to whether it was lawful to make the personal copy or not. For example, there is a very big difference between buying a disk, copying it, and reselling it, all on the same day, and buying a disk, copying it, and reselling it, all years apart from one another. What you were thinking about at the time you made the copy is important and will be determined by looking at how you acted. Simply saying 'personal copies' isn't a magic invocation that protects you.

By the way... you're an idiot. Think harder in the future. Thanks.

I wouldn't be so quick to insult people if I were you.

Re:Wrong conclusion...

[b.burl]

Yours boils down to: I do what I think is correct. Okay, but please don't call the cops when someone punches you in the face and takes your wallet, because I am sure that it was a perfectly acceptable action to the perpetrator. After all, they really needed the $20 and it's an insignificant amount of $$$ to you, and your nose will heal.

Strawman, next..

Re:Wrong conclusion...

[iminplaya]

A better one would be, "Do you rent a car and then keep it?" or "Do you rent a movie at Blockbuster and then crow manaiacally about 'sticking it to da man' because you have no intention of ever returning it?

That's not a better analogy at all. A better one would be if you rented the car and made a perfect copy(dents and all) and then returned the original. You, like too many others, are trying to tell us that making copies means losing the original, or some such nonsense.

...we should happily put the content on whatever device we want and then agree to the rental terms.

Why should agree to something so arbitrary? If they don't want me to see it, then they should keep it to themselves. How many friends should I be allowed to invite over before it becomes a public performance? IP law deserves no respect whatsoever. It's not about protecting property. It's about exclusive control that nobody should be allowed to have. It is censorship.

Re:Wrong conclusion...

[afidel]

The problem with selective enforcement of the law is that it almost always leads to abuse of power by the authorities. Look at things like the term "driving while black", by making common activities illegal (say by lowering the speed limit) and then enforcing the law against only those elements of society that the authorities or their agents deem undesirable you have setup a system ripe for abuse. Another example is the case of Genarlow Wilson. This young gentleman went to a party where a 17 year old girl was impaired and had sex with a number of young men, the prosecutor charged them with rape. Genarlow was acquitted on the rape charge, so the prosecutor came back and charged him with Aggravated Child Molestation for receiving oral sex from a sober, consenting 15 year old girl. This young man now faces 10 years in prison for a common act which harmed no one. The fact that the legal code in any given state, let alone the country or the case/common law, is too large for anyone to learn in an entire lifetime means that there are many, many ways that the system can be abused if you are targeted by the officials. I personally think we need to drastically reduce the size of both the tax and legal code to the point where an average adult can understand them with a decent investment in time, but I know that will never happen because there are large sections of entrenched professionals in both fields who rebel whenever the concept is even discussed.

Re:Wrong conclusion...

[Socguy]

Actually the correct analogy would be: Do you rent a car, make an exact duplicate, then return the original. S.

Re:Wrong conclusion...

[LordEd]

A better one would be, "Do you rent a car and then keep it?"

That's a terrible analogy to copying a movie. In the case above, the car rental company does not receive their car back. In the copying movie case, the movie company receives their movie back to continue using it for their benefit.

If you want to use a car rental analogy, it would be "Do you rent a car and then build a copy?"

Re:Wrong conclusion...

[horn_in_gb]

I don't really think these physical property analogies are valid. If I rent a car and don't return it, the car rental place has just lost a car, and lost money. Same with the Blockbuster physical media.

But what if I rent the blockbuster DVD, rip it, and return the DVD? Nobody loses anything. This is why data/IP is a totally different game from physical property.

Re:Wrong conclusion...

[Dragonslicer]

It's *data*

There were other characters in the movies, ya know.

Re:Wrong conclusion...

[Salsaman]

Didn't the US have a law that blacks on buses had to give up their seats for white people ? How's that law going ?

Re:Wrong conclusion...

[zippthorne]

Actually, many states have a "reasonable and prudent" law which covers the very situation you state. Although such law can just as easily be used to enforce lower speeds under sub-optimal conditions. i.e. driving at 80 in a blizzard even if the posted limit is 80.

A law you believe to be unjust does not necessarily call for your breaking it no matter how much Thoreau you read. If the movie makers demand payment for every format you wish to have, then that's what you should do. Pay them for every format you wish to watch it on, or decide it's too expensive and avoid it altogether. It's not like stealing bread for your starving family. (which btw, most people would be willing to suffer the consequences for anyway if they were in such a situation)

Re:Wrong conclusion...

[drinkypoo]

DUI, embezzlement, drug dealing. Those are pretty extreme examples you put there

How in the HELL does selling drugs make it into the same list with DUI or embezzlement?

examples that could put life and limb at risk, or cause great financial hardship to someone.

Selling drugs puts your life at limb and risk only because they are illegal. Selling drugs does not harm anyone; taking drugs may, depending on the drug.

Keep in mind that the drugs that kill the most people every year, Tobacco and Alcohol, are readily and legally available...

Re:Wrong conclusion...

[walt-sjc]

I believe the company that manufactured that disk disagrees with you.

They do? Then where can I find a copy of this license agreement? It's not provided with my DVD's. In fact, the only legal language on the disk tells me that federal law prohibits me from making unauthorized reproductions. There certainly was no signed contract of any kind, or even a "shrink-wrap license".

You might not realize this but but your statement doesn't do anything to clarify what you own -- Do you actually own the disk?
Yes.

Can that ownership be revoked?
No.

Are you entitled to a copy of the disk if that disk is damaged or destroyed?
In most cases I can return the original to get it replaced, but this has nothing to do with any kind of fictitious license. If I buy a product that is defective, I am entitled to replacement. If I break it myself, I'm not.

Do you own the contents of that disk?
Absolutely. I own the bits that are on that disk. I don't own the bits on the original copy or any other copy , but the bits that exist on that disk are mine and mine alone. Much like if I buy a book, the ink on the paper is mine too.

Are you licensed to watch the contents of that disk? Are you no longer a licensed viewer of the contents of that disk when that disk is no longer viewable (destroyed/damaged)? Are you licensed to show the contents of that disk to non-licensed viewers? Can you charge non-licensed viewers for the privilege of viewing the contents of that disk? Can you derive profit from displaying ads from showing the contents of that disk?
There is no license, so most of your questions are meaningless. As for public display of the movie, that is protected under copyright law and has nothing to do with any fictitious license.

Can you copy the contents of that disk? Can you copy and change the format of the contents of that disk?
That depends on your interpretation of Fair Use. Some say yes, others say no, but that is irrelevant.

Can you destroy that disk? Can you resell that disk?
Yes, and Yes.

Can you resell that disk after having made personal copies of that disk?
Sure, but then I would be in violation of copyright law, not some license.

Can you copy portions of that disk to create derivative works? Can you distribute dirivative works from that disk? Can you charge people to watch works created from derivative works from that disk?

It's VERY clear that you have "license agreement" and "copyright law" mixed up. I suggest you educate yourself on the difference.

By the way... you're an idiot. Think harder in the future. Thanks.

Heh! Anonymous Coward Pot, meet the Kettle. I can see why you decided to post anonymously. Did you do that because you have mod points and wanted to mod yourself up? Hmm....

Re:Wrong conclusion...

[j-turkey]

I don't think that renting a movie/car and keeping it is the same as what the ggpp was talking about. He's talking about buying a copy of a movie, then downloading it because he doesn't want to buy the necessary hardware to watch the copy he bought. It seems pretty reasonable to me. The copyright holder is getting their fair money for the product. How is the ggpp acting in bad faith?

I understand your analogy, and it may be appropriate for other kinds of IP theft, but I don't think that it applies here.

Re:Wrong conclusion...

[ceoyoyo]

I do love to see rude people given a nice slap upside the head by someone who actually knows something, and in a post that has real content as well! Thanks.

Re:Wrong conclusion...

[farble1670]

no, they are not on par and i never said that. the point was that a morality based on doing what you decide is correct in your own little head doesn't work.

Re:Wrong conclusion...

[ajs318]

When I buy a DVD, I buy a disk that has a movie on it - not a license.

I believe the company that manufactured that disk disagrees with you.

What the company that manufactured that disc thinks is irrelevant. They accepted payment for it; it's not their property anymore. According to the Law of the Land, what anybody does with it from that moment on is None Of The Manufacturer's Damn Business.

You might not realize this but but your statement doesn't do anything to clarify what you own

No, but consumer protection law is quite clear on the matter. Your right to use any article purchased at retail by you for its Rightful Purpose is protected by the Law of the Land. If you purchase a DVD at retail, its Rightful Purpose includes private home viewing by the owner, their friends and family and for which an admission fee is not charged. If the goods you have purchased are not fit for their Rightful Purpose, then you are entitled to return it to the place of purchase and receive a full refund of the purchase price paid.

Do you actually own the disk?

You paid money for it. It's your property.

Can that ownership be revoked?

That would be called Theft.

Are you entitled to a copy of the disk if that disk is damaged or destroyed?

Not necessarily. It is your property and you are generally responsible for taking proper care of it. However, unauthorised, deliberate damage by a third party may constitute Criminal Damage.

Do you own the contents of that disk? Are you licensed to watch the contents of that disk?

Watching the contents of the disc would be considered the Rightful Purpose of the disc. Your right to use your own property for its Rightful Purpose is protected by the Law of the Land. You do not need any other licence to watch it.

Are you no longer a licensed viewer of the contents of that disk when that disk is no longer viewable (destroyed/damaged)?

You do not need any licence to view the contents of the disc. Your right to do so stems directly from your ownership of the disc. If the disc is covered by an insurance policy, the original disc will become the property of the insurer when they pay out (and therefore you would no longer have the right to view its content) -- however, they may give it to you anyway, in order to transfer any obligations regarding proper recycling of waste onto you.

Are you licensed to show the contents of that disk to non-licensed viewers?

You do not need any licence to view the contents of the disc. Refer to established case law regarding viewing of recordings. Generally, it is OK to show it to your friends and members of your family if an admission fee is not charged; and a licence can be arranged for a small fee (payable through a royalties collection agency) to allow showing it in a workplace or to members of a club or society (which is deemed beyond Rightful Purpose, and so requires permission from the copyright holder or their authorised agent [i.e. a royalties collection agency]).

Can you charge non-licensed viewers for the privilege of viewing the contents of that disk?

You have to obtain a special licence for exhibition other than to friends and members of your family or for which an admission fee is charged. A licence permitting the general Public to attend the viewing (which certainly exceeds Rightful Purpose) is generally more expensive than a licence for a viewing restricted to a workplace or members of a club or society.

Can you derive profit from displaying ads from showing the contents of that disk?

Yes, if you are properly licenced to do so. See above.

Can you copy the contents of that disk? Can you copy and change the format of the contents of that disk?

Re:Wrong conclusion...

[ConfusedVorlon]

so morality should be based on what others decide?

I disagree.
That's morality, that's following orders.

If they told you to kick the baby would you?

Re:Wrong conclusion...

[rtechie]

The most basic acceptance test of any moral or social philosophy is whether it can be applied generally. Yours boils down to: I do what I think is correct.

ALL moral decisions are individual and ultimately arbitrary. He certainly CAN apply this moral principle universally: Do you think he would object to other people doing EXACTLY the same thing? (downloading a copy of purchased content in another format). He is saying that he "generally" believes the legal restrictions on the use of content are not "moral" and he chooses not to follow them, NOR DOES HE EXPECT OTHERS TO.

You, nor does anyone else in the world, do not seriously believe that you should slavishly follow every tiny aspect of the byzantine US legal system even assuming that were possible (it's not). Would you refuse to help somone that collapsed across the street because it would be jaywalking? Even better, in the US it's ALSO a crime to not help someone obviously in need. So in the above situation ther is LITERALLY NO WAY not to break the law. I could come up with a 1,000 more examples. It's very simple:

Law has nothing whatsoever to do with morality. Period.

Re:Wrong conclusion...

[anthony_dipierro]

the point was that a morality based on doing what you decide is correct in your own little head doesn't work.

In what way does it not work? And what other choice is there?

Re:Wrong conclusion...

[anthony_dipierro]

But if you are agreeing to pay for a rental of a movie you have no right; legal, moral, or otherwise, to keep it permanently.

Sure. If I agree.

But, if we know the content we purchased is only valid for a limited time (or number of viewings) we should happily put the content on whatever device we want and then agree to the rental terms.

No. You can't force me to agree to the rental terms. If I purchase a DVD, then I have not agreed to merely rent it.

Re:Wrong conclusion...

[Alsee]

There's nine or ten replies to you, and I can't beleive no one has hung you with your own argument:

The most basic acceptance test of any moral or social philosophy is whether it can be applied generally.

You proceeded to list a bunch of STUPID comparisons... but how about we look at what he ACTUALLY said and consider under the exact moral rule you just stated. He said:

I purchase Star Trek for my Xbox and then download a copy for my PC as well. Sure it's illegal, but I look at it from the perspective of: I purchased it so that I could watch it, and watch it I shall.

If everyone buys stuff, and then they all either break the DRM or download a de-crippled version with the DRM already broken, then heay! What a wonderful world! What a fantastic moral solution to apply generally.

Eliminate the IMMORAL DMCA, the DMCA which immorally declares that good moral non-infringing people are to be imprisoned, stick with good old copyright. Go back to... *shock*... *gasp*... going after actual copyright infringers.

-

Re:Wrong conclusion...

[PRMan]

Many people choose morality according to the Bible, with the thinking that God knows more than we do....

Re:Wrong conclusion...

[anthony_dipierro]

Many people choose morality according to the Bible

I would say it's very very few people that do that. How many goats have you seen sacrificed lately? How many people kill those who work on Saturday? Besides, what does the Bible say about downloading DVDs over the Internet?

with the thinking that God knows more than we do....

Not a bad assumption. But figuring out what God wants us to do and just accepting what other people say God wants us to do are two different things. Which Bible? Which parts of it? Whose interpretations?

Damn it!

[fahrbot-bot]

Cracked already? I had December 29th in the pool.

Re:Cheers!

[Anonymous Coward]

How exactly are their DRM schemes any more restrictive than DVD's?

Cracker actually working for HD-DVD Consortium?

[BenJeremy]

Really just a stab here, but maybe given lackluster sales of hardware, the consortium hired a ringer to play "DVD Jon" for a day and "leak" the crack to the public, thus encouraging some support from a DRM-weary public?

The industry knows piracy is not really a big problem - they still make mountains of cash, and society needs a little underlying "lawlessness" (like speeding, for example) to ease pressure. Perhaps some industry insiders sick of kowtowing to the IP Lawyers decided to leak the crack to the public in a round-about manner?

If true, it's brilliant.... if not, then they missed the boat.

Re:Cracker actually working for HD-DVD Consortium?

[iainl]

Lacklustre sales of the hardware?

I'll give you that they're not completely phenomenal, but they're good enough that they fly off the shelves at the rate they can manufacture them.

Re:Cracker actually working for HD-DVD Consortium?

[Weedlekin]

"given lackluster sales of hardware"

The poor hardware sales are due to the following factors:

1) Hi-def content is only of interest to the small minority of consumers who have a TV capable of displaying it, a screen big enough to notice any difference from up-scaled DVDs, and the requisite inputs, i.e. HDMI if they don't want to risk having future content down-scaled to a level that's worse than DVD.

2) Even those who fall into (1) above are wary of the fact that there are two competing formats, so many will inevitably wait and see which of them finally wins (or alternatively, wait for a player that's compatible with both).

3) Prices are extremely high at the moment -- for less money, one can buy a decent stand-alone DVD recorder with an integral DVR and editing system, which appeals to far more consumers due to being usable with a much wider range of TVs. The fact that DVD players are now available for less than the cost of newly released media for them does nothing to help this situation.

4) A shortage of blue lasers means that even those early adopters who want HD-DVD or Blu-Ray players have difficulty finding one.

5) There isn't a vast range of compelling titles in Hi-def formats, and some of those that are available don't actually look any better than the DVD version (in some cases they're worse). Furthermore, the fact that certain studios are aligned with HD-DVD while others favour Blu-Ray means that it's rare to see a movie released on both, meaning that those who opt for one format cannot view movies that only get released on the other one, thereby bringing us back to (2) above. By contrast, a $25 DVD player gives people access to a gigantic library of content, much of which is available for around $5, or can be rented, pirated, or made by individuals using cheap and readily available equipment.

6) Early adopters with money to burn tend to read lots of reviews, and will therefore know about the problems each of the small number of available players have with some disks. These issues might be acceptable with a $25 no-name DVD player, but those who spent between $500 and $1000 on a new hi-def system will be feeling very pissed off indeed if one of the only five movies they want to watch on it doesn't play properly.

Problems (3) and (4) will disappear fairly quickly because the lack of blue lasers is a short-term phenomenon, and once production ramps up, competition between manufacturers will progressively lower prices and ensure that dual-standard players come on to the market, possibly (i.e. not definitely) some time during the next year, and this competition will also mean problem (6) won't be (much of) an issue in a year's time. Even so, realistically speaking, the requirement for a large high-definition TV set will mean that adoption rates will remain low for a few years yet, so the range of titles will be significantly more limited than those for DVD, and sales / rental outlets will therefore devote less shelf space to them than their DVD equivalents, as indeed was the case with DVDs when VHS was the dominant format. However, unlike the VHS / DVD situation, it's easy and cheap for manufacturers to equip blue laser players with the ability to read standard DVDs, so those with existing collections aren't forced to re-buy everything in the new format, and this will probably help adoption rates once the price drops to an acceptable "impulse buy" level (i.e. below $150/Euros) and equipment is supplied with "dongles" (internal or external) that ensure output doesn't become degraded when connected to non-HDCP compatible displays (the fact that no media have HDCP yet is a short-lived phenomenon, because the media companies wouldn't have insisted it be there unless they intended to use it).

So the probability of this crack having been unofficially sanctioned by the industry (hardware or media) is very remote indeed, because the slow hardware sales aren't in any way linked to DRM, and even if they were, hardware companies in particular could easily circumv

Re:Cracker actually working for HD-DVD Consortium?

[Lumpy]

Sales of hardware is lackluster for many reasons...

1 - the current hardware SUCKS. Buggy as hell and not what a Rich man with a home theatre would tolerate.
2 - The current movie linup for the formats SUCK. They butchered the ones that people wanted (5th element transfer is incredibly crappy) and released utter crap for the rest.
3 - Most people do not own a HD capable set. This is a stone cold fact.
4 - Those that own a HD set own a 480P set and will get a minor increase in "quality" a really good DVD player or a decent video processor between your crappy 480P set and your DVD player will give a FANTASTIC picture that makes everyone that sees it very happy with it. HDDVD or Blu Ray on those sets simply does not look that much better than a upconverted DVD with a good line doubler running on it. Therefore people wait.

5 - Most integrators and Theatre designers are telling clients to wait. I have one customer that has been through 3 of the Pioneer BDR-101a and finally asked if he can simply return it to us. IT's crap and for a $1000.00 player it is not allowed to have any crappyness in it from the consumer's viewpoint.

The players suck, the content is not that good, most people cant watch it, most people dont see a difference on current sets... they dont want it.

and this is before DRM and other issues that geeky owners care about.

Re:Cracker actually working for HD-DVD Consortium?

