New AACS Fix Hacked in a Day

VincenzoRomano writes "ArsTechnica has just published an update to the neverending story about copy protection used in HD DVD and Blu-ray discs and hacker efforts against it. From the article: 'The ongoing war between content producers and hackers over the AACS copy protection used in HD DVD and Blu-ray discs produced yet another skirmish last week, and as has been the case as of late, the hackers came out on top. The hacker BtCB posted the new decryption key for AACS on the Freedom to Tinker web site, just one day after the AACS Licensing Authority (AACS LA) issued the key.' The article proposes a simple description of the protection schema and a brief look back at how the cracks have slowly chipped away at its effectiveness. It seems it'll be a long way to an effective solution ... if any. One could also argue whether all that money spent by the industry in this race will be worth the results and how long it would take for a return on investment."

Comments

If it's viewable, it's hackable

[elrous0]

Blu-ray discs with a further layer of copy protection called BD+ are rumored to be nearing delivery

You know, they say the definition of insanity is doing the same thing over and over again, expecting different results. Somewhere I picture entertainment execs, having been sold a big and expensive line of B.S. by the firm that developed BD+ (just as they had been sold the exact same line by the companies that developed CSS and AACS), sitting in some board room saying "Don't worry, THIS time it's going to work!" They just don't get it. If it's viewable, it's hackable--period.

Re:If it's viewable, it's hackable

[erroneus]

You're not looking far enough down the road to where this all leads. Hell, you're not even looking back on the road we've all be travelling where all of this is concerned. They know there is no knot that cannot be untied. What they are winning is the sympathy of lawmakers who are increasingly adding to the penaties of copyright infringement, writing new laws around the globe and generally extending copyright indefinitely. It's the quicksand they have us trapped in that they are after. The more people resist, the more legislative backing they receive. How long before whistling a tune as you walk down the street will get you arrested?

Music [and the arts] may have charms that will soothe the savage beasts in all of us, but these people want you to pay for the remedy and will do anything to make sure you do!

Re:If it's viewable, it's hackable

[FauxPasIII]

> You know, they say the definition of insanity is doing the
> same thing over and over again, expecting different results.

And Bartcop's second law says that if someone makes a "mistake" that makes them a whole heap of money, then they will make the same "mistake" again and again and again. They keep making new protection scheme revisions, the content providers keep buying in and hardware manufacturers keep upgrading.

These protection schemes aren't a failure as you seem to think. They're accomplishing exactly what they're intended for.

Re:If it's viewable, it's hackable

[AlHunt]

Honestly, consumers just need to start voting with their dollars - don't buy copy-protected DVDs, don't buy CDs until RIAA knocks off intimidating people, don't patronize lawsuit-happy companies.

The bottom line is that Joe Average just doesn't mind being pushed around as long as he's comfortable. Very discouraging for the future of free will, independent thinking, privacy, security, liberty and other non-socialist, non-communist ideals in the USA.

Re:If it's viewable, it's hackable

[alienw]

Actually, there hasn't been an actual hack yet. These "hacks" are what the key revocation procedure is intended for. It isn't like DeCSS, where knowing the algorithm was enough to bruteforce thousands of keys. If the AACS LA wanted to, they could stop giving out new keys to software-only players and stop this type of hacking in its tracks.

Re:If it's viewable, it's hackable

[c00rdb]

Except the less you buy, the more the industry claims that those losses are due to piracy. It's a never ending cycle.

Re:If it's viewable, it's hackable

[Kadin2048]

Well, you're right that the key-revocation scheme was designed to deal with this, however where the problem lies is in certain assumptions that the people designing the revocation system made.

I don't think they ever thought that the keys would get compromised this quickly. The AACSLA is fighting an asymmetric war. It takes them, what, about six months to revoke a key? Maybe they could get that down to a few months, but it's still going to be difficult. They have to realize that a key is compromised, decide to revoke it, make up a new MKB, master a new disc, send that disc master to Taiwan or China for pressing, and import and distribute the new disc. There's only a certain amount that a process like that can be expedited by.

