Slashdot Mirror
HDCP Master Key Revealed
solafide writes "The HDCP Master Key has allegedly been revealed. If true, this information will allow anyone to create their own source or sink keys, essentially making HDCP useless for content protection permanently. No word yet on how it was obtained, but if true, this is a great day for content freedom around the world!"
No, this is actually the master key that you can use to generate vendor keys -- changing this key would break compatibility with existing HDCP equipment!
Here you go:
HDCP MASTER KEY (MIRROR THIS TEXT!)
This is a forty times forty element matrix of fifty-six bit
hexadecimal numbers.
To generate a source key, take a forty-bit number that (in
binary) consists of twenty ones and twenty zeroes; this is
the source KSV. Add together those twenty rows of the matrix
that correspond to the ones in the KSV (with the lowest bit
in the KSV corresponding to the first row), taking all elements
modulo two to the power of fifty-six; this is the source
private key.
To generate a sink key, do the same, but with the transposed
matrix.
6692d179032205 b4116a96425a7f ecc2ef51af1740 959d3b6d07bce4 fa9f2af29814d9
82592e77a204a8 146a6970e3c4a1 f43a81dc36eff7 568b44f60c79f5 bb606d7fe87dd6
1b91b9b73c68f9 f31c6aeef81de6 9a9cc14469a037 a480bc978970a6 997f729d0a1a39
b3b9accda43860 f9d45a5bf64a1d 180a1013ba5023 42b73df2d33112 851f2c4d21b05e
2901308bbd685c 9fde452d3328f5 4cc518f97414a8 8fca1f7e2a0a14 dc8bdbb12e2378
672f11cedf36c5 f45a2a00da1c1d 5a3e82c124129a 084a707eadd972 cb45c81b64808d
07ebd2779e3e71 9663e2beeee6e5 25078568d83de8 28027d5c0c4e65 ec3f0fc32c7e63
1d6b501ae0f003 f5a8fcecb28092 854349337aa99e 9c669367e08bf1 d9c23474e09f70
3c901d46bada9a 40981ffcfa376f a4b686ca8fb039 63f2ce16b91863 1bade89cc52ca2
4552921af8efd2 fe8ac96a02a6f9 9248b8894b23bd 17535dbff93d56 94bdc32a095df2
cd247c6d30286e d2212f9d8ce80a dc55bdc2a6962c bcabf9b5fcbe6f c2cfc78f5fdafa
80e32223b9feab f1fa23f5b0bf0d ab6bf4b5b698ae d960315753d36f 424701e5a944ed
10f61245ebe788 f57a17fc53a314 00e22e88911d9e 76575e18c7956e c1ef4eee022e38
f5459f177591d9 08748f861098ef 287d2c63bd809e e6a28a6f5d000c 7ae5964a663c1b
0f15f7167f56c6 d6c05b2bbe8800 544a49be026410 d9f3f08602517f 74878dc02827f7
d72ef3ea24b7c8 717c7afc0b55a5 0be2a582516d08 202ded173a5428 9b71e35e45943f
9e7cd2c8789c99 1b590a91f1cffd 903dca7c36d298 52ad58ddcc1861 56dd3acba0d9c5
c76254c1be9ed1 06ecb6ae8ff373 cfcc1afcbc80a4 30eba7ac19308c d6e20ae760c986
c0d1e59db1075f 8933d5d8284b92 9280d9a3faa716 8386984f92bfd6 be56cd7c4bfa59
16593d2aa598a6 d62534326a40ee 0c1f1919936667 acbaf0eefdd395 36dbfdbf9e1439
0bd7c7e683d280 54759e16cfd9ea cac9029104bd51 436d1dca1371d3 ca2f808654cdb2
7d6923e47f97b5 70e256b741910c 7dd466ed5fff2e 26bec4a28e8cc4 5754ea7219d4eb
75270aa4d3cc8d e0ae1d1897b7f4 4fe5663e8cb342 05a80e4a1a950d 66b4eb6ed4c99e