[imroy]

While I would like to believe your hypothesis, it simply doesn't hold up to logic. Do you understand what you're suggesting? Much of the entertainment industry (movie, tv, and even music copyright holders) has spent rather large amounts of time and money fighting what is a threat to their long-standing business model. They've lobbied heavily for draconian new copyright laws and put lame "please don't download this movie from the intarweb" messages before movies. They just spent a few years and probably countless millions of dollars developing this AACS content protection system in conjunction with many hardware manufacturers in several countries. And you think that only several months after the release of this new medium they've just said "ah, fuck it"? Like I said, I'd like to think they've done this. But I don't think the odds are high.

Re:Cracker actually working for HD-DVD Consortium?

[Manmademan]

1 - the current hardware SUCKS. Buggy as hell and not what a Rich man with a home theatre would tolerate.

Launch hardware sucks? OH NOES! this has never happened before and will CERTAINLY not get better over time...

2 - The current movie linup for the formats SUCK. They butchered the ones that people wanted (5th element transfer is incredibly crappy) and released utter crap for the rest.

This makes as much sense as judging DVD based on the titles that were available in it's first year, or CD's that were available in the mid 80s, or games available for the PS2 in 2000... Jesus man, give it time.

3 - Most people do not own a HD capable set. This is a stone cold fact.

Been into a best buy lately? SDTV's are an endangered species. The majority of new sets sold these days are HDTV's and this will only increase. I recently snagged a GOOD 32 inch sharp Aquos for $850 before the holiday season- this is in line with what good SDTV's were selling for 6 or 7 years ago in that size. Give it another year and they'll be even cheaper. I agree that not everyone really cares about the improved picture quality but form factor alone has proven to be a HUGE selling point for HDTV. Not only are they flat enough to hang and mount on walls, but they're LIGHT enough that even a weak individual would have no problem at all moving a 36 inch tv anywhere they like, even up a flight of stairs by themselves.

4 - Those that own a HD set own a 480P set and will get a minor increase in "quality" a really good DVD player or a decent video processor between your crappy 480P set and your DVD player will give a FANTASTIC picture that makes everyone that sees it very happy with it. HDDVD or Blu Ray on those sets simply does not look that much better than a upconverted DVD with a good line doubler running on it. Therefore people wait.

480P is not HDTV and is never sold as such. at best they're labeled as EDTVs, and they're not all that common. 1080P on a blu-ray or HD-DVD is LEAGUES better than the 480p current DVD players allow. Have you seen any discs at all? It doesn't sound like it.

and this is before DRM and other issues that geeky owners care about...

DVD and even VHS was DRM'ed. Remember macrovision? didn't stop the adoption of either format..clearly "geeky" owners are in the minority.

Re:Cracker actually working for HD-DVD Consortium?

[afidel]

480P is HDTV, huh? 480P is EDTV not HDTV. Sure some scummy companies market EDTV sets as "HDTV compatible" but I'd hardly call them HDTV's. The fact is the majority of the sets on sale for the last two years have been 720P sets, and you can get 1080i sets for well under $1K today and 1080p sets for around $2K if you shop smart. Maybe it's the places I hang out, but at this stage I don't think it's the displays keeping out of HDTV, it's the players, content, and uncertainty of how the format wars and DRM will play out thats keeping people on the sidelines.

Re:Cracker actually working for HD-DVD Consortium?

[Weedlekin]

"I still have a couple of shelves of VHS tapes, and no (serious) reason to rebuy them."

Same here, but I have to keep a VHS machine around to play them, and what happens when it finally breaks down (as it will do eventually)? How long will VHS machines be generally available now that DVD recorders cost the same or less, and what will we have to pay for them when they cease to become mass-market items? None of these are issues for people with DVD libraries if they decide to opt for a high-definition system at some point because they can not only play DVDs, but also have very capable up-scalers that will make those DVDs look better on large-screen HD-capable TVs than the DVD player they're replacing (unless said DVD player is both modern and expensive).

"Why would I need to rebuy my DVDs if I got an HD-DVD player without the ability to play DVDs? TVs have more than one input - not to mention that I'm European so I can daisy-chain SCART devices and have any number of different format players hooked up"

You may like having an ever-growing number of legacy devices daisy-chained together, but most people don't (I know this may come as a shock to Slashdotters, but the term "Home Entertainment System" actually refers to something you put in your home to entertain you, not the process of converting a home into a data format museum).

"VHS players are still easily available and cheap"

Are they? Try walking into any major UK electronics retailer and looking for one -- they're getting pretty thin on the ground nowadays, and you're likely to pay more for them than a DVD recorder if you can find one (most retailers don't have them in stock, but have to order them, as is the case with machines for that other dying format, audio cassettes).

"Finally, my PC has a DVD writer and VIVO (video in - video out) graphics cards are much cheaper than rebuying a shelf of videos: I could format-shift them myself if I really needed too."

And you are of course a typical man-in-the-street, nearly all of whom (a) know what a VIVO graphics card is, (b) can find one and install it in their computer, and (c) will of course have a desktop system that can accept such cards rather than a laptop because nobody buys laptops (and this desktop system will of course store all multimedia files in one of the overwhelmingly popular Ogg formats that all personal music / video players must support or be doomed to commercial oblivion).

Meanwhile, back in the real world of _consumer_ electronics, ordinary mortals with existing VHS libraries are faced with two realistic possibilities: (1) buy the old content they actually watch on DVD for a couple of quid each second-hand or in bargain bins, or a fiver otherwise, or (2) spend 120 spondoolicks on a combo DVD/VHS recorder that requires 1 cable, 1 electrical outlet, needs no graphics cards, computers, or other devices, will transfer their old content at the touch of a button, and record new stuff with far better image and sound quality than their VHS system. Option (2) is worthwhile if a person has a large library of personal content or some commercial stuff that isn't available on DVD, otherwise the fact that the DVD copies can't be better than the tapes they come from means that buying the content on DVDs is probably preferable, and for most people, cheaper, than spending money on equipment / media and a considerable amount of time copying tapes to DVD.

Which brings me back to the point I was originally making, i.e. that none of the above will be necessary for people with DVD libraries if one of the HD formats becomes popular because they can both play DVDs rather better than most dedicated CD players.

"DVD has some other benefits too, of course, but rebuying a film to avoid rewinding would be crazy"

The primary benefit for those of us with wives / live-in girlfriends is storage space. Commercial media tend to use one bulky tape / movie, and while one can squeeze eight hours recording time out of an E-240 using the long-play feature most video rec

P2P links then...

[_Shorty-dammit]

ed2k://|file|BackupHDDVD.zip|17964|4860e9248663d52 dc47bfc98d61ec6d7|/ magnet:?xt=urn:bitprint:ZHZI65X7J4NIX7TU7KLDIZXIJA 62SXX7.OBRERVSGGVO4OMWW7JN7BPC2BPDCE2U5NBUVU3Y&xt= urn:ed2khash:4860e9248663d52dc47bfc98d61ec6d7&dn=B ackupHDDVD.zip&xl=17964

Link

[h4rdc0d3]

If anyone wants to try it out, here is a link to the executable and source code (Java)...

http://forum.doom9.org/showthread.php?t=119871

There is more detailed info in the included FAQ. The bad news is, the program itself isn't actually "cracking" anything. The author used publicly available AACS documents to write his own decrypter (e.g. just as PowerDVD or WinDVD would). The catch is, you must provide the decryption keys to this software in order to rip the movies from the disk.

However, the good news is, it looks like he may have found a way to extract the needed decryption key(s) from the HD-DVDs. He doesn't explain how in the documentation or provide any keys, but if he figured it out I'm sure others will - and that means more advanced and powerful tools shouldn't bee too far off.

Re:Link

[dteichman2]

Once you rip the files from the disk, you can pass them out to your 100 million closest friends over LimeWire.

Actually...

[alexandreracine]

now that it is crack, I might buy one :)

Mmm but would you do it?

[atari2600]

I think Hollywood has a slight edge here. Consider this: Ripped DVDs came around to 4 - 4.5GB and while this isn't a huge amount of diskspace, it is still a considerable amount of space. Even so, a 250GB HDD (you can get this for
Now coming to HD-DVDs (the screenshots from the article show approximately 24GB of space being used or 24GiB, whatever tickles your fancy). This means a 250GB will be able to hold
The point is with the Hi-Def media, it doesn't make as much sense to rip every movie you have and store it on your fileserver for the next year or two. This is awesome news but i am not sure i'll be ripping HD-DVDs/Blu-ray disks like i used to rip DVDs. These things take way too much space. Hollywood would have an edge if they priced the stuff at around 15-20$ - i'd buy one than let a movie take up 30GB on my machine.

Re:Mmm but would you do it?

[FuturePastNow]

Yes, but who keeps their ripped DVDs in their original format? Most people use XVID or similar compression to get them down to 700-800MB (or, I should say, most P2P downloads are that size and format).

A dual-layer HD-DVD is 30GB, similar compression would get that down to about 5GB. That's $2 worth of hard drive space.

Re:Mmm but would you do it?

[BenJeremy]

True, but you could also use a better compression algorithm and knock the size down... say, use a new version of RatDVD, call it "RatHD" and preserve all of the menuing and features, but compress it down to 8 or 9 GB and save to DL. Even better, if you don't have 1080p, compress it down to 720p and save more space, but still get higher def than DVD as a backup of your movie discs. Store your retail HD discs away some place safe and use your backups for playback (or keep on the HTPC HD for easy retrieval)

Re:Mmm but would you do it?

[mwilliamson]

Multi Terabyte harddrives are on the way. There was once a time that ripping a DVD was considered ubsurd because of the amount of space it consumed. Before that, ripping uncompressed CD audio was considered ubsurd for the same reason. With new developments like vertical storage, I don't think space will stay an issue for long.

Re:Mmm but would you do it?

[TexasDex]

The point is with the Hi-Def media, it doesn't make as much sense to rip every movie you have and store it on your fileserver for the next year or two. This is awesome news but i am not sure i'll be ripping HD-DVDs/Blu-ray disks like i used to rip DVDs. These things take way too much space. Hollywood would have an edge if they priced the stuff at around 15-20$ - i'd buy one than let a movie take up 30GB on my machine.

Wait 5 years and read that post again. I bet you'll laugh. "Only 24 gigs?" you'll say. "That's nothing!" I guarentee it.

To put it in prespective: My old 486 had a hard disk with less than 400 MB of space. But it also had a CD-ROM drive. Your average CD back then held 650MB. Yes, it had an optical drive that was bigger than its hard disk. Nobody ever thought to even include copy protection on the CD because storing that much data was insane, and transmitting it over the internet even more so. With the advent of MP3 and bigger storage and broadband it became commonplace to trade music online.

My brother got one of the first computers that came equipped with a DVD drive, which has a capacity of 4.7 GB (I'm ignoring the whole multi-layer DVD format for sake of simplicity). It also came with a hard disk that could hold up to 2 Gigabytes. Now your average DVD can be recompressed without too much quality loss to, say, 1.5GB, and modern hard disks will store hundreds of them with ease, and you can download them in an hour or two on a good connection, or maybe a day on an okay one. Are you noticing a recurring theme here?

The truth is that Blu-ray isn't all that big compared to the hard disks of today, especially not when you look at previous optical formats and how big they were in comparison to the hard disks of the era in which they were first made. Heck I could fit a Blu-ray disk or two on my iPod and have some space left over.

Such is the progress of technology (by which I mean mostly storage space and bandwidth, but also compression technology and the processor power to implement it). A digital movie standard such as Blu-ray or HDDVD should be expected to last a decade. They will probably last even longer than that because hi-def technology has matured to the point where users couldn't possibly need higher resolution or more pristine sound effects. Where do you think magnetic storage will be in ten years? Heck, where do you think solid-state storage will be in ten years?

The point is that technology changes, and people invent things like MP3 that let you squeeze more into smaller space. Which means movie format won't stop piracy because it's "too big".

Re:Mmm but would you do it?

[melikamp]

Now your average DVD can be recompressed without too much quality loss to, say, 1.5GB [...]

The truth is that Blu-ray isn't all that big compared to the hard disks of today [...]

Good post. I just want to point out that since Blu-ray packs the same damn movie, it can be just as well compressed to the same 1.5GB without much loss. And who is willing to pay for higher resolution in movies these days? May be I am just getting old, but I cannot see any pixels on a regular 36 inch CRT TV when I watch a movie. Everything is sharp and smooth. (Console games are a different matter.)

Re:Mmm but would you do it?

[Jeremy Erwin]

Putting aside the whole "re-compressing adds artifacts" argument for the moment, the only reason DVDs can be further compressed is that MPEG-4 is more efficient than MPEG-2. HD-DVDs use vc-1, which is roughly comparable to mpeg-4. It's already quite compressed.

Do XVID rips still reduce the multichannel Dolby Digital down to mp3?

Re:Mmm but would you do it?

[FuturePastNow]

I can only assume the compression schemes will keep improving. Also, Blu-Ray and HD-DVD movies are unlikely to completely fill disks- they'll probably continue to be movie on layer 1, extras on layer 2, etc. I'm too lazy to look that up right now.

As for the audio- if you encode it yourself, good programs will let you choose how to format the audio, or just leave it as AC3.

Re:Mmm but would you do it?

[Chandon Seldon]

They will probably last even longer than that because hi-def technology has matured to the point where users couldn't possibly need higher resolution or more pristine sound effects.

Bullshit. There's easily space for another generation worth of quality improvement in video - at least one more generation. Find yourself a 50" 1080p display, and then watch some 1080p content at 2 - 3 feet (17" computer monitor distance). The screen should fill your vision, including most of your peripheral vision - better than a good movie theater. And... you can see the pixels. They're not very big, but they're there and they're obvious.

I'm not saying this is necessary today, but people are already playing video games at higher-than-HDTV resolutions. Saying that there will be no demand for that in 10 years is short sighted at best.

Re:Mmm but would you do it?

[Crizp]

You won't see much pixelating and artifacting on a CRT of that size. On a HDTV however, you'll notice. On a 20" 16:10 LCD (1680x1050) the artifacts in an XviD are very noticeable. I would still think that a 1.5 GB XviD based on a Blu-Ray HD source would be prettier than one based on a DVD source due to the better quality of the source video. But this is just speculation on my part, I haven't done comparison tests.

I would guess a good size/quality trade-off would be a ~4 GB H.264 rip of the HD source.

Re:Mmm but would you do it?

[MaGogue]

Why would you want to rip a HD film and compress it into a kind of regular DVD, when you can just rent a DVD for 2$ or less, is beyond me. You'd get a poorer (than DVD) picture because of recompression and resampling, and pay 8$ for the DL blank alone.

They aren't just going to stop selling DVD's anytime soon, and a good DVD is as good as it gets on 720x576 pixels. No MP4 compressed material (700M or even 1.4G) comes close to originally compressed MP2 on a DVD.
The friggin' point of HD format is to enjoy it on a 100" DLP projected full HD projector.. not on a computer monitor downscaled to 1080p or even 720p.

Re:Mmm but would you do it?

[sane?]

The question I would love to see addressed is how much space a movie takes up, with a decent codec - MINIMUM.

In the same way that DVD Shrink could make a good job backing up 8.5GB movies onto 4.4GB DVD-Rs, I'll bet it doesn't require 24GB to store an entire HD movie at I-don't-notice-the-difference quality. Given the nonlinearities in encoding, I'd tend to guess the multiplication factor over DVD is nearer to x2 than the x4 that might be naivly expected. Add to that the benefits of better encoding over MPEG2 and we reach acceptable sizes for distribution.

I for one won't weep when the money grabbing little toads who looked on higher resolution for a pay day see their pot of gold disappear with the DRM rainbow.

Re:Mmm but would you do it?

[znu]

I don't have any discs around to check, but a two hour VC-1 or H.264 movie should be under 10 GB for 1080p (~11 Mb/s), unless they're using higher bit rates than you'd reasonably expect for those codecs. You can also use MPEG-2 on both formats. I think some discs do.

Either way... sure, the size of the media might give them some protection for a while, but... consider that it took 7 years for DVD sales to surpass VHS sales. These formats might not even get adopted that fast... and we're probably not going to see a "super HD" come along any time soon that requires new formats anyway. So, Blu-ray and/or HD-DVD are going to be around for a good long time. If you project out the last 10 years of advances, desktop computers are going to have over 100 terabytes of storage 10 years from now. The size of the content isn't going to be much protection then!

(Of course, the formats might die before then due to Internet distribution.)

Re:Mmm but would you do it?

[mlk]

You can pick up 4 blank DVDs in Pound Land for a pound, give it a year after HD-DVD/BluRay going main stream and you will be able to pick up a single blank HD-DVD/BluRay disk for a pound.

Second question is how much space will the movie (not the Value-Added junk) take on its own?

Re:Mmm but would you do it?

[master_p]

And let's not forget that the quality jump from mpeg4 to HD-DVD is not that great when compared to the quality jump from 320x200 to mpeg4. I think lots of blu-ray/hd-dvd movies will be ripped and downgraded to mpeg4 and then spread around as usual.

Re:Mmm but would you do it?

[Charcharodon]

I'd see the HD disc ripping being the same as DVD's I rip from rentals. I only put them on there in the first place so I can rent 5-10 at a time and take them back the next day. They only stay on there long enough for me to watch them at my leisure. Any permanent residents on my harddrives are movies that I've watched a hundred times and still aren't sick of them, which in that case I've gone out and purchased them so I always have a backup.

I bet you could knock a big chunk out of the size of the HD movies by just dumping all the extra junk on them, the extras, menus, spanish and french audio. On regular DVD that represents anywhere from 1-5 gb of the space (Most movie DVD's are dual layer.) So on HD-DVD that's probably somewhere around 3-8gb and Blue-Ray 5-10gb. That still leaves some pretty big files behind, but then I remeber when ppl used to rip MP3's to lower qualities to save space. These days there's not much of a point in doing that anymore. By the time these formats become saturated in the market, by format I mean the video resolution, not the crappy plastic discs they are being served on, I would think the same would be true of harddrives for video as well.

Re:Mmm but would you do it?

[iamdrscience]

They will probably last even longer than that because hi-def technology has matured to the point where users couldn't possibly need higher resolution or more pristine sound effects.

I don't think this is entirely true. I was in Best Buy the other day and they had a bluray player hooked up to a very nice 1080i TV -- the first thing that I noticed was that it was strikingly sharp and I was instantly convinced that I will want to purchase a bluray player (or HDDVD if that's the format that wins) once the technology becomes commoditized and players get to a more reasonable price (is room for improvement.

Re:Mmm but would you do it?

[drix]

I said the exact same thing about DVDs when they came out. Literally, the exact same thing.

And look where we are today.

Re:Mmm but would you do it?

[Jeremy Erwin]

HD-DVD layers are just like DVD layers-- they add to the discs capacity in a seamless way. And HD-DVD discs are weighing in at 27-28 GB already

Re:Mmm but would you do it?

[NeMon'ess]

Have you actually seen a 720p movie stored in 4.3GB? No? I think you'll be surprised how much detail is there that a plain DVD doesn't have. Yes there's much more artifacting in the non-detailed/high contrast areas, but a dual layer disc would solve that.

HTPC means Home Theater PC. The point is to use a HTPC to output the movie to a projector or plasma screen, NOT a monitor.