The revocation scheme was designed to deal with insecure players, basically as a one-off process. Player gets compromised? Revoke it. It's not getting them any security in its current state. Right now, they revoke existing key. New key is compromised after one day in circulation. They begin revoking it. Six months later, they revoke new key. Rinse. Repeat. What's the steady state of this system? The hackers win, because at any given time, they probably have the keys to all the extant discs.

Now, you do bring up an interesting point about blocking software players, and just eliminating them altogether. Setting aside the problems this would cause with the likes of Microsoft and other players heavily invested in the concept of HTPCs, it might slow things down. However, I don't think there's any reason to think that they keys can't be extracted from the hardware -- that's just too good of a technical challenge to pass up. And again, if the rate at which keys get compromised is much, much faster than the rate at which compromised keys can be revoked, then the AACS loses control.

Re:If it's viewable, it's hackable

[mgblst]

Honestly, consumers just need to start voting with their dollars - don't buy copy-protected DVDs, don't buy CDs until RIAA knocks off intimidating people, don't patronize lawsuit-happy companies.
 
Which well never happen. It makes people feel very uncomfortable to have to think about the ethical choices they make before they buy (this counts for things like clothing and coffee as well). They would rather not hurt their brains that much. Those are the ones that even cared enough to find out that buying some products are bad, which the majority won't, unless some celebrity happens to take a stance. Have you noticed the shift to more and more brain-dead celebrities these days?

Re:If it's viewable, it's hackable

[veganboyjosh]

If current trends continue, media sales will continue to drop (be it from piracy, or disinterest, or whatever legitimate reason/s), they'll totally crumble and go away. At that point, it won't matter what the real reason is, so long as they go away.

Re:If it's viewable, it's hackable

[jZnat]

Why should we have to completely ignore our culture just because of some assholes at the top? The Libertarian solution to every problem doesn't always work, and in this case, it won't work. People are ignorant of the issue, and even if they knew about it, they'd rather continue indulging in their culture and entertainment rather than "fight the power". We need to think of a different solution, and continuing to break all the rights-restricting DRM they throw at us is, in my opinion, a good start.

If the law wasn't bought and paid for by them, a boycott might work, but since they are able to extend copyright to cover anything and everything for as long as they want, we cannot just vote with our wallets; they've got much bigger wallets than us.

Re:If it's viewable, it's hackable

[dpilot]

My *next* letter to Sen. Patrick Leahy will have 3 focal points...
1: I like the work he's currently doing on Judiciary with the investigations. This stuff is IMPORTANT!
2: As far as copyright law goes, these days it's not really "all about the artists," as he has told me in letters in the past. If he really believes that, he's being sold a bill of goods by the mafiAA, and I need to dig up substantiation for his.

And the point germane to this thread...
3: Passing ever-more-draconian copyright/DRM legislation is HURTING our media industry. We will NEVER get a regimen this tough forced around the world, no matter how hard we try, and no matter that there are some early exceptions. NONE of this stuff has done spit to stop widespread violation in China and it never will.

Like it or not, the world is changing, and the mafiAA had darned well better learn to cope with it. The current legislative path in the US is coddling them, and allowing them to not cope with a changing world, and at some point they will be completely incapable of playing on the world stage. (figuratively and literally) For an analogy, a favorite on Slashdot is how the movie industry grew up in California, in order to get around the protective laws the stage industry had in New York. If the mafiAA doesn't learn to adapt, world entertainment WILL move elsewhere, it's just a matter of time.

Which is a harder problem - cracking the Chinese copyright violation problem, or teaching Bollywood to make good movies?

Re:If it's viewable, it's hackable

[Ngwenya]

I don't think it would be possible to extract keys from hardware, if said hardware is well-implemented.

Yes - just a small matter of implementation :)

You are correct, of course, that hardware key storage is generally more effective than software storage. The problem, however, is that key storage isn't the end of the story. Sure, you can embed a TPM chip in epoxy resin, and surface mount that chip onto the motherboard - but it can still be removed. Tricky, yes - error prone, also true. But it can be done. Which means that, assuming it's not some totally proprietary design it can be inserted into a standard PC motherboard and exploited from there. If it is a completely proprietary chip, well, the record of such security systems working is less than stellar. Tends to be of the same order as proprietary crypto algorithms. In using AES, the AACS designers made at least one good technical decision.