3d7e9d469c6165 81677af04a2e15 ada4be60bc348d dfdfbbad739248 98ad5986f3ca1f
971d02ada31b46 2adab96f7b15da 9855f01b9b7b94 6cef0f65663fbf eb328e8a3c6c5d
e29f0f0b1ef2bf e4a30b29047d31 52250e7ae3a4ac fe3efc3b8c2df1 8c997d15d6078b
49da8b4611ff9f b1e061bc9be995 31fd68c4ad6dc6 fd8974f0c506dd 90421c1cd2b26c
53eec84c91ed17 5159ba3711173b 25e318ddceea6a 98a14125755955 2bb97fd341cea2
3f8404769a0a8e bce5c7a45fb5d4 9608307b43f785 2a98e5856afe75 b4dbead4815cac
d1118af62c964a 3142667a5b0d14 6c6f90933acd3d 6b14a0052e2be4 1b1811fda0f554
12300aa7f10405 1919ca0bff56ea d3e2f3aad5250c 4aeeea5101d2ec 377fc499c07057
6cb1a90cdb7b11 3c839d47a4b814 25c5ac14b5ec28 4ef18646d5b9c2 95a98cc51ebd3b
310e98028e24de 092ffc76b79f44 0740a1ca2d4737 b9f38966257c99 a75afc7454abe4
a6dd815be8ccbf ec2cac2df0c675 41f7636aa4080f 30e87b712520fd d5dfdc6d3266ac
ee28f5479f836f 0bf8ee2112173f 43ae802fa8d52d 4e0dffd36c1eac 3cbda974bb7585
fb60a4700470e3 d9f6b6083ef13d 4a5840f02d0130 6c20ef5e35e2bf dad2f85c745b5b
61c5ddc65d3fc9 7f6ec395d4ae22 2b8906fb3996e2 e4110f59eb92ac 1cb212b44128bb
545afda80a4fd1 b1ffea547eab6b fac3d9166afce8 3fe35fe17586f2 9d082667026a4c
17ffaf1cb50145 24f27b316acfff b6bb758ec4ad60 995e8726359ef7 c44952cb424035
5ec53461dbd248 40a1586f04aee7 49ea3fa4474e52 c13e8f52c51562 30a1a70162cfb8
ccbada27b91c33 33661064d05759 3388bb6315b036 0380a6b43851fb 0228dadb44ad3d
b732565bc37841 993c0d383cfaae 0bea49476758ac accc69dbfcde8b f416ab0474f022
2b7dbcc3002502 20dc4e67289e50 0068424fde9515 64806d59eb0c18 9cf08fb2abc362
8d0ee78a6cace9 b6781bd504d105 af65fab8ee6252 64a8f8dd8e2d14 cb9d3354e06b5b
53082840d3c011 8e08
1. HDCP MASTER KEY (MIRROR THIS TEXT!)
2.
3. This is a forty times forty element matrix of fifty-six bit
4. hexadecimal numbers.
5.
6. To generate a source key, take a forty-bit number that (in
7. binary) consists of twenty ones and twenty zeroes; this is
8. the source KSV. Add together those twenty rows of the matrix
9. that correspond to the ones in the KSV (with the lowest bit
10. in the KSV corresponding to the first row), taking all elements
11. modulo two to the power of fifty-six; this is the source
12. private key.
13.
14. To generate a sink key, do the same, but with the transposed
15. matrix.
16.
17.
18. 6692d179032205 b4116a96425a7f ecc2ef51af1740 959d3b6d07bce4 fa9f2af29814d9
19. 82592e77a204a8 146a6970e3c4a1 f43a81dc36eff7 568b44f60c79f5 bb606d7fe87dd6
20. 1b91b9b73c68f9 f31c6aeef81de6 9a9cc14469a037 a480bc978970a6 997f729d0a1a39
21. b3b9accda43860 f9d45a5bf64a1d 180a1013ba5023 42b73df2d33112 851f2c4d21b05e
22. 2901308bbd685c 9fde452d3328f5 4cc518f97414a8 8fca1f7e2a0a14 dc8bdbb12e2378
23. 672f11cedf36c5 f45a2a00da1c1d 5a3e82c124129a 084a707eadd972 cb45c81b64808d
24. 07ebd2779e3e71 9663e2beeee6e5 25078568d83de8 28027d5c0c4e65 ec3f0fc32c7e63
25. 1d6b501ae0f003 f5a8fcecb28092 854349337aa99e 9c669367e08bf1 d9c23474e09f70
26.
