HD-DVD and Blu-Ray Protections Fully Broken

gEvil (beta) writes "According to an article at BoingBoing, the processing keys for the AACS encryption scheme used by both HD-DVD and Blu-Ray video discs have been extracted, and a crack has been released. What this means is that there is now a method to extract the copy-protected content of any HD-DVD or Blu-Ray disc out there. This is different from Muslix64's previous crack, which only extracted the volume key for each disc. This new method bypasses this step and allows anyone to extract the data without first requiring the volume key."

Comments

Can this be fixed?

[CastrTroy]

Can this be fixed by revoking a player key? Or is this a more extensive breach like what happened with DECSS? Will this work on all future discs, or does it just work on the discs that are currently being produced?

industry's response?

[bcrowell]

So what is the industry's response to all this? Can they deal with the problem without breaking every DVD player in existence? Is the encryption completely symmetric? Can they start releasing DVDs with new keys, without creating a situation where some DVD players can read old dics, and others can read new ones? Are different keys used in Europe, U.S., etc.?

Re:I disagree

[p0tat03]

The same method used to acquire this key can be used to acquire future keys. All it takes is one determined hacker willing to rifle through his memory addresses for the key.

I do not see a terribly effective fix for this - your key has to exist somewhere, and even in a CPU register it is still in memory more often than not.

Here we go again...

[Synesthesiatic]

Just like when the iTunes DRM was cracked, I might actually consider buying in these formats now.

And because of that, when I put my iPod shuffle through the wash I was able to replace it with a good AAC-playing MP3 phone and flip the bird to Steve Jobs. Same thing with these...I want my media in formats I can move around and use to my liking.

I'm not going to pay for the same content twice, ever. And if I can't get my content in a cracked DRM or DRM-free format, I'll just pirate it. That'll show 'em.

Re:Now we get to see...

[awkScooby]

They won't do it. Their bluff has been called.

Revoking keys would have a huge negative impact on the adoption of HD-DVD and Blue-Ray. Look at the backlash from the Sony rootkit -- that was something a lot of consumers were/are unaware of. It's harder to be unaware of the fact that your $900 dvd player no longer works, or your $2000 HDTV doesn't work. The inevitable lawsuits aren't worth it.

arms race

[micromuncher]

Once upon a time I worked at a company encrypting CDs for digital data. This was over ten years ago... We too had a staged security, weak protection on key store, stronger protection on packages and data. We knew that the cost involved in high security was too high, from a functional and complexity cost POV.

First, making the volume information secure, and file content, was pretty pointless because if you had strong security on it, it would be too slow to do anything useful. For the data, you could wait longer, but at the end of the day, all of it was moot because once either catalog or data is decrypted... its there. So, you decrypt on the fly, or use adaptive methods that attempt to hide information, it all leads to...

The Cost of protection geometrically increases to the linear Time to break it.

And in the end, all the protection does is buy you a little bit of time, because for every couple of guys thinking up the next best protection scheme, once it hits the world, you have 100+* the resources trying to break it.

In the end, the best protection we came up with was something everyone hates... a hardware key that imlpemented the decryption, and sell that key with the media. Economically not viable to copy, but still does nothing once unprotected.

Re:Not Really Broken

[TheRaven64]

Without double-checking, I believe the keys are only 128 bits, they could be loaded into the SSE registers in encrypted form and then decrypted on chip

Good thing Intel put in those nice debugging registers that let you dump the contents of SSE registers at arbitrary intervals (e.g. after every SSE operation by the debugged process).

Re:Now we get to see...

[AnyoneEB]

They would only be revoking keys used by software players. Eventually someone will probably go through the effort to get keys out of a hardware player, but it is a lot more work to do so.

The end of software players?

[guidryp]

"I do not see a terribly effective fix for this - your key has to exist somewhere, and even in a CPU register it is still in memory more often than not."

Ummm, how about no more new keys for software players. As long as there are software players it seems obvious that it will be possible to reverse engineer what they are doing to shake out the keys. But if the industry decides that SW players are too weak, they simply revoke keys for them and don't issue new ones. The end of software players and the end of the risk.

Re:props to Muslix64 and hackers everywhere

[slim]

However, as the key has now been compromised, future disks will not accept that player key. Sure they can remove the compromised player key from the acceptable list. But it remains to see whether they'll actually do it. Presumably there's a decent number of blameless consumers already using that player. What's the commercial impact of pissing them off?

Re:All DRM implementations will be broken.

[radtea]

Of course the devil is in the details. It's fully possible to build an insecure system around a secure TPM chip, and no doubt that's going to be done, too.

Unless you change the laws of physics it is completely impossible to build a secure TPM chip. TPM is an inconvenience, nothing more, just like DRM. DRM, no matter how implemented, involves supplying the same person with:

a) the ciphertext
b) the plaintext
c) the decryption key

All of those things must be present on the user's system for DRM to work. TPM etc are merely means to try to make it hard for the user to access the key, and they never work. One way of thinking about it is: a TPM chip "hides" certain details inside a little bit of plastic. It is security through obscurity and nothing more, and so long as the chip emits any EM radiation the internal details will ultimately be inferable, although it is doubtful that going so far as reading internal bits via EM fields will be required.

But if it is, we can all take comfort in the fact that Maxwell's equations aren't just a good idea: they're the law.