Even if not removing the key storage device, the buses which connect it to the rest of the system are still subject to probing via ICEs. And all of this assumes that the electrical characteristics of the systems don't exhibit any exploitable variances like key-dependent delays in processing (side-channel attacks).

And even if you had that down pat, you've still got the fact that the connection from device to display is only protected by HDCP, which was cracked years ago. And there's no real protection on digital audio outputs, so capturing that frame-by-frame and remuxing to high quality rips would still be eminently possible. The only reason there aren't HDCP strippers and HD capture devices all over the place is because AACS has been rendered moot. If the keystream still held secure, you'd simply see another attack vector.

Now here's the other problem: in order to get the backing of people like Microsoft and other likely media centre manufacturers, the HD-DVD camp had to promise Managed Copy (Blu-Ray said they would also provide it). In other words, they had to promise that copying to a non-hardware-secured device would be possible. And if you just shift the problem onto the the PC that way, you haven't really bought anything.

All told - your analysis is spot on - h/w only operations are harder to crack. But from a technical and business commitment standpoint, it wouldn't make any real difference. The incentive to crack is far greater than the technical obstacles in place.

I suppose it all comes down to the age old cliché - security is a process, not a product. And with AACS, it seems that the content producers have only semi-digested that point. Without control of the entire delivery chain - something that is both technically and legally impossible you cannot square the circle of both giving someone the key and not giving it to them at the same time.

--Ng

Re:If it's viewable, it's hackable

[spun]

I'm using the term anarchism in the sense that Proudhon and Bakunin used it, so yes, what it meant in the 19th century. Sure, any economic system can be used to oppress people. I think that's a key point, economics can oppress just as surely as politics can. Do they automatically oppress? That's what we're debating here, I think, not whether they can, but whether they must. I'd say capitalism by its very nature creates an oppressed class. Communism will lead to a non-communistic structure that creates an oppressed class. Socialism won't necessarily. That's my take anyway. Although for me, a cooperative structure like that found in the Mondragon Cooperative in Spain sounds even better than socialism as practiced in, say, France.

Re:If it's viewable, it's hackable

[duerra]

Oh get off your high horse. The wealthiest 1 percent of earners in this country pay 37% of tax revenue. How that got modded as Informative is beyond me.

Re:If it's viewable, it's hackable

[Ngwenya]

Who says the chip has to be a standard, off-the-shelf device?

Economics of interoperability. If each device manufacturer goes with their own way for encryption then the devices will cost too much. As for ICEs not working against modern hardware, I think you may be incorrect there. Just as the crypto chips have got faster and harder, so have the ICEs. To take an example: TPM chips for PCs tend to come from one of three manufacturers - Infineon, Atmel and Nat Semi. Of course, HP, Dell, Sony, IBM, Toshiba and so on could all invent their own chips, their own bus controllers, etc, but then the interoperability costs become huge. So to make HD-DVDs/BDs work on all platforms, you'd basically be asking for each major manufacturer to spin custom silicon in each instance. The cost of that would be massive.

As far as attacking the HDMI stream: good luck doing real-time encoding of a raw, uncompressed HDTV stream. Currently, that requires extremely expensive hardware (if it even exists).

It does exist, and it is expensive. But were the demand higher, then those costs would come down. Secondly, it doesn't have to be real-time at all - you can do it frame by frame if you will. Or would you also authenticate and encrypt the control channels (ie, the remote controlling the player)? Pretty soon all of those encrypted channels start to require extra margins in the price of the device. It's not just a matter of signal security - it's a matter of signal security at a cost the market can bear.