27. 3c901d46bada9a 40981ffcfa376f a4b686ca8fb039 63f2ce16b91863 1bade89cc52ca2
28. 4552921af8efd2 fe8ac96a02a6f9 9248b8894b23bd 17535dbff93d56 94bdc32a095df2
29. cd247c6d30286e d2212f9d8ce80a dc55bdc2a6962c bcabf9b5fcbe6f c2cfc78f5fdafa
30. 80e32223b9feab f1fa23f5b0bf0d ab6bf4b5b698ae d960315753d36f 424701e5a944ed
31. 10f61245ebe788 f57a17fc53a314 00e22e88911d9e 76575e18c7956e c1ef4eee022e38
32. f5459f177591d9 08748f861098ef 287d2c63bd809e e6a28a6f5d000c 7ae5964a663c1b
33. 0f15f7167f56c6 d6c05b2bbe8800 544a49be026410 d9f3f08602517f 74878dc02827f7
34. d72ef3ea24b7c8 717c7afc0b55a5 0be2a582516d08 202ded173a5428 9b71e35e45943f
35.
36. 9e7cd2c8789c99 1b590a91f1cffd 903dca7c36d298 52ad58ddcc1861 56dd3acba0d9c5
37. c76254c1be9ed1 06ecb6ae8ff373 cfcc1afcbc80a4 30eba7ac19308c d6e20ae760c986
38. c0d1e59db1075f 8933d5d8284b92 9280d9a3faa716 8386984f92bfd6 be56cd7c4bfa59
39. 16593d2aa598a6 d62534326a40ee 0c1f1919936667 acbaf0eefdd395 36dbfdbf9e1439
40. 0bd7c7e683d280 54759e16cfd9ea cac9029104bd51 436d1dca1371d3 ca2f808654cdb2
41. 7d6923e47f97b5 70e256b741910c 7dd466ed5fff2e 26bec4a28e8cc4 5754ea7219d4eb
42. 75270aa4d3cc8d e0ae1d1897b7f4 4fe5663e8cb342 05a80e4a1a950d 66b4eb6ed4c99e
43. 3d7e9d469c6165 81677af04a2e15 ada4be60bc348d dfdfbbad739248 98ad5986f3ca1f
44.
45. 971d02ad
Custom electronics and digital signage for your business: www.evcircuits.com
Nobody had to give it out. The encryption is weak, and it has been known for a long time that it would be possible to derive the master key given data from a sufficient number of devices. I'm surprised it took this long for someone to actually do it.
What other for profit industries can we attack? Maybe someone could come up with a universal electronic key so you can drive any car you want.
Electronic unlock devices already exist. They can be used by locksmiths or other authorized personnel for good. You can buy a variety of security-defeating devices on dealextreme. Have a nice day.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Like all encryption systems - if you learn enough about the keys, you can crack them and recover the original keys. In this case, just 40 devices with HDCP and a lot of mathematics is virtually guaranteed to recover the master key.
Don't use encryption to secure a digital product. It *will* fail because, at some point, you have to give people a key to access that product - thus they have access to the decrypted stream and to a number which is reliant on the private key. Encryption does NOT take account of protecting against an authorised user with a valid decryption key, or numbers of those users working in a concerted effort to crack your encryption. It's a misuse of the technology and any company that claims the opposite (e.g. all DRM companies) are lying to you.
Also the 'crimes' being committed are merely civil offenses.
Ah, the classic slashdot myth, repeated so many times that most people here actually believe it. However, the United States criminal code would beg to differ. Ever download $1,000 worth of material in 6 months? Guess what, you committed a crime.