Oh, and damn near nobody has a projector in their house capable of true 1080p. Newegg has one for $11,800. A 720/768p projectors start at $1,800. People are buying the $2,000 projectors instead of a $2,000 plasma TV. If the HD-rip is done properly it means it can be displayed with 720p hardware and not need a deinterlacer to make it look good.

Re:Mmm but would you do it?

[Kjella]

Find yourself a 50" 1080p display, and then watch some 1080p content at 2 - 3 feet (17" computer monitor distance). (...) And... you can see the pixels.

That depends on your ideal viewing distance. Currently HDTV is enough if you're sitting at a normal living room distance or the center of a movie theater. I guess movie theaters are the best example - where do people sit? Fact is, it doesn't fill from the front row going back, it fills from the center spreading out. Given free choice, people don't want to sit that close. But yes, if you do then there's room for about 2xHDTV - I believe some cinema projectors have that (but really to show the ~1000 line resolution of scanned film, not because they need 2000 line resolution) but I doubt it'll be very common. Just look at computer screens, i followed it all the way from EGA, VGA, SVGA, XGA and then it really slowed down and with LCDs it degenerated rather than evolve. If people wanted more detail, we should have no problem making a HDTV+ resolution display, but there's no market.

Re:Mmm but would you do it?

[RightSaidFred99]

What is this, 1999? ;)
Right now 300-400GB hard drives are the sweet spot, and 500GB and 750GB drives will probably be the sweet spot by the end of 2007. I have about 1.2TB of usable disk space (a few 400 gig drives, a 300, and some misc other space) available. At 15GB per movie (which is probably too high anyway) that's like 80 high def movies.

So I don't buy the disk space argument. As others have mentioned, however, these movies are compessed about as efficiently as they can be. Recompressing would cost considerable quality.

Re:Mmm but would you do it?

[I'm Don Giovanni]

You make a good point, but your talking about "legit" uses for cracking DRM, such as storing DVDs on your own media server harddrive. Most people that cheer this are imagining bittorrenting HD-DVDs to their harddrive, burning them to a HD-DVD-R, deleting the HD-DVD image from their harddrive (thus recovering the space), then repeating the process for the next movie they want to pirate.

Re:Mmm but would you do it?

[jZnat]

HD-DVD and Blu-ray both support MPEG-2 (which can be transcoded very well), MPEG-4 ASP (DivX/Xvid), MPEG-4 AVC (H.264), and VC-1 (WMV3).

Re:Mmm but would you do it?

[Jeremy Erwin]

The fact that HD-DVD supports MPEG-2 does not mean that, say, "Full Metal Jacket" is encoded using the codec, In fact, it's encoded with VC-1, and any attempt to shrink those massive files will produce artifacts. The impact of these artifacts may be slight, or it may destroy the very elements that make the HD-DVD so visually and sonically compelling.

If you can deal with those artifacts, might I interest you in an upsampling DVD player?

Re:Mmm but would you do it?

[Chandon Seldon]

with LCDs it degenerated

There's been a glut of 1280x1024 (5:4 gah!) LCD displays at the low end. We're slowly getting over it, and it's now possible to get 1400x1050, 1600x1200, and 1680x1050 LCD displays reasonably cheap. At the high end, we have 2560x1600 LCD monitors - which is about where CRT displays were five years ago.

If people wanted more detail, we should have no problem making a HDTV+ resolution display, but there's no market.

Not only is there a market, but HDTV+ resolution LCD displays are already commonly available. They're not cheap (30", 2560x1600, $2000), but you wouldn't think they would be.

Re:Mmm but would you do it?

[RareButSeriousSideEf]

On my 56" 1080i DLP HDTV, 360 x ~200 XviDs look *remarkably* good at around 10MB / minute. In fact, the ~4GiB DVR-MS Dr. Who episodes I record at full resolution through S-Video on a media center PC are utter crap compared to those ~350MB XviDs. Where I am, digital cable sources are pretty locked down, so SVid is my only real source option for recording most cable channels. (It's a shame, really, that the content I pay for is so inferior in quality to widely available torrents of the same program from the UK.)

Experimenting with various MP4-related compression schemes on my own -- using 1080i source material -- I'm confident that I can transcode to 720p with an end product that looks as good as or better than a 480p commercial DVD and fits within ~35MB / minute (or 4.5GiB for a 2hr feature). I find that this size constraint is generous enough to remove all but a very few occasional bits of artifacting in the low contrast areas.

That leads me to agree with your conclusion about H.264 @ ~4GB, but so far every H.264 encoder I've enountered is too slow compared to mencoder's MP4 to justify the little bit of quality improvement I see.

If HD-DVD and Blu-Ray cracks become as ubiquitous and easy as DeCSS / libdecss, I might consider buying into one of those formats. Until then, reg'lar ol' DVDs upsampling through an HTPC looks just fine for my dollar.

Re:Mmm but would you do it?

[jZnat]

If I were archiving an HD-DVD or Blu-ray disc with current video codecs, as long as the video weren't encoded in MPEG-2, I would just remux the files into Matroska and archive like that. With those discs, archival currently shouldn't transcode it.

However, if there is an MPEG-5 standard or Xiph can pull off a fast one and make a Theora:H.264::Vorbis:AAC (or MP3), we'll be able to save a bit more space with transcoding. If HD content is compressed nearly losslessly like it is on DVDs, there really won't be any chance for artifacts if you transcode using a high enough bitrate (e.g. a max of 2000 kb/s using Xvid or FFmpeg in a two-pass encoding tends to transcode nearly losslessly in most live-action videos).

Re:Mmm but would you do it?

[Jeremy Erwin]

Maybe it's just time to experiment. We have the computers, and we shall soon have the content. (or rather somebody does. My lowly Mac G4 does not have a HD-DVD drive, and I doubt I have CPU to spare.) But don't be terribly surprised if the gains are not what you expect.

Why this may be good...

[mitchell_pgh]

Basically HD-DVD and Blu-Ray aren't even options for me at this point as the DRM associated with it has me shaking my head. While I'm willing to pay $20+ for a movie, I want to be able to use the movie on my terms after the initial purchase.

If this hack proves to be valid, I would actually consider investing in the technology as it opens the format up to Linux/Unix/OSX/etc.

Re:Why this may be good...

[poot_rootbeer]

If this hack proves to be valid, I would actually consider investing in the technology as it opens the format up to Linux/Unix/OSX/etc.

If you invest in the technology, you invest in the assholes who insisted that it be wrapped in DRM in the first place.

Wait for a Free alternative.

Sort of Cracked

[Jah-Wren Ryel]

It sounds like he didn't "crack" AACS, he just extracted the disc keys for certain titles.

A quick and dirty and probably somewhat inaccurate description of the way AACS works is that each disc is encrypted with a single 'disc key' and then that key is encrypted once with every known 'player key,' and each of those is stored on the disc. So, if you have an authorized player, it will find the version of the disc key that it knows how to decrypt and then use that to decrypt the disc for playback.

My guess is that he used one of the software players like WinDVD or PowerDVD that now sort of support HD-DVD and BLU-RAY. But instead of extracting their player key and publishing that, he played a disc in a debug environment and extracted the 'disc key' for that specific title.

The studios thought that they would be able to 'revoke' disclosed player keys by just not using them on any discs pressed after the disclosure was made public. This guy's approach seems to be to distribute disc keys and then anyone with the same disc can decrypt that specific title, thus making it harder for the studios to guess which player keys need revoking.

I think that this guy's approach will be most useful to widescale pirating because all it takes is for one person to decrypt a movie and share it with a billion of his closest friends. But the 'regular joe' who just wants to copy his BD-HDs to his hard disk for ease of playback or maybe to cut clips from it for his own home movie won't benefit because chances are, the keys for his particular discs won't be widely known enough for him to find them.

So, I now look forward to various HD titles from disc (rather than from broadcast, which are already common if you know where to look) showing up on P2P and elsewhere, I'm still not purchasing any AACS playback system since the "crack" is not (yet) useful enough for me to exercise typical fair-use rights of format shifting and personal editing.

Re:Sort of Cracked

[TubeSteak]

But the 'regular joe' who just wants to copy his BD-HDs to his hard disk for ease of playback or maybe to cut clips from it for his own home movie won't benefit because chances are, the keys for his particular discs won't be widely known enough for him to find them.

Maybe I misunderstood you, but you seem to be suggesting that in the future, not all disc keys will be available.

I recall reading (a long time ago) that teh intarnet pirates had already ripped about 3/4 of Net Flix's catalog. I imagine that they've upped that percentage significantly since.

IMO, once the knowledge behind grabbing disc keys spreads, every single HD title that comes out will promptly have it's disc key ripped out & uploaded to some gracenote style database.

Release groups are very dedicated to what they do.

Re:Sort of Cracked

[Gorm!]

A quick and dirty and probably somewhat inaccurate description of the way AACS works is that each disc is encrypted with a single 'disc key' and then that key is encrypted once with every known 'player key,' and each of those is stored on the disc. So, if you have an authorized player, it will find the version of the disc key that it knows how to decrypt and then use that to decrypt the disc for playback.

It seems like this also opens up the possibility for an attack on the player keys. Since that the plaintext (the disk key) that the player key is encrypting is now known, it sounds like an attempt to recover a player key just got easier; especially since there are multiple disk keys to work against and multiple player keys to recover.

Re:Sort of Cracked

[Dachannien]

If that's how he's doing it - by distributing disc keys - then the studios will just start making shorter runs of the discs from the same master. There'll be, say, a hundred different disc keys for the same movie, and you won't know which one you have until you try them all. An individual or group would have to get hold of all 100 discs (or at least the portions of each that store the disc keys) to compile a complete list.

While it's certainly a move in the right direction, unfortunately, it's far from ideal. The reason I feel no moral compunction about saying this is because of your astute observation that this DRM scheme utterly fails to prevent piracy and instead is unfairly limiting how legitimate customers can use the products they buy. It's likely that this was the primary intent all along.

Re:Sort of Cracked

[countach]

Yeah, but if you have a gracenote style database it could check a hundred versions in a millisecond. Of course, your pressing may not be in the database yet, but this is hardly going to stop the hard core pirates.

Re:Sort of Cracked

[Nocterro]

I think that this guy's approach will be most useful to widescale pirating because all it takes is for one person to decrypt a movie and share it with a billion of his closest friends. But the 'regular joe' who just wants to copy his BD-HDs to his hard disk for ease of playback or maybe to cut clips from it for his own home movie won't benefit because chances are, the keys for his particular discs won't be widely known enough for him to find them. Sort of reminds me of the whole serial key situation and sites like serials.ws. Amusing that after all the DRM crap we've gone through, we're back to 'secret' keys to secure software/media. No matter how often they change the disc keys, if it's easy to extract them, people will quickly share them all.

Re:Sort of Cracked

[RAMMS EIN]

``But instead of extracting their player key and publishing that, he played a disc in a debug environment and extracted the 'disc key' for that specific title.''

So now the next step is to disallow running software in a debugger, just like in The Right to Read

Re:Sort of Cracked

[MMC Monster]

Well, he somehow managed to get the keys. Whatever that process is should be part of the final application. And since we're talking about software, it will be much more flexible than any hardware.

Imagine if the consortium had to revoke the keys for a physical player? What sort of chaos would ensue?

As an aside, I recently bought (by mistake) a bunch of region 2 & 5 DVDs, while I only have a region 1 player. I used DVDecrypter to brute-force break the keys and download the DVDs to my hard drive. I then promptly burnt them region-free to DVDs and enjoy them on my regular home entertainment system.

1 Question - If multiple different versions of a HD-DVD or blue ray disc are going to be pressed with different keys, doesn't that seriously increase production costs?

Re:Sort of Cracked

[jeffeb3]

A quick and dirty and probably somewhat inaccurate description of the way AACS works is that each disc is encrypted with a single 'disc key' and then that key is encrypted once with every known 'player key,' and each of those is stored on the disc. So, if you have an authorized player, it will find the version of the disc key that it knows how to decrypt and then use that to decrypt the disc for playback.

Doesn't it seem like if you had one player key, and you then know the 'disc key', that you could figure out the othe 'player keys' because you knew exactly what the key was like before and after the 'player encryption'?

Seems to me that they are only making the problem as difficult as making my dad not want to try it. If pyracy was really a huge loss, they would just reduce the costs of the discs to increase sales. It's obviously not as big a concern as they are making it seem if the encoding they use sucks this much.

Re:Sort of Cracked

[ZorinLynx]

It's all about competition and being better than the other guys.

These people are typically unemployed hackers with a lot of time on their hands. An intelligent mind needs something to work on, or frustration sets in. A challenge like this is irresistible to such a mind, so folks pull all-nighters trying to figure it out.

Groups are formed because one guy may be good at cracking the encryption, another guy may have tons of bandwidth and thus be able to quickly seed a torrent or run a private distribution site, and so on.

Once the groups form, they become incredibly competitive. They want to get their release out FIRST. This is how warez groups work, and have worked since the very beginning.

It's probably a lot of fun to try to figure it out, and for some folks the illegality of it adds a mystique of daring to it that makes it even more exciting. Add competition and comradery to it and you get very motivated groups of people!

-Z

Re:Cheers!

[evilviper]

I'd like them both to totally fail, due to their restrictive DRM.

...EXACTLY like DVDs before them...

Zip does NOT contain any keys

[Rufus211]

Just a clarification because BoingBoing is confused. The zip file from doom9 does NOT contain any keys. All it contains is lines like:

CE6339246F34087AB355681DEB656D23DCD5BD86=Full Metal Jacket | 1-00000000000000000000000000000000

That's the sha1 hash of the file F:\aacs\VTKF000.AACS, a human readable name, and where the title keys should be. Notice the title key is all 0's, which is obviously wrong.

Also the fact that BoingBoing ran the program and it slightly changed the file is meaningless. Trying to decode a file with the key "0" will obviously not do what you want.

Re:Zip does NOT contain any keys

[Anonymous Coward]

Notice the title key is all 0's, which is obviously wrong.

All zeros?

That's amazing, I've got the same combination on my luggage!

Re:Zip does NOT contain any keys

[Junta]

Notice the title key is all 0's That's amazing! I've got the same combination on my luggage!

Re:Zip does NOT contain any keys

[j00r0m4nc3r]

"We'll just make all the keys 00's. Those stupid pirate hackers would never suspect it!"

Re:Zip does NOT contain any keys

[Alsee]

>all 0's
That's amazing! I've got the same combination on my luggage!

You're obviously a programmer, everyone (non-programmer) else's combination is 00000000000000000000000000000001.

-

HDCP

[StreetStealth]

It seems to me most people are seeing this as a means to:

A) Place-shift HD-DVD content (despite current storage constraints)
B) Pirate HD-DVD content (despite current bandwidth constraints)

when I see the much more immediately relevant issue being that of HDCP: If this crack can be rolled into something on the order of a VLC plugin, there's a chance I'll actually be able to use my technically-more-than-capable, yet not-a-member-of-the-HDCP-club LCD display to view commercial 720p content.

Re:HDCP

[Jeremy Erwin]

HD-DVD and Bluray players have component video outputs. In the future, resolution reduction may be used, but right now, the full resolution of the disc is output. Granted, some players have buggy 720p outputs, but that's another issue entirely.

Re:HDCP

[chuhwi]

I believe they are actually talking about using normal DVI outputs on computers when playing hd content, since vista doesn't allow this for HD-DVDs normally.

Re:HDCP

[scb2]

HDCP has also been hacked (or atleast there are ways to remove the hdcp from a signal). 2 ways are already available one is stripping the signal using small boxes that don't follow the rules and the last is by picking up the signal inside a player before hdcp is added and putting a HDSDI connection on your player and a scaler that handles hdsdi (this is the way i will do it since i want the best signal possible and hdsdi is the best). shop where you can buy a hdcp free player. http://www.jvb.nl/jvb.asp?cur=1&level=dvdplayers&p age=browse&searchtype=quicksearch&searchstring=hd- sdi Daniel.

Re:HDCP

[scb2]

There are several devices that can bring that back to either dvi/hdmi and external scalers who all are coming out or are already out with HDSDI inputs to replace their SDI (SD only) inputs. This is one (not cheap) http://www.crystalio.com/ but there are more. I personally use a vp50 (www.dvdo.com) that is beta testing its hdsdi input to replace their sdi card i currently use for my dvd player. Let me stress most of us do it to get better video so the cost are high and not to pirate anytbing (i am against drm for other reasons). I just wanted to make clear there are ways around hdcp and have been for a while handy engineers could probably sidestep (like this aacs hack is doing) the real protection by tapping into the datapaths say of a cheap projector creating a secure path will always leak somewhere just like the whole secure trusted computing will not work unless they have full control and they never will. In many ways encryption is a better way atleast that has a change to flow over the internet and into/out devices unhacked but that is also tricky as we are seeing now. Eben Moglen is right the only way for their biz. model to work is to have military like control over all our devices and networks and we won't let them and will resist. Daniel.

Re:HDCP

[scb2]

Well i you think that is bad, try projectors for the last say 10 years i try not to think about it since i start to cry like a baby if i do. But take your 2 years interval a $8000 projector 2 years ago would probably be about $2000 today max and many people will claim their $1200 one has the upperhand. Deinterlacers/scalers also loose value but most of these companies allow you to upgrade to new models. But you are right its a silly hobby that we try to coverup by saying we don't have to spend $40 bucks everytime to go to the local cinema *grin* Daniel.

GG

[moheezy]

Several years to develop a new optical storage device with an emphasis on DRM, cracked in a few months.

BackupHDDVD FAQ

[Black Acid]

B a c k u p H D - D V D F A Q

-What is "Backup HDDVD" for?
It can do backup copies of HD DVD movies that YOU OWN! I don't want anyone to do piracy here! This software is a good way to protect your investment, because I have notice that this type of media seems very fragile, if it's scratched a little or dirty, it won't play. It seems less tolerent than DVD format. (Higher density!)

-What "Backup HDDVD" is doing exactly?
This is a java based command line utility that decrypt video files (.evo) from a HD DVD disk that you own, to your hard drive and you can play them back with a HD DVD player software.

-What are the system requirements to use "Backup HDDVD"
1 - A Windows based system
2 - A HDDVD disk drive
3 - A HDDVD player software (like PowerDVD)
4 - A HDDVD movie(s)
5 - Java rutime 1.5
6 - The possibility to access the content of the disk with a drive letter under windows.
(you may need UDF 2.5 file system driver for this)
7 - A lot of free hard disk space to backup your movies!

-Was your first HDDVD movie hard to decrypt?

It took me around a week to do. But I have wasted few days
trying to work on too complicated approach. In fact, it is very simple.

-How do you do that?

The program itself has nothing special. It simply implement the AACS decyption protocol. I have followed the freely available documents about AACS
Have a look at: www.aacsla.com The trick, is to find what they call the "Title keys". So I figure out how to extract them.

-How do you extract the "Title keys"?

I won't explain it in detail. Read the AACS doc first. You will understand. The title keys are located on the disk in encrypted form, but for a
content to be played, it has to be decrypted! So where is the decrypted version of the title key? Think about it...

-What kind of crypto algorithms are involved?
Standards algorithms:
ECC-160
AES-128
Look in the AACS doc for more details.

-What is the TKDB.cfg file?
This is the Title key Database file. It holds the decryption keys for the movies.