The only reason that HD capture devices are so expensive is because it's much cheaper to decrypt the signals at source rather than the decoded ones. You've already demonstrated knowledge of this, but it's worth repeating - you have to protect the signal at all points, and protect it to an economically viable level. Honestly, if Sony thought it could pull the same stunt that it did with MiniDisc except for HD video, then I'm positive they would have done. They (and Toshiba) have got their own fab plants. Since they didn't do it, I don't think it was because they were stupid - it was because they didn't think it worth it.

--Ng

Re:If it's viewable, it's hackable

[bracktra]

For all interested, Ari Fleischer -- ex-bush press secretary -- has made a more detailed whine using this same statistic.

It is also useful to consider other statistics such as how much income the wealthiest one percent actually makes. When it comes to actually living life, 50% of hundreds of thousands of dollars to billions of dollars is much different than 50% of ten to twenty grand. It's the difference between "Am I going to be able to buy a boat upon which to stand around and drink alcoholic beverages?" and "Can I afford a place to live and food to eat?".

Re:If it's viewable, it's hackable

[Mattcelt]

That's what YOUR grandparents said about anyone who listened to rock-and-roll.

45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2

[Anonymous Coward]

Just for the record.

Haiku?

[packetmon]

the site posted the 128-bit key as a method of decrypting a small haiku that they placed on the same page, noting that it just might accidentally (wink, wink) be the same key that will decrypt new high-definition discs as well

I couldn't find that Haiku... Was it:

Broken it is now
Silly little execs
More Free DVD's

Re:Haiku?

[abb3w]

I couldn't find that Haiku

The article is misleading; the hacker posted the comment, not the site or its editors. I quoted the "Own Integers" Haiku ((copyright 2007 by Edward W. Felten)) as part of an Educational Post on the actual encryption. The F2T blog with the original seems to be Slashdotted... again. Imagine that.

I do admire BtCB sense of technical style.

It's painful to watch...

[tygerstripes]

My cat does this with spiders. Once he's got one of the hairy buggers pinned, he just sits there and waits for it to make a dash for "freedom". Then he chews another leg off it, and goes back to waiting.
Whenever I see this happen, I'm torn between horror at the grisly spectacle of such torture, and the guilty pleasure of seeing something I hate being toyed with so cruelly. If I can live with it in my own home, I can live with it in the media market...

The other side of the coin

[TripMaster Monkey]

From the summary:

One could also argue whether all that money spent by the industry in this race will be worth the results and how long it would take for a return on investment."

Indeed...one could argue that a company would better serve its shareholders and its long term interests by eliminating copy protection completely. After all, at this stage of the game, anyone who wants a pirated copy can either make it themselves, or knows some techie guy who can. Eliminating all copy protection would save money otherwise pissed away on ineffective measures that only serve to annoy legitimate users, and would build a measure of good will and consumer loyalty that is worth more than anything deterring piracy could realize.

Re:The other side of the coin

[hal2814]

"...anyone who wants a pirated copy..." (emphasis mine)

Aha, but that's the key. Most people don't necessarily want a pirated copy. They just want a copy. If the copy protection can be difficult enough to get around to not make it worth the average person's time, then they won't bother getting a pirated version. People who make a conscious effort to pirate the material cannot be stopped, but if you can make it difficult enough to pirate nobody else will bother. I think the movie industry massively failed in that regard with DVDs. It became far too easy to pirate them. I also think they'll also fail here, but I do see why they keep trying. If they can just make it hard enough, most people won't bother.

Re:Bad system

[minginqunt]

But, you know, most of these hackers aren't even doing this because they desperately want to watch Pirates of the Opening Weekend IV: At Wits End, since most people have better things to do than watch Kiera Knightley and Orloomdo Bland do their best dining furniture impression.

No, these guys break AACS simply because it's _there_, and the movie industry *dared* them to do it.

And you know what? By making it more complicated than DeCSS, they made BD+ and AACS simply become *even more fun* to hack.

These guys should befriend some supply-side economists to learn about incentives and how they work.

DRM == FRAUD

[Concern]

When will the legal system in this country catch on to the fact that DRM is a garden variety fraud, perpetrated by shady "engineers" on gullible content producers?

There has never been a working DRM system in the history of mankind. There will very likely never be a working DRM system. And I only say "very likely" because the rest of history is a very long time - but it is impossible to imagine how any such system can be built in the future, regardless of technological progress.

The roster of DRM vendors is a list of failed charlatans, with a track record of consumer ire, ruined reputations (the vendors' own, and their customers), legal liability (remember Sony?), and of course, enormous costs for their customers - their true victims.

I wonder if the spectacle of AACS' failure will finally begin to wake them to the fact that no one can sell DRM, because it doesn't exist - and the people who claim it does are no better than those selling magic weight loss via email spam.

Neverending story, eh?

[Spy der Mann]

This reminds me of a famous song... let's see what we can do with it.

*ahem* *ahem*

Turn around
Look at what you see
In their face
The keyword of your dreams
Make believe they're everywhere
Just encrypted in the lines
Written on the DVD's
Is the answer to our never ending story
ah ah ah

See the cracks
In their fantasy
crush their dream
show them what they'll be
Codes that keep their secrets
Will unfold behind a yarr
zero nine eff nine one one...
Is the answer to our never ending story
ah ah ah

Show no fear
For they may fade away
In your hands
The birth of a new age
Codes that keep their secrets
Will unfold behind a yarr
zero nine eff nine one one...
Is the answer to our never ending story...
ah ah ah
Never ending story...
ah ah ah
Never ending story.

Maybe I'm in the minority, but...

[SkyMunky]

I would have already bought an HD-DVD player had there not been DRM in place. If I knew I could make copies for myself, rip to a portable or my laptop easily, etc., I would already own an HD-DVD player an several movies for it. I guess the Industry doesn't take my demographic into account as it must be a minority, but surely there has to be some up-side to playing nice with consumers and letting us make copies/rips of their movies. I used to buy music, too, when I knew I could copy/mix/etc.
  Would they lose a sale here and there because somebody copies a movie for a friend/family/neighbor? Yes, of course. Are they going to anyway? Yes. But...are they losing sales because of DRM in place? I think lots.

Simple solution

[gr8_phk]

If the MPAA want to protect their stuff they shouldn't license the decryption algorithms to PC implementations. You'd think they would have learned that with DVD. Don't put secret algorithms on widely available hardware with lots of debuggers and hacking tools. Duh.
This would slow down the crackers a LOT - but not entirely.

It's still doing it's primary job

[Dachannien]

AACS does stop casual copying, but it hasn't prevented unencrypted HD content from being distributed over the Internet.

That's really what the content cabal are most interested in. Piracy of their content is a foregone conclusion. It's been happening for decades, and in some countries, almost the entire market for their content is based on counterfeit copies. They've long since priced their "losses" into the cost of their product.

What AACS (and CSS before it) is really about is enforcing the other forms of DRM they've implemented, like user-operation prohibition (preventing you from skipping the pointless FBI notice, company credits, and best/worst of all, advertising) and region coding. Note that neither of those DRM schemes have anything to do with piracy prevention - they're just another route for indirectly extracting revenue from the consumer, by force-feeding advertising or by exploiting the arbitrage created when they don't release their content simultaneously around the world.

Heard from an RIAA Studio exec .....

[Anonymous Coward]

Studio Exec: [pointing to a screen with code on it] This is a crypto program, to, uh, you know, what we use on DVDs, but it's very, very special, because, if you can see...
Hacker: Yeah...
Studio Exec: [pointing to the parameters] ...the numbers all go to eleven. Look, right across the screen: eleven, eleven, eleven, eleven...
Hacker: Oh, I see. And most crypto keys go up to ten?
Studio Exec: Exactly.
Hacker: Does that mean it's better? Is that any better?
Studio Exec: Well, it's one better, isn't it? It's not ten. You see, most... most blokes, you know, will be coding at ten. You're on ten here, all the way up, all the way up, all the way up... you're on ten on your algorithm. Where can you go from there? Where?
Hacker: I don't know...
Studio Exec: ...nowhere! Exactly! What we do is if we need that extra... push over the cliff, you know what we do?
Hacker: Put it up to eleven.
Studio Exec: ...Eleven. Exactly. One better.
Hacker: Why don't you just make ten better, and make ten be the top... number, and make that algorithm a little better?
Studio Exec: [pause, blank look and snapping chewing gum] This goes to eleven.

dvd sales

[dAzED1]

I know this has been mentioned before a million times, but...have dvd sales really been hurt that bad by the encryption for dvd being broken years ago? Those that will rip, will find a way to rip. The rest will buy the blueray/hd dvds.