-What is the format of this file?
Field 1: SHA1 Hash of the VTKF000.AACS file on your HDDVD disk.
Next fields are pipe "|" delimited.
-Movie Title
-A variable number of Title key, pipe delimited
You have a key number followed by the key value like:
12-08A3DC61910280F2...

Key values are 128 bits long, so 16 bytes, or 32 hexadecimal characters long.

-The TKDB.cfg file provided with your program is empty or incomplete, what can I do?
Here is my TKDB.cfg:

CE6339246F34087AB355681DEB656D23DCD5BD86=Full Metal Jacket | 1-0000000000000000000000
0000000000
486198E3855B57CD40F6DC0C60645BDE8E1E9AC5=Van Helsing |19-0000000000000000000000
0000000000
3D357B0653A66176583C5218FD0149EAF8832FB0=The Last Samurai | 1-0000000000000000000000
0000000000

-What do you think of the technical aspects of AACS?

The design is not that bad, but it's too easy to have an insecure player implementation somewhere. And just one bad implementation is all it needs
to get the keys! There will always be insecure implementations of a player somewhere! And the "Revocation system" is totaly useless if you use
the Title key directly.

-Is there any known problems with the decryption?
Yes. I call this problem the "Nav chain" bug. I realize that I have a lot of frame skipping at playback after the decryption, so I hunted down the problem. To avoid the frame skipping, I patch the video file. This fix allows smooth playback of the movie, but there are some side effects.

-What are the side effects of the "Nav chain" bug fix?

You cannot do fast forward, or backward using the round dial, but you can still use the progress bar to navigate through the film. So it's not that bad... For some reason, the sub-titles don't seems to work anymore. It may be a side

Re:Cheers!

[MrAnnoyanceToYou]

I'd like to see them both fail for their restrictive DRM, but they won't. So instead I'd like to see them fail for their pathetic and petty infighting reminiscent of Betamacs and VHS. Anyone over the age of 40 I've talked to about the two formats has said, "What, you mean like Betamacs and VHS?" Just keep telling people that that's what this reminds you of, and wait for someone to start selling a less draconian product. You'll have a long wait, but the moral high ground anyways.

Will every player key be cracked?

[dave1g]

So the player key is hard to get at, so this guy worked around it and just copied the title key from memory, which is encrypted on disc with every player key. Since you have the plain text (of the title key) and each of the cypher texts(the encrypted title key), aren't there attacks to figure out all the player keys? And actually its worse since you have many(possibly all?) title keys and all their corresponding encrypted versions that has to extremely limit the search space for the player keys. This would be an even worse problem since they cant just revoke every key. All the hardware would break! Lawsuits galore!

Seems like the whole house of cards will fall down.

Re:Will every player key be cracked?

[dave1g]

Known Plaintext Attack - http://en.wikipedia.org/wiki/Known-plaintext_attac k

Related Key Attack - http://en.wikipedia.org/wiki/Related-key_attack

Is AES not susceptible to these attacks?

Re:Will every player key be cracked?

[bigberk]

I haven't studied this implementation, but techniques like salts can easily avoid known PT/CT pair attacks

Re:Will every player key be cracked?

[Rufus211]

If you look through the spec there are actually 2 revocation lists: player and content. Player revocation is so they can blacklist this version of PowerDVD so that it can't be to crack any future movies. Content revocation is so they can blacklist all the current movies so they can't be used in a known plaintext attack against future version of PowerDVD.

That is assuming anything ever actually gets blacklisted (hello class action lawyers).

Re:Will every player key be cracked?

[Kjella]

Since you have the plain text (of the title key) and each of the cypher texts(the encrypted title key), aren't there attacks to figure out all the player keys?

The short answer: No, AES is a strong crypto (though fundamentally broken when applied as DRM) and there's no known way to extract the player key no matter how many title key plain/ciphertext pairs you have. A typical example would be a SSH connection where you don't know the key, but can send plaintext, it doesn't help you. It might possibly help in reverse engineering the player key though, but only because it's broken as DRM (the decryption keys and decryption machine is under your control).

Re:Will every player key be cracked?

[swillden]

Is AES not susceptible to these attacks?

If it were, it would not be used as the encryption standard.

Re:Cheers!

[woof69]

its Betamax with am X http://en.wikipedia.org/wiki/Betamax

Re:Cheers!

[dangitman]

That's because Betamax is eXtreme, dude.

Great job with the title keys

[Myria]

The hacker didn't extract the player key. This might be due to the difficulty of getting the player key, but it really doesn't matter.

The use of title keys instead is a great strategy. It means that the revocation system is worthless - AACSLA may not even know which player is compromised. Gray/black-area web sites can maintain big lists of title keys for movies without a whole lot of trouble. The bigger issue will eventually be getting each new movie to the trusted few pirates that are capable of extracting keys. This is no big deal now, but would be if and once these formats become popular.

A counterattack from Hollywood could be to produce thousands of distinct masters of each movie; the same movie would have thousands of different editions that differ only by their title key. I don't know the current state of disk production however, so this may not be feasible.

The revocation system is itself problematic anyway. A person seeking to damage the system itself would try to crack the most popular player, even if it's more difficult than other players. The cost of a massive recall - plus the fines the manufacturer would pay for their player being the one cracked - would heavily discourage the use of the revocation system. It seems like the revocation system is more of a deterrent against both pirates (if you crack a player we'll change the key making your work worthless) and manufacturers (if you don't obfuscate well enough, we'll cost you millions of dollars).

DVD had a revocation system too, but it was never used. DeCSS and the Drink or Die program that preceded it used a player key, but the CSS algorithm was so badly flawed that it wasn't difficult to derive the remaining player keys. This will not happen with AACS, because they're using real crypto this time.

Melissa

Re:Great job with the title keys

[tomjen]

To prevent the problem with many masters, you could hash all the encrypted volume keys and then when you needed to look up a key you would ask for the key corresponding to such and such hash.

Re:Great job with the title keys

[Wesley Felter]

The revocation system is itself problematic anyway. A person seeking to damage the system itself would try to crack the most popular player, even if it's more difficult than other players. The cost of a massive recall - plus the fines the manufacturer would pay for their player being the one cracked - would heavily discourage the use of the revocation system.

I see no one here has read the AACS spec. Each individual player has a different key, not each model. When The Man revokes an individual player, millions of regular consumers are totally unaffected.

Why wait till January?

[Air-conditioned cowh]

Is there some kind of randsom involved?

If the source code exists, which it must if the code exists, then why sit on it?

It just gives someone the chance to bury it before it sees the light of day.

Blu-ray designers were right after all

[News for nerds]

This kind of situation is what they had in mind when they added BD+ in the Blu-ray spec. OTOH, the HD DVD is out of luck.

Re:Blu-ray designers were right after all

[s0matic]

Maybe it's the reverse. Assuming BD+ takes a while to become circumvented, consumers will flock to HD-DVD in the mean time because their fair-use can't be practiced on Blu-Ray discs. And that push may be significant to send Blu-Ray the way of the Betamax.

Re:Blu-ray designers were right after all

[iainl]

BD+ won't help. All it does is perform some checks that are orders of magnitude easier to crack than the AACS encryption, and then allow Fox to brick your player if they don't like what they see.

But since everyone cracking movies will be running a PC rather than standalone hardware, there's nothing to brick; it's all software, and no pirate is going to write the suicide code anyway.

Re:Blu-ray designers were right after all

[News for nerds]

BD+ won't help. All it does is perform some checks that are orders of magnitude easier to crack than the AACS encryption, and then allow Fox to brick your player if they don't like what they see.

Apparently you have no idea for what BD+ is let alone what AACS is.

Re:Blu-ray designers were right after all

[iainl]

I don't know the full details, no. But people who do (people who design these things) tell me that the copy protection listed in the AACS standards is pretty damn serious in comparison to the added level in BD+, that BD+ is a comparative piece of cake to break, that the legal ramifications of leaving a BD+ backdoor in your player are smaller (as we've seen with DVD player region encoding, no hardware manufacturer wants to make it any more than minimally challenging to bypass, because ease of chipping is a major sales feature) and that the technical advisory group told the head Blu-Ray group that it was a stupid feature that they shouldn't apply.

But they were desperate to sign Fox, and Fox said they wanted BD+. What Fox wants from the Blu-Ray group Fox gets, because they are the only chance it has of killing HD-DVD.

It's things like this, their use of MPEG2 rather than a decent modern codec that make me really, really want to see Blu-Ray die a painful death. Their comedic yield rates on 50Gb discs, which show no sign of improving soon, tell me that might actually happen, too.

Re:Blu-ray designers were right after all

[spwolfx]

you seem not to know any details at all...

" BD+ is a dynamic encryption scheme that allows for changing encryption schemes midstream. Should the encryption be cracked, the BDA can update the encryption scheme and put it on all new discs, thus preventing a single crack from opening up the entire BD spec for the duration of its lifetime. "

but hey, dont let little things like facts stop you, please continue...

Re:nothing is perfect

[Sancho]

Trusted Computing solves this 'problem'. Debuggers won't be allowed to run on 'protected' programs, and this will be enforced on the hardware level (each program will effectively have to ask for permission to run).

For right now, not everything has TPM. We'll see how this changes in a few years (almost all new computers do include the TPM chip).

Re:Cheers!

[msobkow]

I agree. We shouldn't have to risk harassment from the *AA for exercising rights that have been granted to us by precendence in different countries, especially those which find their root in UK/Commonwealth legal systems.

It's unfair to expect the individual consumer to fend off such attacks, and insulting to the intent of law to allow the attacks to occur in the first place. The *AA and the various DRM fans are responsible for developing products and solutions/proposals that are compliant with the laws of their target markets, and should not be trying to shove their vision down our throats just to protect oligopoly and monopoly economic models.

The same goes for all industries. Why else has the EU so soundly rejected US proposals to make their patent database a global starting point for managing IP? It's stuffed with speculative junk patents.

Piracy not equal to Losses

[kurt555gs]

I do not agree that piracy has anything to do with losses. Who is to say that those that watch movies without paying a fee would actually pay to see them in the first place?

The only way there is a real loss is if some one is SELLING copied DVDs as if they are original. That is not what we are talking about here. We are in this insane mindset that if we see or hear something that we owe money to some one for it.

Utter stupidity if you really think about the concept.

The only way there is a real loss, is if you counterfeit the media and sell it to some one that actually WANTS to pay for it.

This whole issue of IP ownership makes no sense if one steps back and clearly thinks about it.

Cheers

Re:Piracy not equal to Losses

[evilviper]

Who is to say that those that watch movies without paying a fee would actually pay to see them in the first place?

The only way there is a real loss is if some one is SELLING copied DVDs as if they are original.

Who is to say that those who buy cheaper illegal copies of movies would actually pay full price to see them in the first place?

Re:Piracy not equal to Losses

[networkBoy]

I say it, and thus it is so!

Re:Piracy not equal to Losses

[kfg]

This whole issue of IP ownership makes no sense if one steps back and clearly thinks about it.

Jefferson did so and agreed with you.

Interstingly, his opponent in the matter, Madison, did so as well . . . and agreed with you.

However, Madison thought that despite making no sense it had a certain pragmatic value that more than offset its nonsensicality; and that The People of a free, democratic society would not allow it to balloon out to a truely offensive incursion on their civil rights.

Score one for Jefferson.

(On the other hand, Madison was afraid that an encoded Bill of Rights would be primarily used to interpret a restriction of rights. Score one for Madison)

KFG

Re:Piracy not equal to Losses

[StringBlade]

The difference being that the (U.S.) law specifically protects the copyright holder from others selling his/her works without permission. It doesn't matter that the purchaser would not have purchased the movie for its full retail price -- the law states the "pirate" seller is in the wrong and legally liable.

At the same time, the law also states that anyone redistributing (even for free) The Work without the copyright holder's permission is in violation and subject to fines and other judgments.

However, cracking the encryption in order to copy the disc for backup purposes (or to transfer to a different medium) is protected by law (even the DMCA has a fair use clause) and in this case there's nothing illegal with cracking the DRM to get at the content you paid for (or otherwise obtained legally).

I agree that just because someone watches a movie doesn't mean they were ever willing to pay for it, but that doesn't really factor into law now does it? I mean, by that logic I could argue that I should get everything I want for free because I don't want to pay for any of it.

The real value of something is whether or not I determine it to be worth the asking price -- the same goes for everyone else. If a $400 sweater is worth the money for you to buy, then it's worth $400. If you can live without that sweater then it's clearly not worth that much, but you might be willing to pay $20 for it. If one could clone the $400 sweater and then sell it for $20 we'd be in the same legal situation as the guy selling DVD rips of movies for $5 on the street corner.

Just because my price point is lower than the legal selling point does not make it any more legal for an unauthorized agent to sell me the item at my price point because I was never going to buy it at the full selling point anyway.

Re:Piracy not equal to Losses

[gutnor]

That's when you buy cheaper illegal copies. You get what you pay for. That's no different than downloading it.

However there are people that believe they are paying for the real stuff:
1. they were customer for the real stuff, only the price point was not ok, but that's temporary: they could have wait one month to find it in the bargain bin, bought second hand, ...
2. Also, just imagine that it is a crappy compressed ( DVD9 -> DVD5 conversion). This pirated DVD becomes a bad publicity for the original DVD.

Anyway if making content available can be seen as a noble cause ( information want to free, copyrights are evil, ... )
I'm less understanding with copying content and selling it for a profit to people that could afford it at full price.

We live in developped countries and majority of the population in our countries have no problem afford a luxury life by Average World Standard ( including purchase of modern luxury like DVD, iPod, Consoles, ... )

So it is one thing to fight against laws like copyrights by downloading stuff, sharing your DVD,... , that's quite another to build a business only designed to make profit using illegal (as by the Law) activities.
Businesses selling illegal DVD are not very different than other business doing other illegal activities. And most of the time they are completely illegal business using illegal workers in illegal working condition ( do you really think they are paid a fair salary? )

Re:Piracy not equal to Losses

[jedidiah]

They have ALREADY PAID to get that content. They just haven't been willing to pay the monopoly set price.

Whether or not someone is willing to pay "full price" is IRRELEVANT. Price is a function of supply, demand, elasticity of demand, production costs and such.

The studios would charge you $90 per title if they thought they could. Yet they're making money hand over fist with their current "deeply discounted" prices.

Re:Piracy not equal to Losses

[mgbastard]

IP ownership issues and the fascinating arguments that can be made aside...

(On the other hand, Madison was afraid that an encoded Bill of Rights would be primarily used to interpret a restriction of rights. Score one for Madison)

I assume you were joking about 'primarily' turning out to be true, as the instances of restriction interpretation are rare, compared to the instances of favorable interpretations. Of course, whenever its read as a restriction, its damaging to liberty. That may be absolutist, etc, but so be it.

My point is, the Bill of Rights has served far more good than not in the history of american liberty. So while Madison had a point in that it could be used to the detriment of the society, it has certainly done much more good than bad in protecting the rights of the people from the government. I think he just liked to argue with Jefferson! Excellent engineering tactic. Madison being appreciated; I wouldn't score one for either yet on that argument. But hey, he did get "The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people" in there on #9. It took nearly 40 years for the 10th amendment to be remembered by the courts.

Re:Piracy not equal to Losses

[kfg]

I assume you were joking about 'primarily' turning out to be true, as the instances of restriction interpretation are rare. . .

No knock warrants. Criminal possesion of a screwdriver. You're looking through the end of the telescope they've taught you to look through. Condsider that it might be the wrong end.

I think he just liked to argue with Jefferson!

I don't think there's any controversy there. :)

. . .he did get "The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people" in there on #9.

Legally voided before the ink was dry.

It took nearly 40 years for the 10th amendment to be remembered by the courts.

Say Hallelujah!

KFG

Re:Piracy not equal to Losses

[cpt kangarooski]

The difference being that the (U.S.) law specifically protects the copyright holder from others selling his/her works without permission.

No it doesn't. It says that no one can sell copies unless those copies were lawfully made, in which case, anyone can sell them (or give them away, or in most cases, rent them, etc.) without permission.

However, cracking the encryption in order to copy the disc for backup purposes (or to transfer to a different medium) is protected by law (even the DMCA has a fair use clause) and in this case there's nothing illegal with cracking the DRM to get at the content you paid for (or otherwise obtained legally).

No it isn't. Circumventing protection measures is nearly always unlawful, and fair use does not change that. This is because fair use only applies to making copies, not to circumvention. Circumvention is a distinct step for which fairness has no legal relevance. In order to not break the law, you'd have to make a copy without having circumvented the protection measure, i.e. without ever having decrypted the disc in the process, so that your backup copy was still encrypted. What the DMCA has to say about fair use is merely that it doesn't alter fair use, meaning that it doesn't reduce it (so that it didn't cover certain kinds of copyright infringements, which circumvention is not anyway), and that it doesn't enlarge it (so that it doesn't apply to circumvention, which was never covered under fair use to begin with). And there's everything illegal about circumventing DRM to get at the content you paid for.

Also, making a backup, or shifting media, is not necessarily fair use. It will depend on the circumstances in each case. For some people, under some circumstances, it will be fair (yet still illegal if they circumvent in the process), and yet other times, not fair. It depends, and there is no bright-line rule.

Re:Piracy not equal to Losses

[steveo777]

I understand where the backstabbing labels are coming from. You said that people who see it would not pay to see it, thus it really is stealing. And very much the wrong attitude about it. Kind of like the guy who wouldn't pay for, say, a calculator. So he finds a way to get the parts much cheaper and builds one for himself as a copy of somebody else's. Then for a few buddies... blah blah blah. The guy is pirating and I'd be pissed if he copied my work.

Same for music. If you wouldn't pay for the rights to listen or watch, then don't. In this case just taking them is theft. Just record it off the radio/TV, which I think is still legal.

The only thing that I get steamed about is the DRM preventing me from making copies and backups for myself. I'll bloody well make as many copies of music I buy to keep it safe in whatever manner I choose.

Re:Piracy not equal to Losses

[Kjella]

In order to not break the law, you'd have to make a copy without having circumvented the protection measure, i.e. without ever having decrypted the disc in the process, so that your backup copy was still encrypted.

Except there's a problem here - between a copy and fair USE, there's access. And 1201a) says "No person shall circumvent a technological measure that effectively controls access to a work protected under this title." Encrypted copies can't in any meaningful way be used, because the access control tools don't recognize them as legitimate. If that is anything but abolishing fair use, I don't see it.

Re:Piracy not equal to Losses

[j00r0m4nc3r]

I would like to hear more about your sweater-cloning machine. Please contact me.

Re:Piracy not equal to Losses

[tinkerghost]

Actually, one of the federal courts upheld the right to copy/decrypt digital media for personal use as a fair use exception, however, the same case also determined that creating & distributing the software required to do so was illegal.
So according to the Federal court system, you have the legal right to copy your digital media to you computer for personal use, you just don't have the legal right to posses the software that would allow you to actually do it.

Re:Piracy not equal to Losses

[cpt kangarooski]

between a copy and fair USE

Fair use doesn't mean 'use' per se, it means circumstances under which it is fair to make a copy, distribute a copy, perform a work, etc. Basically anything that is infringing is allowed, if it's fair to do so given the circumstances involved. So making the copy would be the fair use for our purposes. What the copy is intended for plays a factor in whether or not it's fair to make it at all, but we're really not concerned with it otherwise.