Unless the industry is wanting to try a dramatic price hike, which would cause those on and near the fence to rip too...?

Re:Bad system

[BosstonesOwn]

Or how about simply stop trying to protect "content" I paid for and let me use it as I see fit.

This "war on piracy" crap has to stop , all it is doing is creating a false market for companies to sell them content management (and I use the term loosely) systems.

They need to rally sit back and look at the hacks that are widely available. Satellite , software , hell even bank cards. They need to either make the system more expensive to break , so there is no point in cracking it , but just buying the disc or they need to embrace what the people want.

Since at this point you are driving your customers away I would choose the second option , don't DRM the discs and let people use the content they paid for. Why make them pay 3 times for the same content, that is just basic bad business and money mongering.

Watch the news spread using Google

[giafly]

At the time of posting, this gives 973 results. Click the link see how much further the news has spread.

Silent cheer for cracked DRM

[raw-sewage]

Does anyone else silently cheer whenever you read a headline about DRM being cracked?

I mean, I'm not an anarchist or cheering for piracy. I just think that DRM strips or at least greatly hinders fair use and artificially inflates the cost of media. The latter is particularly irksome: part of the cost of your CDs, DVDs, HD-DVDs, Blueray Discs is to pay for the research, development and deployment of DRM. I'm sure that's not a trivial cost.

The more I think about this, the more worked up I get: it's paying for features that nobody wants. We are literally paying more to get less.

Making personal copies of media, I believe, should be totally within our fair use rights. I know lots of people with young children who make copies of their DVDs. Their kids watch the DVDs over and over again, and their grubby little hands aren't well-suited for handling the somewhat fragile media. Solution: make a cheap copy of a DVD, and let the kids use that one. Likewise, I copy and encode all the DVD movies I own to my hard drive for a movie-on-demand system. I still own the DVD, so why can't I copy it? (Maybe I should thank the DRM pushers for trying to combat my laziness?)

Just out of curiosity... how big are HD-DVD and Blueray movies? Last I recall, the media sizes were 30 and 60 GB, respectively. Do most movies take up all that space? I mean (in my experience), most 480p DVD movies seem to average just under 9 GB (the full capacity of a dual-layer DVD).

DRM is futile

[pavera]

We all know this, I just think its funny that these media execs can't figure it out. I will never forget a story I heard from Westwood Studios back before they were bought out by EA (96-97 timeframe). On Red Alert 2, they spent a large fraction of the budget of the game, had 4 PhD contractors come in, trying to build a DRM system that would keep people from copying the game. It was cracked within 10 minutes of release.

After that they vowed never to try to put DRM on a game ever again, it cost way too much, and it didn't do anything. Besides that they got people all the time filling out their registration cards saying "I bought this game after I played the hacked version and I liked it".

DRM hurts sales, it hurts acceptance of a system, and it is expensive and pointless to deploy.

Re:DRM is futile

[johno.ie]

Rubbish. Red Alert 2 was not cracked. Even 10 years after release. I have 2 copies of Red Alert 2 and 2 copies of Yuris Revenge on the shelf right beside me here and I played it regularly for years after its release. There was a nocd crack available for it, but it didn't work. It appeared to work for the first 5 minutes of the game, then all your units blew up. That was a clever move on the part of Westwood.
This 'story' that you 'heard' is highly suspect because Red Alert 2 is the only game I know of that never had a working nocd crack.

That was quick

[dgr73]

Usually userfriendly.org can run atleast a few strips poking fun at the inevitability of the crack before one is actually delivered. I guess in the future they should make a stock strip and replace the daily strip with it the second a new AACS fix is announced.