If that is anything but abolishing fair use, I don't see it.

It's not, but it is an attempt to make an end-run around it and render it irrelevant.

Re:Piracy not equal to Losses

[cpt kangarooski]

Actually, one of the federal courts upheld the right to copy/decrypt digital media for personal use as a fair use exception, however, the same case also determined that creating & distributing the software required to do so was illegal.

Got a cite?

Re:Piracy not equal to Losses

[Lord Apathy]

How about I say its legal and I'll go one step farther and say that the DMCS is hearby null and void. Does that work for anyone?

Re:Piracy not equal to Losses

[tinkerghost]

from bennedict.com

The DMCA prohibits the sale or distribution of technology that would enable either the unauthorized access to a work or the unauthorized copying of a work. However, only the act of gaining unauthorized access to a work is prohibited.

The distinction is a neat bit of sleight of hand employed to ostensibly preserve fair use. The theory is that since copying a work may be a fair use under appropriate circumstances, the DMCA does not prohibit the act of circumventing a technological counter measure that prevents copying. However, the trafficking in tools to accomplish this is prohibited, so you have to be a hacker to enjoy fair use in the Digital Age.

As far as unauthorized access to a work is concerned, the argument is that since fair use is not a defense to the act of gaining unauthorized access to a work, the act of circumventing a technological measure in order to gain access is prohibited. This raises many thorny issues, not the least of which is that in the real world, you generally need access to a work in order copy the work.

Which is a discussion of copyright in general.
For an actual ruling this PDF is part of the DMCA ruling reguarding 321's DVD copying software. Wherein you get such gems as:

This Court agrees with the Corley court that the purchase of a DVD does not give to the purchaser the authority of the copyright holder to decrypt CSS. and

Licensed DVD players have been issued a key to decrypt CSS, and in exchange must adhere to strict prohibitions on copying of the decrypted DVD; 321's software does not have such a license, and therefore does not have the authority of the copyright owner. Which in effect means that You (the owner of the DVD) do not have permission to decrypt CSS, the DVD player (which you own) has the permision.
My real preference is actually a reference from Corley:

[Defendants] contend that subsection 1201(c)(1), which provides that nothing in this section shall affect rights, remedies, limitations or defenses to copyright infringement, including fair use, under this title can be read to allow the circumvention of encryption technology protecting copyrighted material when the material will be put to fair uses exempt from copyright liability. We disagree that subsection 1201(c)(1) permits such a reading. Instead, it simply clarifies that the DMCA targets the circumvention of digital walls guarding copyrighted material (and trafficking in circumvention tools), but does not concern itself with the use of those materials after circumvention has occurred. Subsection 1201 (c)(1) ensures that the DMCA is not read to prohibit the fair use of information just because that information was obtained in a manner made illegal by the DMCA.

So, you can legally engage in any fair-use of material from a work covered under the DMCA, after you have ilegally broken the 'digital walls'. Wee, that one really does seem to cover "It's legal to do it, but illegal for anyone to make or distribute the tools to do it."

Re:Piracy not equal to Losses

[ajs318]

This Court agrees with the Corley court that the purchase of a DVD does not give to the purchaser the authority of the copyright holder to decrypt CSS.

What were they smoking? This goes completely against Common Law Property Rights! Without the express or implied right to decrypt CSS, the owner of the disc is unable to use it for its Rightful Purpose. The DVD is thus rendered Unfit for Purpose.

Expect to see that ruling challenged. It would never have gone that way in Britain or Europe (and the Continentals have even stricter consumer protection laws than we do).

Re:Piracy not equal to Losses

[StringBlade]

Allow me to provide a few cites to text that I believe support what I've said:
DMCA circa 1998

Section 1201 divides technological measures into two categories: measures that prevent unauthorized access to a copyrighted work and measures that prevent unauthorized copying(2) of a copyrighted work. Making or selling devices or services that are used to circumvent either category of technological measure is prohibited in certain circumstances, described below. As to the act of circumvention in itself, the provision prohibits circumventing the first category of technological measures, but not the second.

This distinction was employed to assure that the public will have the continued ability to make fair use of copyrighted works. Since copying of a work may be a fair use under appropriate circumstances, section 1201 does not prohibit the act of circumventing a technological measure that prevents copying. By contrast, since the fair use doctrine is not a defense to the act of gaining unauthorized access to a work, the act of circumventing a technological measure in order to gain access is prohibited.

2 "Copying" is used in this context as a short-hand for the exercise of any of the exclusive rights of an author under section 106 of the Copyright Act. Consequently, a technological measure that prevents unauthorized distribution or public performance of a work would fall in this second category

and later on in the same document

Savings clauses

Section 1201 contains two general savings clauses. First, section 1201(c)(1) states that nothing in section 1201 affects rights, remedies, limitations or defenses to copyright infringement, including fair use. Second, section 1201(c)(2) states that nothing in section 1201 enlarges or diminishes vicarious or contributory copyright infringement.

...and last but not least - the copyright law itself as it defines "fair use" just so we're clear:

107. Limitations on exclusive rights: Fair use

Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include --

(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;

(2) the nature of the copyrighted work;

(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and

(4) the effect of the use upon the potential market for or value of the copyrighted work.

The fact that a work is unpublished shall not itself bar a finding of fair use if such finding is made upon consideration of all the above factors.

So to me it's fairly clear that the DMCA allows circumvention for cases of fair use. The catch is the interpretation of "fair use". The EFF (among others) consider a personal backup copy fair use. Of course, that's not always the case.

To add more confusion to the mess, the RIAA itself said in the MGM vs. Grokster case

Don Verrilli said to the Supreme Court last year:

"The record companies, my clients, have said, for some time now, and it's been on their websi

Re:Piracy not equal to Losses

[StringBlade]

Hee hee hee

So that means that if I get a DVD decrypter (illegally) and rip all my DVDs to my hard drive removing the encryption in the process...as long as I don't get caught with the decrypter software there's nothing they can do to me after the fact (since they've explicitly stated over and over again, what they care about are the circumvention tools, not the material after it has been accessed).

Re:Piracy not equal to Losses

[tinkerghost]

This Court agrees with the Corley court that the purchase of a DVD does not give to the purchaser the authority of the copyright holder to decrypt CSS.

What were they smoking? This goes completely against Common Law Property Rights! Without the express or implied right to decrypt CSS, the owner of the disc is unable to use it for its Rightful Purpose. The DVD is thus rendered Unfit for Purpose.

Expect to see that ruling challenged. It would never have gone that way in Britain or Europe (and the Continentals have even stricter consumer protection laws than we do).

Oh yes, yes it does in fact go against every tiny bit of common sense that could possibly be used to examine the system as a whole. However, the courts logic is that 1 section clearly protects copying for fair use, therefor fair use is not being blocked by the DMCA. Access is also not blocked by the DMCA as access is granted by the copyright owners to the mfgs of players and thus to the players themselves. The problem is that the access is only granted under the conditions that expressly prohibit the fair use of the content.

The court looked at it in 2 parts -

1. Q: Is fair use prohibited?
   A: no, a clause in the DMCA expressly states fair use is still fair use.
2. Q: Do purchasers have authority from the copyright holders to decrypt the content of the DVD?
   A: No, as exibited by the restrictions placed on mfgs who receive valid keys.

Each part is internally consistant, but totally nonsensical when placed together.

In my motion to reconsider/appeal I think I would have included - "Given that the DMCA and this ruling both state that the concept of fair use is to be protected, please describe in detail how the average citizen of the United States may excercise their fair use rights to a DVD under this interpretation of the DMCA."

From my POV, that's the most important issue. If fair use is to be preserved, then the average citizen must be able to exercise that right. If the judges and the *AA can't come up with how that works, then they can't exclude the geeks from providing the tools. Yes fair use tools can be used to create pirated copies. Construction tools are frequently used to commit murder. Tools are tools, if they have legitimate uses, they need to be permitted.

Re:Piracy not equal to Losses

[gordguide]

Although I understand what you are trying to convey, I think it's important to realize that, if we use the terms correctly, what you are actually saying is that "piracy does have something to do with losses".

If you look at the definition of "piracy" by national rights organizations worldwide you find that it most certainly does refer only to counterfeit disks made for sale. It does not cover private copying for non-commercial use at all.

For example, the International Federation of the Phonographic Industry (IFPA), which is the umbrella rights organization that all the national ones belong to (including the RIAA, in this example) and whose role it is to represent these various national organizations (in fact they act quite similarly to how the RIAA represents its member record companies) you find a quite different definition of piracy, and it's been so for a very long time. They still, to this day, define it the same way.

"Piracy" the term has been pirated by the RIAA and the MPAA in the US to mean something it doesn't, and you have used it in your argument in the same way it's been misused by the RIAA and the MPAA. (No surprise there: the whole idea was to get everyone to misuse it that way, by repeatedly misusing the term in their proclamations in the media at every opportunity).

I do agree with your basic premise: that private copying is something of a crusade they've taken up, while essentially ignoring, publicly, that true piracy (for profit) is the more damaging problem.

But, I hate to see right-thinking people parroting the wrong-thinking person's message. To an extent, it means the wrong guys are succeeding. It's not piracy if it's not unauthorized commercial duplication.

Re:Piracy not equal to Losses

[Kjella]

Fair use doesn't mean 'use' per se, it means circumstances under which it is fair to make a copy (...)

That doesn't mean shit when the copy is useless for anything you could possibly use a copy for. The copy is not a backup, it's not format-shifting, time-shifting, it's not anything. It's meaningless encrypted data unless you can access it. "Copying" in itself is not a purpose, and when you've annihilated anything that could be a purpose you've destroyed fair use because you've destroyed the ends if not the means.

It's not, but it is an attempt to make an end-run around it and render it irrelevant.

They've already did. Show me one case where users have been permitted to disable any function of access control software, even the ones that are blatantly using restrictions not based in copyright law. Anything else is just the inability or unwillingness (to boil a frog) of the access control software to block it, and something they could remove at will with greater invasive control.

Re:Piracy not equal to Losses

[evilviper]

Circumventing protection measures is nearly always unlawful, and fair use does not change that.

It wasn't before the DMCA...

And the DMCA has a special clause for "interoperability" which means if there's ANY platform the DRM doesn't work on, you have a legal right to circumvent it. There's plenty of grey area, of course, but your statement that it's nearly always illegal is certainly wrong.

Re:Piracy not equal to Losses

[evilviper]

Whether or not someone is willing to pay "full price" is IRRELEVANT.

It is distinctly relevant to the subject at hand...

There is no magic change in kind when you go from paying 0 cents to paying 1 cent.

I have no problem with the idea that the RIAA/MPAA are significantly over-charging. But THAT is the part which isn't relevant here.

Re:What's the fuss,anyway?

[Rufus211]

Who said the source was 320p? The source for most movies is a 35mm film print. The current digital cinema spec calls for resolutions that are essentially 1080p and 2160p.

PowerDVD

[postmortem]

That particular copy/edition of PowerDVD is going to be very popular...

Re:What's the fuss,anyway?

[Anonymous Coward]

Commercially available 35mm negative scanners can extract in excess of 10 MPixel per frame. The Digital Imaging Project reflects this by stating that 35mm film should be encoded as native 4200 pixel in longest dimension (depending on actual aspect used this could mean 2600x4200 px). How much data is actually present in a given movie will depend on grain, process, age of film etc. The bits, in point of fact, are there.

Oh, and there is no 70mm version of FMJ, it was shot spherically on 35mm and cut to 1.66:1 which means loss of 20% of image data, let's say no more than 4TB of uncompressed native resolution video. You'll get more from anamorphic movies, and a lot more from 70mm.

Re:Why this may be good...for the planet

[Adult film producer]

No, that means being able to rip the disc/compress it/play on it on his laptop.. or do some resizing so it can play on his ipod, or maybe his mythtv media playing box doesn't have much disk space... There are plenty of reasons why the consumer loses with digital restriction management.

Re:Cheers!

[Anonymous Coward]

Something like "Just like the Beta-emacs vs vi-HS wars!" ?

Re:Cheers!

[atlasdropperofworlds]

If they can be decypted, they no longer have restrictive DRM, right?

Re:Please improve the source code

[Rufus211]

A quickly glanced at the java sources.
They are crap. No use of NIO, using Hashtable instead of HashMap and all sorts of strange quirks.
I predict, a proper version will be *much* faster in decrypting the content.
Please, someone with time on their hands: Improve this code

Why would those things matter at all? 99% of your time will be spent in the java-provided AES decription routines. Optimizing a single hash lookup will make about 0 difference.

Lookup premature optimization is and learn from others mistakes.

Re:Cheers!

[Ironica]

Anyone over the age of 40 I've talked to about the two formats has said, "What, you mean like Betamacs and VHS?" Just keep telling people that that's what this reminds you of, and wait for someone to start selling a less draconian product.

Um, except, VHS became the dominant format for many years, until (the more draconian) DVD unseated it. So the Betamax/VHS issue doesn't really serve to predict the failure of both formats, nor the rise of a new format which is more open.

"your not in the minority in doing so"

[da5idnetlimit.com]

So, if he's not in the minority in doing so, and he lives in a real democracy, then what he did must be deemed legal by public assent...
Alas he lives in a republic, and it's a different beast altogether....

Can't see the pixels...

[Joce640k]

"I cannot see any pixels on a regular 36 inch CRT TV when I watch a movie"

Whether or not you see them depends on how far away you are. If you sit closer, you'll see them, I'll garantee it.

Equivalently, instead of sitting closer you can make the screen bigger - it's the same thing, and that's what's happening. 36" is nothing these days. There's plenty of TVs bigger than that, and projectors are becoming common.

I watch my movies on a 110" screen via a projector, and I can definitely see the pixels.

huh?

[someone1234]

So, you would like an uncrackable DRM because you hate uncrackable DRM???

Re:huh?

[sunny256]

So, you would like an uncrackable DRM because you hate uncrackable DRM???

Maybe he has some belief in the consumer mass that they will value their rights and reject the product because of the tight DRM. I'm heavily disappointed about what I've seen so far. Seems as there'll always be a big enough mass of people who doesn't care, and then it gets popular enough to bother me.

Re:huh?

[someone1234]

Maybe, and i can only agree with you. But how the news of being able to crack this stuff will increase the popularity with the so called 'ignorant masses' ??? I would like to see the publication of Microsoft's player keys so they will get banned and they need to get issued a new key, only to get those published the next month. (if i understood the underlying technology correctly).

My guess on where this is going.

[eddy]

If I may speculate (which I love to do), I predict that if "leaking" title- (and possibly even host-) keys become common, software players (or at least their HD-module) will NOT get licensed from AACS-LA unless they only run on "Trusted Computing Platforms". Of course, the media moguls have a problem here since they need their format to win in the market, so it's a trade-off for them for sure. If people resist "Trusted" computing, HD-DVD/AACS may have an 'effective' lifespan that's even shorter than what DVD-CSS had.

Looking forward to some cryptographic attacks.

Re:My guess on where this is going.

[Cafe Alpha]

Trusted computing depends on chip features right?

I wonder if someone, say the Chinese, will crack a trusted platform and make hacked processors.

Re:nothing is perfect

[sxpert]

and you can probably run the app inside a software simulator to analyse what it does...
you can fake everything, even TSCs and whatnots, the program won't have any way to find out the type of "hardware" it's running on.

Clever key tricks won't matter!

[Cafe Alpha]

Each movie will end up being cracked, once, then everyone will download the same cracked version with file sharing. That's the niche they can't prevent.

So it really doesn't matter what stupid multi-key tricks the studios come up with.

I can predict that software players will all be revoked as each one is cracked, though - forcing all of the customers to keep downloading unrevoked, presumably more secure updates. That much is predictable.

Actually there is an attack against file-sharing from the same source. If they watermark the movies so that they can tell which key the crack came from then they can revoke THAT key to prevent future use... But hackers will learn how to recode and filter to remove watermarks before release.

Re:Clever key tricks won't matter!

[I'm Don Giovanni]

It's more likely that software players simply won't be granted keys in the first place, so only hardware players will be able to play the discs. Which screws over HTPC users. But, I guess it's worth killing off the HTPC market for some losers to pirate a few movies.

Re:Cheers!

[Fred_A]

Anyone over the age of 40 I've talked to about the two formats has said, "What, you mean like Betamacs and VHS?"

Or even (for the ones with the better memory), "What, you mean like Betamax, VHS and V2000 ?"

Ease of chipping feature!

[Cafe Alpha]

I like that, the "ease of chipping" feature as a major selling point!

Re:Ease of chipping feature!

[iainl]

Welcome to Europe, where no-one wants to be unable to import films from the US.

With the new formats I expect it to be less of an issue eventually; at least we've lost PAL speedup now that our discs are 1080p/24 as well. But my US HD-DVD owning friends have now gone import crazy - HD-DVD's lack of region encoding is a huge bonus, and from a copy protection point kills at a stroke the need to bother with chipping for most people.

Although I've heard nothing other than rumours, I think Lions Gate at least are going to have to go dual format at CES, simply because all the (currently Blu-Ray exclusive) jewels in their US catalog keep coming out on HD-DVD through Canal+ and others in Europe and Japan. Once the money men start seeing the exclusivity is losing them money, I expect things to change.

Re:What's the fuss,anyway?

[Kjella]

How much data is actually present in a given movie will depend on grain, process, age of film etc. The bits, in point of fact, are there.

That's not a meaningful statement, I can have endless bits which will consist of nothing but random noise. As for how many lines of resolution is actually achieved by film, you can read here. The actual study referred to is here (pdf). The summary:

35mm RESOLUTION
 
Measurement Lines
Answer Print MTF 1400
Release Print MTF 1000
Theater Highest Assessment 875
Theater Average Assessment 750

So basicly, good film is HDTV (between 720p and 1080p somewhere). Film transfered directly to digital has about 1400 lines of resolution, which is better than current direct digital productions, but not by much (most production grade is 1080 lines, and so are people's HDTVs). Of course, while this is done using 'typical' equipment it's of a resolution chart under excellent conditions, I expect an actual movie would have less.

Re:Cheers!

[WhatAmIDoingHere]

DVD had more to offer over VHS compared to HD-DVD and BluRay over DVD. DVD offered no rewinding, special features, easy chapter browsing.. All things that VHS lacked. That's why DVD won over VHS. All they're offering in HD-DVD and BluRay is Slightly Higher Def, which is lost on like 95% of the TV owning public. Oh, and restrictive phone-in DRM.

Frankly I'm waiting for the next wave - HDDs

[StringBlade]

I think HD-DVD and Blu-Ray simply will not succeed because hard disk drives will get smaller (in size), larger (in capacity) and more resistant to shock - even to the point of being solid state (like a flash drive).

When this happens, optical media will be a thing of the past because it only holds a mere 250GiB. Tiny drives like the ones in digital cameras probably make for better storage (or will) of high definition video than optical discs do because they're more likely to grow in capacity with the video than the Blu-Ray is (unless they find another frequency of laser light to make even smaller pits and grooves to increase the capacity of a disc -- or mash even more layers in a disc I suppose).

Yes HDDs are more fragile...now. In 10 years I would be surprised if HDDs haven't replaced both of these HD formats for HD content (or another possibility is that you don't buy physical media anymore, you simply stream it to your TV/computer as video on demand).

Re:Frankly I'm waiting for the next wave - HDDs

[Aqualung812]

(or another possibility is that you don't buy physical media anymore, you simply stream it to your TV/computer as video on demand).

Ding ding! We have a winner. Unless optical media offers greater storage than HDD, download will be the way of the future. Maybe even streaming, if bandwidth outpaces optics.

Re:nothing is perfect

[Dunbal]

and you can probably run the app inside a software simulator to analyse what it does...

      That's the joy of owning both the key AND the lock. But the IAA's, and even Microsoft and Intel - haven't figured this out yet. Sigh.

Will the mpaa/riaa ever learn

[bl8n8r]

They are just pissing away money fighting an unbeatable battle. The only way they can lock down the content is by not using it.

--
Novell petition: http://www.techp.org/

Re:Cheers!

[aplusjimages]

Always look to the porn industry. Where is the porn industry at right now? Still on DVD and downloadable content. Downloadable content is the future. Sing it with me "Downloadable Content is the way to go."

Cracked or no, still formats in search of a market

[punterjoe]

Maybe if the powers behind the format had put aside their petty squabbling and released a single format, they could have devoted their energy to finding a market for the format. Now they're busy battling each other for market share, yet this competition doesn't seem to be benefitting consumers. By the time they have a format inexpensive & useful enough, a new format will have likely come along & crptured the public's attention anyway.
    HD is not a selling point. It may be useful as a marketing term. I hear many stories - and know some firsthand - of people who connect their flatscreen to a DVD or SD cable and think they have HD. Most people don't know the difference & can't be bothered to learn. Until their is one high capacity disc format, and it's affordable enough to compete against hard drives for storage or flash memory for portability, the manufacturers are wasting their time - and ours. Lack of DRM alone won't sell this.

Re:Cheers!

[danpsmith]

Um, except, VHS became the dominant format for many years, until (the more draconian) DVD unseated it. So the Betamax/VHS issue doesn't really serve to predict the failure of both formats, nor the rise of a new format which is more open.

Yes, but I guess nowadays most people are assuming that consumers won't want to get involved in a corporate battle for format control like they did not then, not knowing that their newly purchased betamax machines would be shiny pieces of garbage as they had to buy a second VCR. I think acknowledging this as Betamax/VHS is to acknowledge the fact that it's wise not to get involved while the two respective companies duke it out. Which is exactly what a lot of people will do, while continuing to buy DVDs.

Re:Cheers!

[ajs318]

And the Sony C6 Betamax recorder, given a decent aerial, could record the Teletext signal along with the picture (even if your set was non-Teletext, since it's being picked up by the recorder's internal receiver). I never even realised VCRs weren't supposed to be able to do that. All those old Betamax cassettes in lofts and cupboards are hiding not only subtitles, but little vignettes of the news and sporting events of the day they were recorded.

The only problem was that in order to get that resolution better than 280 lines (think about it - that's only chucking away 32.5 of 'em, which isn't bad), a Beta machine needed more moving parts than its VHS cousin (although they moved less often. VHS laced the tape when you pressed PLAY and unlaced it when you pressed STOP. All fast-winding was done inside the cassette -- which allows you to move the tape faster, but you cannot switch to picture-search without lacing it. Betamax laced the tape the first time you pressed PLAY and unlaced it when you pressed EJECT. Fast-winding was done inside the cassette until you first pressed PLAY [to allow for rapid rewinding before watching], and thereafter, with the tape laced; making it possible to switch instantaneously from fast-wind to picture-search.) Thus, VHS recorders were easier to field-maintain. And in an era before everything was made to be disposable, that was the deal-clincher.

OK. . .

[kimvette]

NOW I am willing to buy hi-def DVDs since I can:
  - Take advantage of Fair Use (make backups, format-shift to my PocketPC, keep copies of the movies on my HDD)
  - Play DVDs on Linux
  - Not worry about downsampling output on non-HDCP video cards

Now the Blu-Ray vs. HD-DVD format war does not matter so much. Does anyone here care WHICH one wins now that both have been cracked?

Thanks guys, you rock!

Re:Cheers!

[kunwon1]

The European ones with a better memory, anyway. V2000 never hit the streets in the US.

Re:Cheers!

[Steve001]

danpsmith wrote and included with a post:

Um, except, VHS became the dominant format for many years, until (the more draconian) DVD unseated it. So the Betamax/VHS issue doesn't really serve to predict the failure of both formats, nor the rise of a new format which is more open.

Yes, but I guess nowadays most people are assuming that consumers won't want to get involved in a corporate battle for format control like they did not then, not knowing that their newly purchased betamax machines would be shiny pieces of garbage as they had to buy a second VCR. I think acknowledging this as Betamax/VHS is to acknowledge the fact that it's wise not to get involved while the two respective companies duke it out. Which is exactly what a lot of people will do, while continuing to buy DVDs.

Unfortunately, the video companies did not learn one of the factors that made CD a success: a single format. Although many formats were proposed, only one was chosen and accepted by the music industry. They saw what happened with Quad (seven incompatible formats), and were determined that CD not meet the same fate.

Due to the format war going on between the two DVD successors, I will stay with DVD and sit out the war until long after there is a victor. For me, DVD is good enough for now and I have no pressing reason to move to either format. It is the same reason that I am staying with CD, versus going with either of the CD successors.

I wouldn't be surprised if the above paragraph reflects the views of many people concerning the new formats.

Nothing yet Proven

[Anonymous Coward]

This guy wrote a Javaclient based on the open AACS spec which can decrypt the AACS format using Java AES calls.
The program takes a title key as input.
This is nothing special - any student given the spec could write this.

For the whole thing to work, needs a title key.

He did not include those keys - as someone here pointed out, what looks like a key are infact hash-indici to associate the discs with the keys - the keys are however nulled out.

He now claims that it is easy to find the keys if you're looking in the memory.

Case 1: He is right:
According to AACS rules, you need to keep the keys highly confidential. The robustness rules would explain this, I assume you have to hide things from debuggers and not keep keys clean in one memory location, etc... Black art of tamper-resistance is required.
If the player vendor didn't do that, they face serious consequences in addition to the key being revoked.

Case 2:
He wants that others try to find the keys, because he could not do it himself.

Case 3:
This is a hoax and on January 2nd, when he offers us the update, he will laugh at us all

Case 4:
Someone is trying to badmouth something here, be it HD DVD, AACS or PowerDVD

Anyway, I guess we need to wait. Until then, nothing has been proven....

Re:Nothing yet Proven

[mandelbr0t]

I assume you have to hide things from debuggers and not keep keys clean in one memory location, etc... Bwahahahaha! Typical non-debugger user. There's no such thing as "hiding something from a debugger", especially not the debuggers we're talking about here. Unless you're on an OS which doesn't let you set the processor's trace flag (why on Earth would you buy such worthless crap?), you will be able to debug, admittedly at a machine language level, but some people can and do read Intel machine code. So fine, keep the bits in a dozen different memory locations. Don't copy the entire key to the HD-DVD device at one go. Use all of the black magic you mention, and it's still possible to reverse the entire process. Obscurity != Security. The only solution is a legal one: make debugging illegal. Hopefully they don't grandfather that law in, or I'll have one hell of a criminal record...

mandelbr0t

RFC compliance language

[Anonymous Coward]

Oops. Looks like they should have used the RFC conventions. They should have used "must" instead of "shall" :)

Re:Cheers!

[itlurksbeneath]

DVD's won over VHS? Didn't I just read an article about how DVD player ownership just surpassed VHS player ownership? If you consider that winning the war, it sure took them long enough (~10 years).

Re:Cheers!

[Name Anonymous]

DVD had more to offer over VHS compared to HD-DVD and BluRay over DVD. DVD offered no rewinding, special features, easy chapter browsing.. All things that VHS lacked. That's why DVD won over VHS. All they're offering in HD-DVD and BluRay is Slightly Higher Def, which is lost on like 95% of the TV owning public. Oh, and restrictive phone-in DRM. Also, when DVDs came it it worked with the TVs that people had in their houses already. HD-DVD and Blu-Ray require new TV sets and who knows what else for people to be able to make use of them.

Of course, until this format debacle is decided I am not buying regular DVDs either.

Revoking doesn't work...

[Joce640k]

To decrypt the files you need a 128-bit "title key".

There can only be one title key for each disk.

There's no way to work backwards from a title key to the key in an individual player so how can you revoke a player's key?

Re:Revoking doesn't work...

[Junta]

By revoking a player's key that is being exploited to acquire title keys, *new* pressings of discs will not be susceptible until they figure out how to exploit another program that still has a valid key.

It's true, once the player's key is effectively compromised, any current disc that player can play is vulnerable, but new releases and new pressings of the current releases can be made unreadable by that player.

On the work backwards from a title key to the player key, I'm not sure I understand who you are asking about. I'm assuming you are saying how would they know which key to revoke. The answer is not based on the released keys, but on comments/watching the video. I think there are a grand total of two pieces of software currently, and one of them is used clearly in the video. In this particular instance, they know to take a long hard look at PowerDVD, but to be on the safe side, look at the other one and maybe revoke them both. The size of the market you have to piss off is very small at this point. If, say, 30% of the general population had a large variety of HD-DVD playback options, figuring out the key to revoke could be troublesome and piss more people off when/if they did.

Of course, if no player key is released, it remains a pain in the ass to play back an arbitrary disc, and, in fact, you *must* download the probably copyrighted title/volume key from the internet. Which means even in the absence of DMCA they can slap parties with distributing and downloading copyrighted material, even if they can't prove anything illegal with the actual movie content. It's essentially brought it up to the same level of pain in the ass as finding product keys for standalone software.

Re:nothing is perfect

[Joce640k]

"But the IAA's, and even Microsoft and Intel - haven't figured this out yet."

Sure they have but they're not going to admit it while they're still making money from selling the dream.

Cracked equals buyable.

[MikeFM]

If the crack turns out to be real and workable on all titles then this will be good enough for me to be able to buy BlueRay movies. I probably won't, for a while, because I still don't feel a need for any form of HD movies.

I totally agree that it'd be great if we could force these companies not to use DRM but to be realistic that isn't going to happen until a competitor that doesn't use DRM starts whooping their ass. So the first step would be to start releasing DRM-free HD movies which probably means either producing your own movies or convincing someone high up in some movie company that DRM is hurting them.

I'll jump in when it's truly cracked

[sdo1]

I'll be getting one of these formats when it's truly cracked (like DVD CSS is cracked). I have a home media server and the most-watched DVDs in my house are on there. The video quality of DVD leaves something to be desired on my 50" DLP (it's OK, but the quality of the mastering job truly does matter, and HD is certainly much better). I'm interested in getting an HD format... but it's been the lack of a simple, reliable method of ripping the discs that's kept me from jumping in.

I simply refuse to bend over to the movie industry. I WILL be able to do what I want with the content that I BUY. I'm not averse to handing over cash for the shinny silver disc. But when I get it home, I want the ability to put it on my media server and stream it around the house if I want. End or story. Until that crack is real and trivial to use (see software like DVDshrink or DVD Decrypter), I'm out. No blu-ray or HD-DVD for me.

-S

Re:I'll jump in when it's truly cracked

[swillden]

I'll be getting one of these formats when it's truly cracked (like DVD CSS is cracked).

Then you'll never get one of these formats.

CSS is just lousy crypto. They decided to create a homegrown cipher and it's horribly weak. So bad that libdvdcss doesn't even bother with player keys or even disk keys, it just does a ciphertext-only attack on the title keys using the data on the disk.

The new formats use basically the same key structure, but rather than CSS they use AES as the cipher. AES is not a homegrown cipher created by the MPAA etc., it's the United States' standard cipher, selected from dozens of submissions from the world's top cryptographers, and heavily analyzed by the world's top cryptographers for two years. It was selected to replace DES, which has stood essentially unbroken for 30 years, despite being the holy grail for academic cryptanalysts for much of that time. DES is now retired, but not because the cipher is weak, but because the keys are too small. AES is very strong, and has sufficiently large keys that brute force attacks will probably never be feasible (everyone knew that DES would ultimately fall to brute force searches, and there is lots of speculation that such a small key size was chosen specifically because the NSA wanted to be able to brute force it, but was confident that no one else had the computational resources to do so).

Bottom line: It's very, very unlikely the new formats will be broken like CSS was. From a practical standpoint, though, that doesn't matter. Once there are enough player keys released into the wild, you'll be assured of your ability to decrypt any disk you like.

Re:I'll jump in when it's truly cracked

[I'm Don Giovanni]

Wouldn't the AACS's "managed copy" scheme work for copying movies to a media server for personal use? And it requirs no hacking and is completly kocher. But I don't know if HD-DVD discs are supporting it yet.

What?

[Snaller]

But surely they can't include millions, posibly billion of keys to lock out any specific consumer player?

Re:What?

[fluffy99]

Why not? 1 million 128-bit keys is only 16 meg of data.

Re:Cheers!

[WhatAmIDoingHere]

When was the last time you saw a movie come out on VHS? Or even for sale at a store?

Re:Cheers!

[WhatAmIDoingHere]

"All they're offering in HD-DVD and BluRay is Slightly Higher Def, which is lost on like 95% of the TV owning public."

That's what I said. I only know one person with a HDTV. Everyone else sees a 32" CRT for $76 compared to a 20" HD LCD at $290, and they grab two 32" TVs.

Re:Cheers!

[Dargoth_Rejuv]

All they're offering in HD-DVD and BluRay is Slightly Higher Def, which is lost on like 95% of the TV owning public. Oh, and restrictive phone-in DRM. Bad generalization here, the authoring capabilities for both formats is incredibly more powerful than DVD. There's much more to it than just more pixels. I agree that the DRM sucks, but the DRM on DVD's sucks as well, but we all manage to live with that without freaking out too badly.

A Few Missing Formats

[Gr8Apes]

How about S-VHS? Remember that one? It was considerably better than VHS, was available, but really went nowhere, because VHS was truly "good enough" at the time. Then DVDs came out, and gee, they're great!

As for other unmentioned formats brought up by Quad, remember SACD and DVDAudio? Where are they? Especially when you consider that the DVD is perfectly capable of recording audio without going the draconian DVDAudio route. I have several DVDs with music that plays perfectly fine in my DVD player, complete with 5.1 sound. I don't own a DVDAudio disk. I do have one SACD, but it plays in normal CD players.

I'm sure there's plenty more, but that'll do for the recent past. The common thread in the failures I see was price and, for the content, more draconian DRM (SACD and DVDAudio players both have significant restrictions in place on playback options, DVD discs do not, so you get full digital output on DVD recorded discs, while you get analog only output on the other two)

Re:A Few Missing Formats

[Jeremy Erwin]

SACDs? I have a few. Tower Records closed down, though, and most of the other retailers aren't terribly keen on them.

The audio portion of a DVD-Video disc is limited. Either you get CD quality stereo tracks (called LPCM), or you get surround tracks in a lossy format (dts/dolby-digital). DVD-Audio adds "Advanced Resolution Stereo", which at 192KHz/24 bits can (well, theoretically, anyway) sound even better than a CD, and Advanced Resolution Surround, which is a lossless surround track. It's pretty cool, if you have decent home theater speakers.

SACD ditches Pulse Code Modulation for something called DSD. The supposed advantages of DSD are debatable, and only audible on expensive systems. Cheaper players convert the DSD into PCM anyway... Many of the SACD also hare a lossless multichannel track.

Some SACDs are known as hybrid discs, and incorporate both an SACD and a CD layer. CD Players can't read the SACD layer, so they play the CD layer instead.

My DVD-Audio player can output 192/24 stereo over spdif, though most players limit the sampling frequency to 48 KHz. SPDIF isn't configured to stream lossless surround tracks, so if you want a digital connection, DenonLink, 1394, or HDMI are your options. DSD is incompatible with SPDIF, too. so it's turned off when a SACD layer is played.

I'm not sure why a digital connection is so important anyway. Bass management and time correction can be done by the player, and players have decent built in DACs.

Re:A Few Missing Formats

[Gr8Apes]

Very informative. A couple of questions, however:

I was under the impression that the DVD-Video audio section allowed you 5.1 near lossless CD quality plus audio, as a maximum? You would have to encode it specially for that, but it was possible.

Doesn't DTS carry more information than the DD tracks? They're about double the size, and I recall, faintly through the haze of memory, that DTS had more range and signal to noise than DD.

I also thought that SACD was brought out specifically because it was backwards compatible with current CD players. The front right and left channels are on the CD layer, with the additional tracks on the SACD layer. Again, very hazy on the memory bit, as I haven't looked at one in years.

As for the digital connection, it's important if you want to create a lossless copy for backup/archiving/migration to another format. There's no technical reason for DVD-Audio or SACD to not be transmitted directly via SPDIF other than the manufacturer will violate the licensing terms for those two formats. DenonLink is a proprietary formatted link only compatible with Denon products, as of 3 years ago which, IIRC is also encrypted. I don't know of any players that will output across 1394. HDMI runs you right back into the proprietary encrypted format that is difficult to copy.

Lastly, only an extremely exclusive few players have bass management of which even fewer have decent bass management, and only innordinately expensive players, by todays standards, will even have the DACs nowadays. I was just recently looking, and most have punted on DACs, letting the receiver/TV handle it since they have HDMI outputs anyways. (I was just looking for a decently priced, roughly $100-160 dvd player that merely had built-in DACs for DD/DTS and didn't find any)

Re:A Few Missing Formats

[Jeremy Erwin]

I was under the impression that the DVD-Video audio section allowed you 5.1 near lossless CD quality plus audio, as a maximum? You would have to encode it specially for that, but it was possible.

dts claims that 1536 kbs rate is very close to lossless. The half bitrate (768 kbs) variety is used more often, though, and from what I've read, it's still lossy.

Think of the two advanced formats as "CDs with six channels instead of two". If you have the ears and the equipment, the stereo tracks can also sound better than CDs.

I also thought that SACD was brought out specifically because it was backwards compatible with current CD players. The front right and left channels are on the CD layer, with the additional tracks on the SACD layer. Again, very hazy on the memory bit, as I haven't looked at one in years.

Sony wanted to bring out a system that sounded superior to CDs. The very first SACD players and discs were stereo. Multichannel came later.

My copy of "Kind of Blue" only has stereo DSD and three-track DSD. The latter uses adds a center speaker, and mimics the original recording session, pre mix. Or something. Anyhow, it's slightly different. It's not playable in a CD player-- which is a pity,

A multichannel hybrid SACD has three separate versions of the same music-- one stereo DSD, one multichannel DSD(up to six channels) and one stereo PCM, the last for CD players.

As for the digital connection, it's important if you want to create a lossless copy for backup/archiving/migration to another format. There's no technical reason for DVD-Audio or SACD to not be transmitted directly via SPDIF other than the manufacturer will violate the licensing terms for those two formats. DenonLink is a proprietary formatted link only compatible with Denon products, as of 3 years ago which, IIRC is also encrypted. I don't know of any players that will output across 1394. HDMI runs you right back into the proprietary encrypted format that is difficult to copy.

Sony doesn't want you backing up the high resolution tracks, but I can rip the CD layers into iTunes. All the digital outputs of an SACD player (if it even has one) are encrypted.

My player (a Sony scd-c2000es, which is also available in a non es version) has bass management of some sort. No digital outputs, though. My DVD-Audio player is a Oppo 971H. It also has bass management. The digital out is stereo only.