Then again, considering all those pre-release movies out there, I wonder when we'll start getting pre-fix cracks.

Re:Blank Stare

[notque]

I'm sure you thought that was deep, but dude, put down the stick, exhale, and re-read your lines.

There isn't anything deep about it, it just happens to be true.

You know, like this...

            The conscious and intelligent manipulation of the organized habits and opinions of the masses is an important element in democratic society. Those who manipulate this unseen mechanism of society constitute an invisible government which is the true ruling power of our country.
            We are governed, our minds are molded, our tastes formed, our ideas suggested, largely by men we have never heard of. This is a logical result of the way in which our democratic society is organized. Vast numbers of human beings must cooperate in this manner if they are to live together as a smoothly functioning society.
            Our invisible governors are, in many cases, unaware of the identity of their fellow members in the inner cabinet.
            They govern us by their qualities of natural leadership, their ability to supply needed ideas and by their key position in the social structure. Whatever attitude one chooses to take toward this condition, it remains a fact that in almost every act of our daily lives, whether in the sphere of politics or business, in our social conduct or our ethical thinking, we are dominated by the relatively small number of persons--a trifling fraction of our hundred and twenty million--who understand the mental processes and social patterns of the masses. It is they who pull the wires which control the public mind, who harness old social forces and contrive new ways to bind and guide the world.

By the Creator of the Public Relations Industry, and Nephew of Sigmund Freud, Mr. Edward Bernays

crapflooding with keys

[nuzak]

We all know how to google for "09 F9". Some of have that key committed to memory. Or emblazoned on a sticker. Or you can google for "digg revolt". How many people know to google for "45 5F"? How many tshirts will have that? How many hits are on the front page of Digg?

After a dozen more iterations, how visible will those keys be? Easily available, yes. News, no. They go back to being "eeeeevil underground hacking codes" they can more easily legislate against.

Go total digital

[sobolwolf]

They should have learned by now from the music industry - they need strip down all expenses, ie packaging, etc and just provide the content digitally. They could then distribute to selected centers such as blockbuster, etc where people buy a blank dvd and get it burned for a few bucks, and get to keep it as well. Make it so much easier / and cheap for people to get it from offical outlets than to download. I tell you, I would rather stroll around the blockbuster then sift thru shady torrents, plus I can't download pringles... - they could also give away a free toy with kids movies as well... (this seems to work for McDonalds..). They also have one distinct advantage over music in regards to movies - people only watch a movie a few times at most anyway before they are after their next fix. This should be the main focus of a new paradigm in movie distribution. They need to get this infrastructure in place now, as opposed to waiting, for as bandwidth speed increases it is inevitable that people will start to download movies like they do music.

In addition.

[pavon]

To add to erroneus's nonerroneus post, the main thing that they get out of DRM and the DMCA is the ability to dictate exactly what every electronic media device in this country can and cannot do. DVD burners are becoming as common as CD burners, but burning DVDs for your friend is not as common as burning CDs as because you cannot legally purchase software to do so. At the same time it hurts customers (especially ones with young kids) who cannot legitimately backup their DVDs. You cannot copy videos from DVDs onto portable media players, because the companies that sell them are afraid of being sued. Only one company that I know of has prevailed in court over something like this, and they had were sued despite having copy-protection mechanisms built into their device. They want you to buy multiple copies of your videos because that makes them more money.

And it has been working. The number of people who practice wholesale piracy is and always has been fairly low - what scares them is that it might become more widespread if the general public were allowed access to technology which they might abuse. I don't think that is true, and I think it is fundamentally wrong to put restrictions on an entire country just because you fear that some might abuse their freedoms, but that is where they are coming from, and in their eyes DRM has been successful in achieving that goal.

But the real heart of the issue is that they want control for its own sake - not just because they have specific things they want to enforce, but because they have been in control for so long and letting go of any of that frightens them. They don't know what the future holds, and so their reflex is to tighten their grip as much as possible.