Lastly, only an extremely exclusive few players have bass management of which even fewer have decent bass management, and only innordinately expensive players, by todays standards, will even have the DACs nowadays. I was just recently looking, and most have punted on DACs, letting the receiver/TV handle it since they have HDMI outputs anyways. (I was just looking for a decently priced, roughly $100-160 dvd player that merely had built-in DACs for DD/DTS and didn't find any)

Maybe you'd be happy with a Oppo 970hd-- sacd and dvd-audio, as well as decent, if not truly stellar dvd performance.

Re:A Few Missing Formats

[tylernt]

How about S-VHS? Remember that one?

More than remember it, I have an S-VHS VCR. That's not why I bought it, though, and I've never seen an S-VHS cassette, either blank or at a video rental place.

It does have a nice feature called SVHS-ET though, which does wonders for picture quality -- even on a cheapie non-SVHS tape. SVHS-ET at EP speed looks at least as good as VHS at SP.

S-VHS might have gone somewhere if it had had more time before DVD came along and rendered it pointless.

Re:A Few Missing Formats

[Gr8Apes]

I was under the impression that the DVD-Video audio section allowed you 5.1 near lossless CD quality plus audio, as a maximum? You would have to encode it specially for that, but it was possible.
 

dts claims that 1536 kbs rate is very close to lossless. The half bitrate (768 kbs) variety is used more often, though, and from what I've read, it's still lossy. When I talk about lossless, I'm only talking about losses as compared to the original recorded source. All recording technology I'm aware off have some losses and/or artifacts when recording (tape hiss, record hiss, roundings, etc.)

That said, I'd expect that the 1536kb/s sampling has a better approximation than 768kb/s as it's using the same technology. At some point though, the maximum audio resolution will be hit, and increasing the sampling rate beyond that will not improve the approximation.

The best analogy I can come up with is the old regularly spaced dots (the sampling rate) on a curve (original sound source). The more dots you have (the higher the sampling rate), the better you can approximate the curve (sound/music). The better your algorithm (MP3, Dolby Digital - AAC, DTS), the fewer dots you need (lower sampling rate) to approximate the curve. At some point, you will have enough dots that you cannot effectively approximate the curve any more accurrately, and that is the maximum audio resolution of a digital recording device.

In any case, both DD's AAC and DTS can be much better than CDs 44.1 kb/s assuming the recording equipment can exceed the 44.1 kb/s sampling rate of CDs, otherwise the best you can do is approximate the CD's quality. I also know that AAC can be worse, if you lower the sampling rate too much. For instance, iTunes files are generally 128 kb/s, which are worse than CD audio. To be fair, they're much much smaller file sizes than the uncompressed wav file would be.

 
Maybe you'd be happy with a Oppo 970hd-- sacd and dvd-audio, as well as decent, if not truly stellar dvd performance. I looked at a couple of Oppo's, but they didn't have the picture quality I wanted. Don't recall if the 970hd was in that lineup though. I was looking primarily for a progressive player for movies, with decoding capability for DTS for someone else. My personal DVD player is a Denon, which is more than adequate for what I want at the moment.

Re:A Few Missing Formats

[Jeremy Erwin]

The problem with a lot of CDs is not that the available resolution is so poor, or that they can't produce super high frequencies, but that they are mastered to maximize loudness at the expense of dynamic range. A movie soundtrack, however, is not mastered nearly so poorly--for cheap equipment, dolby supplies various dynamic compression algorithms. It's surround as well, which can add something.

As for curve fitting, wouldn't the "more precise" traces be more precise because of high frequency elements that can't be heard? Something about Nyquist...

SACDs and DVD-Audio are niche formats. Sometimes, they can sound gimmicky, sometimes they sound cool.

The Oppo 971H does not have good component outputs. The DVI, however, is stellar (and unencrypted). The Oppo 970HD apparently has good component outs and a good hdmi out.

Re:A Few Missing Formats

[Gr8Apes]

The problem with a lot of CDs is not that the available resolution is so poor, or that they can't produce super high frequencies, but that they are mastered to maximize loudness at the expense of dynamic range. A movie soundtrack, however, is not mastered nearly so poorly--for cheap equipment, dolby supplies various dynamic compression algorithms. It's surround as well, which can add something. Maximizing loudness (thus reducing your dynamic range) is not solely the fate of CDs. It is, for some reason, more prevalent on CDs. It's also extremely annoying.

Regarding Nyquist, that works wonderfully if your waveforms are pure sine. If not, you'll need more points to approximate the shape.

Re:A Few Missing Formats

[Jeremy Erwin]

I'd recommend that if you really want advice on home theater stuff, that you seek out hometheaterforum.com, though I must admit some of the members are a little too pro-DRM for my taste.

Re:A Few Missing Formats

[Gr8Apes]

I've visited a variation of them more than once. I was only looking for some discussion, not advice. Well-mastered CDs work for me just fine, badly mastered ones are, well, bad.

Since I tend to listen to most of my music in my car these days and road noise being what it is, that extra 0.05% quality in audio you can get above a well-mastered CD isn't noticeable anyways. (multi-channel and other gadgetry is pretty much out due to cost)

I really appreciate the details on formats though. It was interesting, to say the least. I'll stand by my statement on Nyquist frequencies. While that formula let's you recreate the frequency spectrum, it doesn't let you recreate the shape of the waveform(s).

Re:A Few Missing Formats

[HTH NE1]

I had an S-VHS VCR as well. Unfortunately it doesn't play back very well anymore. I think there's a problem with the tape feed.

Despite having multiple TiVos and DVD players, I still found myself having to buy a VCR to transfer tapes to DVD for a friend. You can't get a VCR with S-Video out at a reasonable price anymore. Even decks that have VHS and DVD in the same case, the S-Video out is only active for the DVD side. Due to decreased demand, S-VHS decks now cost around $300. D-VHS decks won't play S-VHS tapes at anything better than standard VHS quality.

Re:Cheers!

[james_orr]

I still have a VCR, hooked up and everything. I can't remember the last time I actually watched a movie on it though. I did use it a few weeks ago to record something ... the VERY unusual situation where all 3 tuners on my MythTV were busy and there was still something else I wanted to see. That's the first time that has happened in a long time too.

My point is, DVD ownership just surpassed VCR ownership, but a lot of people still had/have their VCRs even if they were not using them often.

Screw This -- I'll Check back in a Decade

[vtcodger]

Y'know what? There is a whole library in this town full of books I haven't read and CDs I haven't listened to, and VHS tapes I haven't watched. I need this DRM nonsense like I need an infection of antibiotic resistant Staphylococcus.

So, I think I'll just do my damndest to avoid buying ANYTHING that implements or requires DRM ... Starting with Windows Vista. I probably won't succeed 100%, but I think I can come close. If enough folks join me in this, maybe we can convince "them" to either abandon DRM or come up with DRM technologies that are not a monumental PITA.

Either will be fine with me.

Re:Cheers!

[sbaker]

The irony of that was that the format that eventually won (VHS) was technologically the worst of the three. The format that lost out the fastest (V2000) was technologically the best of the three (by far actually). If there is something to be learned from this it is that technological superiority doesn't count for much in setting global de-facto standards.

Morality

[sacrilicious]

DRM sucks, yes. But if you are agreeing to pay for a rental of a movie you have no right; legal, moral, or otherwise, to keep it permanently.

Agreed about not having the legal right. But who are you to say there's no moral right? The laws defining what's legal are fairly clear in this matter, at least in the US, but there is no clearly delimited moral construct... morality is up to each individual. You are free to decide that -- morally speaking -- you are going to adhere to a certain standard. It is up to others to decide for themselves what their morality is.

As for "or otherwise", what "otherwise"'s (i.e., alternatives to legality and morality) are being referenced? Without even knowing what alternate frameworks of interpretation are being summarily dismissed, I'm not inclined to green light that throw-away, no matter how compellingly rhetorical it might sound at first blush.

Re:Please improve the source code

[marcosdumay]

That makes perfect sense if the keys aren't stored at the same machine that will decrypt the movie.

Exactly!

[Dion]

I've been saying this for a while.

The way this will work is that undiscovered player keys are used to decrypt title keys and the title keys them selves are then distributed.

As long as everybody keeps his piehole shut the collection of title keys just grows and grows, maybe even by dynamically requesting a title key before playing a movie.

If a player key is discovered and disabled by the goonsquad then that player key is simply published along with the title keys that it can't be used to obtain, that way the whole key package shinks every time the evil content overlords disable a key.

It's likely that player keys will be discovered with some frequency, so the freedom fighters might choose to publish player keys on their own just to shink the key package.

Someone needs to put together the infrastructure to support title key distribution and some dynamic way of decrypting an encrypted title key.

Re:Exactly!

[Dion]

I should have specified, "Everybody"

The only one who needs to keeps his trap shut is the guy who recovers a player key.

Someone should write a guide for this situation so Blabby McFlappy lips doesn't go bragging on the intarweb about his cool crack as soon as he recovers a key.

Bragging about writing a 500 line Java snippet that decrypts AES is fine, although a bit unsurprising, AACS has been documented for years and it's not going to change any time soon.

Telling people where you get title/player keys from is stupid and will only lead to those holes getting closed off.

Re:Cheers!

[KingArthur10]

The local Walmart has a VHS section that usually has new releases on VHS tapes. What's funny is how much cheaper a new release on VHS is over DVD. The studios kept telling us how DVD prices would come down because DVDs are cheaper to manufacture over tapes, but it never happened. The studios just sat on the extra cash and got fat and happy.

Re:Cheers!

[NormalVisual]

It's also interesting in that the porn industry sees by far the most copyright infringement, but seems to care about it a lot less than the **AA does. Even with all that copying going on, they still somehow are able to make quite a bit of money without whining about it and suing people left and right.

Re:Cheers!

[djh101010]

If there is something to be learned from this it is that technological superiority doesn't count for much in setting global de-facto standards.

One could say that the OS wars have confirmed this. Remember, the common cold is very popular too, that doesn't mean it's good...

Daredevil Sux

[aplusjimages]

The movie industry still makes tons of money, they just want to make more or want something to blame when Daredevil doesn't do good. It can't be that the movie sucked, because they already explained to the investors that its going to be a great movie and that paying Ben Afflick millions will only make the movie better.

Bottom line...

[mmell]

no matter how the data are encrypted, Blu-Ray/HD-DVD players and media have to give you both the encryption algorithm and the key.

Let me repeat that - Blu-Ray/HD-DVD players and media have to give you both the encryption algorithm and the key. Now, it's true that asymetric encryption means that I'll never be able to modify and reencrypt the data without changing the encryption key and thus producing a readily identified copy, but that's not the goal, is it? Given the algorithm and decryption key I can decrypt the content preset. That's the whole point of the system. Attempting to lock the decryption algorithm and key away from the rest of the computer system is impractical at best, more likely impossible. At the end of the day Blu-Ray and HD-DVD end up reliant upon the obsecurity model (rather like CSS); with thousands of eyes watching, obsecurity doesn't work for long (rather like CSS).

Re:Cheers!

[ajs318]

Betamax VCRs never really became "shiny pieces of garbage" in the way Blu-Ray / HDDVD machines will. The crucial thing is, video cassettes were always recordable. You can still watch all your old recordings of Charles and Di's wedding, Fawlty Towers, It's A Wonderful Life and the entire Carry On series, and even record new programmes (VHS tape is the correct width, 12.7, to be wound into worn-out Beta cassettes; but note that you do need to keep the original metallic leader tape, since Beta and VHS used different auto-stop mechanisms and clear plastic leader won't trigger it). As I've hinted elsewhere, Betamax has better resolution and better colour reproduction.

The problem with play-only formats is exactly that: they are play-only, and so there can come a point where nobody is making any new material to play on them.

Wrong Analogies...

[tinkerghost]

The GPP went on about DUI, Assult, Theft, etc. Changing the analogy to jaywalking and parking meters doesn't fix the problem of poor analogies.
The correct analogy is books. When you purchase a book, you are permitted to read it whereever you would like. On the bus, in your bedroom, in the tub, wherever. When you purchase a DVD, CD, or HD-DVD you are doing exactly the same thing as buying a book. You are purchasing a physical copy of the creative effort of the distributor.
What is the total sum of the equipment to read a book? Light and functioning eyes. Oh wait, you can legally use a braile reader to translate the book to braile - some record the book for later playback so one person can scan for another person to 'read' later.
What do you need to view a DVD movie? A player, a video source, and an audio source - along with eyes & ears. Somehow, needing more than your body to appriciate a distributed work makes all of the rules change. What portion of the right to govern distribution (which is all copyright is supposed to cover), covers the right to limit the use of a legally distributed copy?
If I desire to view a legally purchased DVD on my Linux box instead of a Windows box, how do I effect the profit margin of the distributing company? If I re-rip the movie & place it on my video-iPod so I can watch it on my train commute, how do I effect the bottom line? Since, I have already made my purchase of the movie, format shifting should be viewed as no more than the equivalent of moving a purchased book from room to room. Most of the hacks and work-arounds that have been developed were initially done to enable people to use digital media in the same manner they had always used analog. It is not some conspiracy to deprive companies of revenue, it is the efforts of people directed towards maintaining their way of life in a digital erra.
Has the availability of those hacks and work-arounds created an environment in which people blatently disreguard the right-of-first-sale and fair use rules on which they are based on? The honest answer is yes. However, that does not mean that the solution is ever increasing regulation and restriction. As evidenced by the dismal failure of every effort to limit piracy, it simply doesn't work. Eliminating my rights to fair use doesn't solve the problem, in fact it enlarges it as disillusionment with the system causes more casual disreguard for it. The hypocracy doesn't help. Remember legitimate fair use of a copyright work is not an exemption from the provisions of the Digital Milenium Copyright Act. The DMCA itself re-affirms the rights of fair use, but simultaniously denies you the rights to the means to exercise those rights. A shear genius work of doublespeak.

Re:Cheers!

[ajs318]

Exactly. You don't even have to be "good enough"; if you can appeal to the lowest common denominator, and you're essentially competing with nothing at all, "almost good enough" is good enough. Joe Moron doesn't see a drop in picture quality, he sees an improvement over having to watch TV programmes when the TV company say so. And since a VCR is both mechanical and electronic, it's extra-prone to failure. With many of the early machines being rented rather than sold, the perception of reliability was important: they were being sold primarily to rental companies {and in quantities justifying rebranding!}, not consumers. The situation is more or less the same with Windows: it succeeded because it represented an improvement over having no computer at all {some would say even that's debatable}. Well, and because computer vendors were blackmailed into selling it.

Correct...

[Dion]

... what needs to be done in stead is:
1) Find the player key in stead, it's much more interesting and can be used to find all title keys released until now.
2) Find a way to decrypt title keys without compromising the identity of the player key, so we can keep playing HDDVD movies.

#1 is much harder than just snarfing the title key, because the player key might only be in memory while the title key is being decrypted and that takes a very short amount of time.

#2 might be very easy (one server running in law-less^H^H^H^Hfree contry could do it all, the bandwidth needed is very low).

#2b Alternatively we could set up a peer to peer network where some of the hosts know how to decrypt title keys, each host will anonymize all data about where it got the answer from, that way it will be very hard to track down the hosts that have the player keys.

#1 is made harder and more important because it's very, very cheap for the powers that be to revoke player keys, so they might revoke all windows based player keys once a month and force all windows players to download new executables and keys to be able to play new movies.

Re:Cheers!

[Danse]

The studios kept telling us how DVD prices would come down because DVDs are cheaper to manufacture over tapes, but it never happened. The studios just sat on the extra cash and got fat and happy.

Same thing happened with the transition from cassettes to CDs. They lie. That's just the way they are.

Re:Cheers!

[bockelboy]

You say that, but then I - as a member of that other 5% of the population - absolutely crave the ability to watch movies on my screen in high def. I *can* see the difference, and I think it's great.

However, no matter how great I think it is, I'm not dumb enough to buy a HDDVD/BluRay right now. Everytime I watch a DVD on my TV, I curse the consumer electronics industry for not being able to come up with a sane solution to fit my needs.

As much as it is ignored by 95% percent of the population, the HD-DVD/BluRay war is a deep disappointment for the other 5%.

Re:nothing is perfect

[swillden]

Trusted Computing solves this 'problem'. Debuggers won't be allowed to run on 'protected' programs, and this will be enforced on the hardware level (each program will effectively have to ask for permission to run).

Yes and no. You're right about the effect, but wrong about the mechanism.

The TPM can't control what programs can or cannot be run, so it's not correct to say that disallowing debugging of protected programs will be enforced on the hardware level.

The enforcement will be done purely in software, by the operating system. What the TPM will do, though, is to provide a place to securely store the player key, and to bind that key to a specific operating system environment. Boot a different OS, or modify some part of the OS that is considered important for security and the player key will no longer be available.

So, if you use the unmodified OS, it will note that the DVD playing software is not "debuggable" and will not allow your debugger to attach to it. If you try to patch the OS to force it to allow debugging, then the player key won't be available to the player, so you can't grab it with the debugger.

Note that in order for this to work, there must be no exploitable security holes in the OS that allow you to patch the OS after it's been booted into its fully functional state. This is because of the way that the TPM "binds" a key to a given system state.

Basically, during the boot process each chunk of code feeds data to the TPM. The TPM hashes all of this information into a Program Control Register (PCR). This hash value in the PCR is what represents the system state. To bind a key to the PCR, the TPM simply XORs the PCR with its internal master key and uses the result as an encryption key to encrypt the bound key (in this case, the player key). Retrieving a bound key works the same way: The TPM reads the encrypted bound key from disk, XORs the current PCR value with the master key and uses the result to decrypt the bound key.

If you boot into a different OS, or in any other way change the data that is fed to the TPM during boot, then you change the PCR value. Different PCR means different result when XORed with the master key, means different result when the bound key is decrypted.

So, to make such a protection system work, it is necessary that all of the software that is used to enforce the protection be part of the data that is fed to the TPM for hashing into the PCR. BUT, if you can exploit some hole to patch the software *after* the PCR has been fully initialized, then you're golden.

Another way that attackers can try to work around the TPM is by snatching the key before it's bound to the TPM, or by arranging for it to be bound to an already patched OS. Most likely, software player manufacturers will try to work around this by asking the TPM to "attest" to its configuration (meaning its PCR value) before giving out a key.

It's not clear how well that will work, though, because it means that every booted Vista system has to have bit-for-bit identical software so the player mfg can know what the "valid" PCR value is (well, large groups of Vista systems have to be identical, giving the mfg a set of valid PCR values). That doesn't seem like a problem until you realize that part of the data that has to be hashed into the TPM to make the system secure is the BIOS/EFI code. Because if an attacker compromises the code at that level, any protections the operating system tries to implement are irrelevant.

It may be possible to use a string of attestations, one for the PCR value from each stage in the boot process to work around *that* problem, but it's not clear how feasible that is.

Bottom line: The TPM will be used to strengthen DRM systems, but it seems pretty likely that it will be defeatable (and defeated) in many ways. This is because TCPA wasn't designed as a copy protection system, or to prove to third parties that the machine won't violate DRM. Rather, it was designed as

Re:Why this may be good...for the planet

[I'm Don Giovanni]

You don't need to crack DRM to do what you've mentioned. The Analog hole still exists (no HD-DVD or BR discs use the analog flag yet), so you could always make smaller copies for an iPod (God, you're a geek; what normal person would care about watching an HD-DVD on an iPod when the DVD (or even the VHS) would do just as well).

Re:Cheers!

[14CharUsername]

Yeah but you can get a player that can play both BluRay and DVDs. So all your DVDs still work and you can start buying new releases on bluray (or HDDVD, but its seems to me like bluray has won). So it may not offer as big a improvement as DVD but it will also be a much easier transition. More like an upgrade than a replacement.

Of course the lack of HDTVs will be a problem. But as people start buying HDTVs they will pick up a bluray player along with it.

Re:Cheers!

[cayenne8]

"That's what I said. I only know one person with a HDTV. Everyone else sees a 32" CRT for $76 compared to a 20" HD LCD at $290, and they grab two 32" TVs."

Not me baby....you ever try to carry TWO 32" CRT's??

:-)

Hehehe..seriously....I am completely over CRT's....no matter the cost....just too bulky and heavy. This is especially true for computer monitors...but, also true for television.

My preference? DLP Projectors....that that expensive...with a screen, less than many large LCD or Plasma tv's...are HD resolution compatible...and take up very little room, and are easily transportable. Hell...I can grab my projector...take to a friends house and hook to their dvd player, and have 'portable' movie night just about anywhere.

For a bit over a grand...100" picture and great resolution, and taking up very little room.....I don't think they can be beat.

Re:Cheers!

[dave562]

The situation is more or less the same with Windows: it succeeded because it represented an improvement over having no computer at all {some would say even that's debatable}.

Maybe I'm just bitter today, but I have to point out that you're a FREAKING TROLLING MORON. Buddy, there were a bunch of alternative operating systems before Windows was ever on the market. If you didn't like DOS, you could stick with your C64 or your Amiga or your Mac. If you didn't like Windows 3.1 you could have run OS/2 or *nix with X-windows. There have always been alternatives. I know it's popular to shit on Microsoft and whine about "not having a choice" but come on, step into reality. There were alternatives and those alternatives fell by the wayside... and not because "stupid Joe Average users" got conned into using Windows, but because DEVELOPERS and HARDWARE COMPANIES got on the Microsoft bandwagon.

Re:Cracked or no, still formats in search of a mar

[Prof.Phreak]

I don't see what would be so bad about them building something -standard- and easy to use? Like just store a high resolution mpeg4 file titled movie-name.avi, or something, on the high capacity disk. no encryption, nothing. Anyone can open it in Linux/Mac/Windows, etc., pretty easy to build player, integrate the thing into anything, etc. Also pretty easy for -users- to make their own disks (home videos). No need to expensive proprietary software (powerdvd?), etc.

Anyone who -will- copy DVDs will still copy DVDs anyways (and by the time they're downloadable, encryption doesn't even come into the picture). And it only takes 1 person to rip the DVD! Why not make it easy to use for everyone, and have the market create all sorts of extentions that go along with having a huge amount of storage, and easily movable video content.

Re:Revoke the keys

[ajs318]

But if the "banned" key happens to be associated with a popular consumer-grade player, then the manufacturers will have to replace or upgrade every single one of those players in the field (except, maybe, the actual one that was used to obtain the key -- at the very least, it might be considered a warranty-voiding modification). They can't associate keys with individual players; there would be more keys than movie on the disc! (And it would be easy to find a key). People will take their players back to the store if they don't work, which is something that they have every right to do under consumer protection laws, and they will kick up a stink. And it will end up making the 2006 Sony Rootkit fiasco seem like a methodist sunday school picnic.

Yeah, sure, whatever

[heroine]

Just want to get this comment here so you can refer to it in 20 years. AACS will never be cracked. There are too many keys. There will be no software players you can reverse engineer like there were for DVD's. There is no interest in playing movies on PC's like there was for DVD's. It would take over 50 years to reverse engineer just one of the millions of keys by brute force.

Of course, in 20 years you won't even care about who cracked what encryption anymore. It'll just be there like death, taxes, and America.

Re:Yeah, sure, whatever

[Cafe Alpha]

In that case people will crack the displays, capture the raw pixels and reencode.

You can't stop piracy, period.

Protection

[ogcc]

I have red all the above, as i undestand we have some data, whitch was red from disk itself, and some data (key) from player (Powerdvd). Then we tamper with whese two aruond and we get a real key with whitch we decode the movie. Am I right?
If yes,then the question is Why it is (or not) so hard to get that player key. Just fire up the debugger, trace until it reads key from disk (easy), now just look for code whitch does something with that. Somewhere around you will find the key. For example such cracking gruops as RELOADED cracked STARFORCE. it wasnt easy, but the main poblem was to get the executable running. They could extract all those keys from exe and from cds very easy. Why is it hard to do that with powerDVD? it's just simple player. No antidebugging trics, no rootkits, no cd drivers. Nothing.
And, as I understand AES you can decrypt content with only one key, so how can every piece of sofware have different keys?

Re:Cheers!

[NormalVisual]

Or put another way, the porn industry has a business model that is more resilent to outside influences beyond their control without having to buy off politicians. Yeah, you don't players in the porn scene that are multi-millionaires to the degree of someone like Tom Cruise, but in general they seem to do well when compared with the average American.

Re:Cheers!

[ajs318]

The C64, Amiga, Atari ST and so forth were perceived as home games machines, hardly up to the job of running a business. They just weren't "industrial" enough. Business adoption was what brought down the price of the IBM-compatible PC. If some big enough corporation had decided to standardise on, say, Amigas, then history might have run differently. As it was, every non-IBM system found a niche. The BBC and later Acorn RISC machines, with their ROM OS, built-in structured BASIC and accessible hardware, found their way into education and science laboratories; the Mac was used for desktop publishing; the Atari ST, with its built-in MIDI interface, was used in recording studios and the Amiga with its graphics capabilities (you could synchronise its video timing to an external source) was used for video post-production. Mainstream businesses went with IBM-compatible PCs (the Amstrad PCW8256 and co. served many users very well for a long time, but were eventually replaced with PCs) running DOS or Windows.

The rest is history. Millions of expensive typewriters, calculators and desk ornaments were sold on the basis that everybody else was buying them so we need some too. PCs eventually reached a critical mass, bringing down prices. Lower prices meant less initial investment to become a hardware developer, hence more hardware development (don't forget, the early machines' 8- and 16-bit buses were very easy to interface to); and as even more hardware became available, PCs managed to equal and eventually surpass the competition. Software developers also were attracted by less expensive machines (leading, unfortunately, to a huge glut of poor-to-mediocre software [cf. the situation with 8-bit home computers c.1983-4]; however, Microsoft's tolerance of piracy meant that MS software was effectively free-as-in-beer, so eventually bankrupting publishers of software which competed directly with MS). General-purpose I/O cards, Windows, MIDI interfaces, genlock-capable video cards and the inexorable March of Time all eventually helped PCs displace the older machines.

Re:nothing is perfect

[ILuvRamen]

Well then I guess I'll have to use another fancy and accidentally DRM breaking technology called optical out to hook up to my top quality optical input video capture card (that I don't actually have but wish I did lol) If you get both the sound and video in digital format being sent through optical cable and being re-received in through a really good quality card, you barely lose anything cuz if I understand optical correctly, it sends totally uncompressed video that's basically pixel 1x1 is color 34A6D3, etc so all you have to worry about is capturing it fast enough and encoding it well after it's captured in an uncompressed format. Yaaaaay digital! Seriously, how could the DRM people not realize that sending any signal digitally out of a player means it's uncompressed. They better not start encrypting it and having the TV decrypt it.

Re:nothing is perfect

[Sancho]

Except that there's a flag on the disc which tells the player to degrade the signal if it isn't going through a protected path (HDCP). Right now, the flags aren't set, but they eventually will be.

Re:When will they learn

[ajs318]

As long as 5% of the people are able to crack the copy-protection, the other 95% need only copy what the original 5% have de-protected.

Re:Cheers!

[justthinkit]

Pirates came on DVD and HD-DVD from our local pr0n shop, and this was about a year ago.

Re:Cheers!

[dave562]

That's an interesting history that you laid out but I'm not quite sure what your point is. All of those business that you refer to in your statement... "Mainstream businesses went with IBM-compatible PCs..." had options. Before the desktop PC boom the world was running on mainframes. Those mainframes ran a variety of OSs from Unix, to VAX to what have you, but they sure as hell weren't running DOS.

The point that I'm trying to make in addition to countering your assertion that Windows succeeded because it "was an improvement over having no computer at all.", is the point that there were a lot of reasons why Windows succeeded. Yet what I quite frequently read around here is all of this drivel about the evil, monopolistic Microsoft forcing their OS on the world. Before Microsoft was the company that we all love to hate, they were just another fish in the sea. And when they were just another fish, a lot of people decided that they liked that fish. They made an OS that ran on the most mass produced hardware out there at a time when nobody else could do it.

Re:Cheers!

[Leynos]

Heheh. Someone else remembers that. My grandparents, inexplicably, had a V2000, a Betamax and a VHS VCR. And probably way too much money.

Re:nothing is perfect

[swillden]

Apple thought that they were safe by including a TPM in their new Macs to prevent them from being run on generic PC's, but that scheme has been blown apart with every software update Apple has issued (aka service pack).

Agreed. Really *securing* a system with a TPM is non-trivial, and it's damned near impossible if the system configuration has to change on a regular basis. Honestly, TPMs are really not very useful to home users. They're valuable for servers and for enterprise workstations that are configured and mostly left alone, and really require high security.

If you want evidence of just how hard it is to create a secure system build on a TPM, consider this: Linux TPM drivers were available as soon as the chips started to hit the market, long before any other platform started playing with them. Further, there's a corner of the Linux world that is *intensely* interested in security, consider SELinux, GRSecurity, etc. Even further, the Linux world has a very rich tradition of a zillion specialized distributions, each highly tuned for a very small, specific niche. The boot managers we use are open source (and there actually is a TPM-enabled version of GRUB), and nothing in the software stack is hidden from the modifications needed to build a TPM-based solution.

So where are the super-secure TPM distros? There ought to be a firewall distro that hashes *everything* into the TPM and periodically sends attestations to the system administrator, so that even the tiniest compromise will be detected instantly. There ought to be a Host Security Module distro that uses a TPM-enabled PC to provide a poor-man's HSM. There ought to be web server distros that use the TPM to secure their SSL keys.

If it weren't fiendishly difficult, all those distros would exist, but *NONE* of them do. Not a one. Well, not that I've been able to find -- I'd actually love to be proved wrong here... anyone?

This isn't to say that a TPM isn't useful, just that security is much, much harder than people want to believe. I'm sure we will eventually get those Linux distros. I'm far less certain that Microsoft or Apple will ever be able to really make use of them the way they want to.

Re:Cheers!

[tim_mathews]

It's simple really. The porn industry makes movies people actually want to watch.

Seconded.

[SanityInAnarchy]

I won't be quite as extreme, as there are a few places I believe the baggage of this kind of a scheme is necessary. For instance, we don't have a common game engine, therefore each game must ship with software, so any commercial game is automatically somewhat locked down and proprietary, and you can't do everything you want to with it.

Further, I'm perfectly alright with buying things with completely, pathetically defeated DRM. DVDs encrypted with CSS are fine -- I just rend them and rip them, or buy them and rip them.

However, I'm avoiding Windows Vista as long as I can, depending on how much usefulness I can get out of Linux. I'm also not going to buy or rent a single Blu-Ray or HD-DVD movie, so long as it's impossible for me to pop it into a Linux box and play it with mplayer. If I buy music, it'll be in the form of CDs or FLAC files.

Basically, what I'm hoping for is to create an example that others can follow, without boycotting being a monumental PITA. Then, when they come around with surveys, asking why we don't all have Blu-Ray, we can tell them we don't like them bricking our players because we might be able to use them to pirate.

Re:nothing is perfect

[Alsee]

You address some genuine issues, but the Trusted Computing specification addresses and resolves some of the "problems" you cite.

All of your comments about finding and exploting software bugs / software holes to crack the system were valid, and their solution here is to *force* down software patches. If Trusted Computing is adopted as they hope and intend, in a decade or less you may find it impossible to get onto the internet at all unless you allow the software patches to be pushed down onto your machine to close the holes.

it means that every booted Vista system has to have bit-for-bit identical software so the player mfg can know what the "valid" PCR value is

No, as I'll discuss below. The PCR value is used for authentication of other data. Seeing essentially random new and varied PCR values is not a problem.

It may be possible to use a string of attestations, one for the PCR value from each stage in the boot process to work around *that* problem, but it's not clear how feasible that is.

That is approximately the idea, and it is feasible. The first thing the Trusted Software Stack is required to do is keep a log of each value that gets hashed into the PCR, and any identifing information associated with it.

So for example the first value that gets hashed in is the BIOS hash. The system keeps a log of that value, and logs that it is the BIOS value, and presumably the name and certification signature from the BIOS provider proving it is a genuine unmodified BIOS from that Trusted-certified BIOS provider. Then you add in the boot-loader software hash, and the name of the bootloader company and the signature authenticating that. Then you add the hash of the operating system and the name and signature of that operating system provider. Then you add in and log the various operating system hardware drivers, and you rely on the operating system to log which drivers are and are not security critical for various purposes. And then the you can optionally even log every single application that gets run, with the operating system logging which ones are and are not relevant for various purposes.

So if for example you are the RIAA with soem music DRm software, you first take that log file and verify that it does indeed match the current PCR value. New and effectively random PRC values are fine.... they merely proove that the logged software list is genuine. Then you look at the first few items in the log, the BIOS and bootloader and operating system, and you simply check that the listed company is on your "Trusted Computing" approved list, and then check that the signature is genuine. The next thing on the list are the various drivers. If some software we (the RIAA) don't care about... for example a video driver or maybe Trusted DVD player software... if that gets added... it will have an effectively random hash and adding it to the PCR will create an effectively vandom value... but we don't care and we don't even need to verify it. We are Trusting the Trusted operating system to prevent DVD player software from affecting our music DRM system. So it doesn't matter if irrelevant random values get mixed into the PCR and randomize it... we can see by the log that we don't care about that line-item and we can keep tracing the log forward to the items we do care about. The last item on the list might be the last run application.... the application we are currently talking to over the internet... would be our (the RIAA's) own DRM-enforcing music software. The log file and the current PCR prove that we are talking to the exact software we want to be talking to. We (the RIAA) can then bind the music decryption key to that exact software.

If you boot into a different OS, or in any other way change the data that is fed to the TPM during boot, then you change the PCR value. Different PCR means different result when XORed with the master key, means different result when the bound key is decrypted.

There is a complex system that, when Trusted-appropriate, allows

Re:nothing is perfect

[Alsee]

Trusted Computing solves this 'problem'. Debuggers won't be allowed to run on 'protected' programs, and this will be enforced on the hardware level

No it doesn't. The entire Trusted Computing security model vanishes in a puff of smoke the moment someone (metaphorically) sneezes at his motherboard. The software front-door is a militarized bank vault, but there are a dozen wide open hardware back-doors.

That instantly gets us exactly back where we are right now with the current story. You have the exact same person adding a switch to his motherbord or somesuch, undetectably and untracably sitting at home capturing disk keys from memory exactly as in the current story, and managing to leak those keys exactly as in the current story.

-

Re:nothing is perfect

[swillden]

Hi, Alsee.

How large is that log file going to be? Seems like for most pieces of software, it is going to have to contain a full copy of the hashed code. For well-known software, of course, it can be optimized to just a list of identifiers. Mostly.

An even bigger problem is that the scenario you describe (hashing every app) *only* works for DRM while on-line. It would theoretically allow the TPM to attest its current state, but it would be useless to bind any decryption keys to that state.

As for what would make a TPM more suitable for DRM enforcement, there are many things that could be done.

The best is to make the TPM into a low-end HSM. This would add only pennies to the cost of the chip -- a little more internal RAM and a hardware AES co-processor. It would also be necessary to ensure that the TPM was on a USB2 or PCI bus. Couple that with "secure" output hardware (HDMI and something similar for audio) and you can easily arrange it so that the main CPU *never* sees an unencrypted media stream. Connect to iTunes, or whatever, present your TPM's public key (which is signed to prove that it's a TPM key), the music vendor encrypts an AES key with the TPM's public key and sends it back, the TPM stores it and gives the OS a key identifier. Then, you download music, encrypted with that AES key. When you want to play it, the OS hands the data and the key ID to the TPM, which decrypts the data and re-encrypts it with the key for the secure output device. The OS takes the re-encrypted stream and hands it to the output device for rendering into analog format.

That would be a DRM chip. It wouldn't matter a bit what OS you were running, because the main CPU would never see unencrypted data. And it would be vastly simpler to implement and manage than the hoops you have to jump through to try to use a TPM for DRM enforcement.

There are other options and approaches as well, that would allow the TPM tighter control over all running software, rather than just decrypting media streams. For one, put it on the system bus and give it access to system RAM (would require memory controller cooperation). Then provide a mechanism where it can enforce which applications are or are not allowed to run based on its analysis (with the assistance of the OS), and what those applications are or are not allowed to do.

Regarding the implications of the lack of hardware security in TPMs, I would argue that the lack is strong evidence that they are designed to be for exactly what they say they are: to protect against attacks by people who don't have direct, unlimited and unobserved access to the hardware. Were I designing a DRM enforcement system, I absolutely would build in some hardware anti-tamper protections. For a device intended to be used in a secure server room, or on a workstation which the user has an interest in securing, there's no need for that.

Re:Cheers!

[cnettel]

Because as-of-yet relatively uncommon hardware isn't "allowed" to even play the material (in full quality).

Re:Cheers!

[AaronLawrence]

I agree about front projectors for home theatre, they are now high quality and cost effective, but there is one significant weakness: most of them cannot cope with a daylit room. You need to close all the curtains to get decent contrast. I've been wanting to watch more movies during the day (holidays) and I have started to find this annoying.

Thus I need a 42" plasma/LCD as well :)

Re:Cheers!

[HTH NE1]

And the Sony C6 Betamax recorder, given a decent aerial, could record the Teletext signal along with the picture (even if your set was non-Teletext, since it's being picked up by the recorder's internal receiver). I never even realised VCRs weren't supposed to be able to do that. All those old Betamax cassettes in lofts and cupboards are hiding not only subtitles, but little vignettes of the news and sporting events of the day they were recorded.

Over here even VHS VCRs can record closed captioning information, including all modes. I'm sure I have a lot of closed caption news for the deaf recorded on my tapes of UK sci-fi aired on local PBS channels. TiVos also record this information, except they decode it when recorded and regenerate it in the VBI on playback (saves disk space).

Now if only they could record the SAP signal at the same time as the regular audio.

Poisoned Wells and Multiple Masters

[HTH NE1]

If they can't track down what player key was disclosed, they'll flood the underground market with bogus title keys while also making multiple yet visually indistinguishable parallel runs of the same release with different title keys to frustrate the market of title key sharing (multiple pressers manufacturing differently keyed masters of the same title). The more valuable the content, the more masters they'll make with different title keys. If the movie is crap, they only make one master.

That's one way to frustrate the piracy market. And they don't even have to wait for a player key to be broken to implement it.