Re:Bad system

[PainKilleR-CE]

I find that most people need to understand the link between the encryption and the "features" that irritate them before they will actually realize why this is a big issue to a small number of people. For instance:

- Not being able to fast forward (or skip) through the FBI anti-piracy warning that everyone skipped on their VHS copies of the same movie.

- Not being able to fast forward (or skip) through the previews on all of the Disney movies they bought for their kids (therefore leading to their kids wanting all of the crap on the previews; and their kids complaining that the movie hasn't started yet).

- Not being able to copy the movie to their laptop hard drive before they go on a trip to prevent having to take that stack of DVDs through airport security and possibly damaging the disc in transit.

If they understood the reason for the things they have problems with, rather than just blaming it on their DVD player or a shortcoming in their computer, perhaps more people would be irritated by what the movie industry is doing. Instead, the focus of most press on DVD encryption breaks is piracy and copying movies, when the reality is that most people would be happy just to break the format restrictions and keep buying movies.

In a lot of ways I see the same issues with CDs, where the RIAA shot themselves in the foot by saying people were stealing their product by downloading MP3 files when they could have emphasized (and increased) the benefits of the CD format vs. MP3 files. Anyone that listens to a lot of Pink Floyd and hasn't listened to it in any format other than MP3 in a while should throw the CD in the drive and hear what's missing from their MP3 files. Instead, though, we get the music industry trying to make people buy their product again, in a more limited format, and trying to find a way to wrap the older product in a layer of encryption to keep people from ripping the files to use elsewhere.

2 down...

[Evil Cretin]

Just (2^128 - 2) more to go!

Re:AACS v. RSA/TLS

[nuzak]

The algorithms underlying AACS are quite strong. However, in order to be able to play, AACS not only delivers the encrypted content on the disk, it delivers the key itself, in an encrypted format. And they deliver the key for that in the guts of every single player. Kind of daft, isn't it?

The AACS algorithm itelf hasn't been cracked. The encryption itself is based on AES, and it has no known practical attacks against it. The industry was smart about it this time, and made the spec fully open for review. What is happening is that they keep hiding the key under the mat, and we keep finding out where it is.

Re:AACS v. RSA/TLS

[tppublic]

Very little (read: nothing)

RSA is based on a computationally difficult calculation (factoring large numbers). The difference is that there is a secret key and a public key (same with SSL/TLS). Reconstructing the secret key from the public key is computationally difficult (NP-complete).

AACS is a form of a symmetric key system. There is some complicated math in calculating the derivative keys and allowing key revocation (the AACS encryption method is available on the net), but fundamentallly, they have a problem: The key to decode the disk must be present on the disc. Because this is a symmetric system (again, requiring some calculation from the master key in a hardware device doesn't complicate it that much), it simply cannot be made to be as secure as a system with a secret key. "Hacking" AACS doesn't actually require re-derivation from the master key, since there are so many opportunities to intercept the derived keys when they are "in flight" (in software decoders, for example)

Re:Okay... How do we use a crack?

[Ngwenya]

Now that multiple keys are out, how does someone legitimately use a key to view a HD disc on Linux?

https://help.ubuntu.com/community/RestrictedFormat s/BluRayAndHDDVD is one method which can help; but a few caveats. The problem for Linux play is no longer the video codecs (recent ffmpeg builds have VC-1 support pretty much down pat, and H.264 has been fine for ages if you have a sufficiently powerful rig).

The problem is audio codecs. Most HD-DVDs/BRDs have either E-AC3 (A/52B) or TruHD audio, which ffmpeg currently cannot decode. There are folks working away on it, but it might be a while before concrete results are available. Until then, one possibility - if fiddly - is to demux the video/audio/subtitle streams under Windows using some of the tools available on Doom9 and then transcoding the E-AC3 tracks to AC-3 (or TruHD to FLAC) using EAC3To. You can then remux the video/audio/subtitle tracks into Matroska, and use mplayer or VLC to watch it under Linux. Cumbersome, and not very friendly, but you won't lose any video quality, and if it's FLAC, you won't lose audio quality either.

--Ng