506. Criminal offenses6
(a) Criminal Infringement. —
(1) In general. — Any person who willfully infringes a copyright shall be punished as provided under section 2319 of title 18, if the infringement was committed —
(A) for purposes of commercial advantage or private financial gain;
(B) by the reproduction or distribution, including by electronic means, during any 180-day period, of 1 or more copies or phonorecords of 1 or more copyrighted works, which have a total retail value of more than $1,000; or
(C) by the distribution of a work being prepared for commercial distribution, by making it available on a computer network accessible to members of the public, if such person knew or should have known that the work was intended for commercial distribution.
(2) Evidence. — For purposes of this subsection, evidence of reproduction or distribution of a copyrighted work, by itself, shall not be sufficient to establish willful infringement of a copyright.
(3) Definition. — In this subsection, the term “work being prepared for commercial distribution” means —
(A) a computer program, a musical work, a motion picture or other audiovisual work, or a sound recording, if, at the time of unauthorized distribution —
(i) the copyright owner has a reasonable expectation of commercial distribution; and
(ii) the copies or phonorecords of the work have not been commercially distributed; or
(B) a motion picture, if, at the time of unauthorized distribution, the motion picture —
(i) has been made available for viewing in a motion picture exhibition facility; and
(ii) has not been made available in copies for sale to the general public in the United States in a format intended to permit viewing outside a motion picture exhibition facility.
(b)(b) Forfeiture, Destruction, and Restitution.—Forfeiture, destruction, and restitution relating to this section shall be subject to section 2323 of title 18, to the extent provided in that section, in addition to any other similar remedies provided by law.
(c) Fraudulent Copyright Notice. — Any person who, with fraudulent intent, places on any article a notice of copyright or words of the same purport that such person knows to be false, or who, with fraudulent intent, publicly distributes or imports for public distribution any article bearing such notice or words that such person knows to be false, shall be fined not more than $2,500.
(d) Fraudulent Removal of Copyright Notice. — Any person who, with fraudulent intent, removes or alters any notice of copyright appearing on a copy of a copyrighted work shall be fined not more than $2,500.
(e) False Representation. — Any person who knowingly makes a false representation of a material fact in the application for copyright registration provided for by section 409, or in any written statement filed in connection with the application, shall be fined not more than $2,500.
(f) Rights of Attribution and Integrity. — Nothing in this section applies to infringement of the rights conferred by section 106A(a).
It gets worse actually, with HDCP you cannot use signal splitters or other devices like scalers or converters that are frequently used in professional projection and scientific setups. If you do, you will get snow (not immediately, just sometime down the road when somebody has loaded HDCP protected content) on the whole display (not just the content) making those things useless. If you use a splitter for example, you have to go out of your way and buy another device ($80) to sit on the primary channel to make sure it can't negotiate the HDCP encryption. But HD content will still play even if you don't have an HDCP-compatible setup (as there is no content I know off yet that forcefully locks people out of their Chinese/Wal-Mart TV/Blu-Ray el-cheapo knockoff setup), it's just that if you do have an HDCP-compatible setup (and you paid good money for eg. Dual-DVI KVM, splitter, displays and projectors with high-res 120Hz signals for scientific research), it will malfunction.
Custom electronics and digital signage for your business: www.evcircuits.com
In particular, read
http://en.wikipedia.org/wiki/High-bandwidth_Digital_Content_Protection
and
http://en.wikipedia.org/wiki/Blom's_scheme
Some key (heh) facts:
* This key is not stored in high-def devices themselves, nor does any manufacturer possess it. This is the key used to *make* individual manufacturers' keys.
* The generated manufacturers' keys are set up in a way that device A and B can communicate secretly without knowing each others' keys.
* Because of the way this system works, if enough individual manufacturers' keys are known, one can figure out the master key. In this case, "enough" is 40.
Important point: it's not like some random tech at Sony got fired and decided to blow the whole thing wide open. If it's a leak, it's a leak from just one or two specific keyholders at Intel, who developed the system. But it doesn't have to be: any random person with 40 different Blu-Ray players and a whole lot of cleverness could potentially figure this out.
Cryptome has an interesting reading on the weakness of the key
Ubuntu is an African word meaning 'I can't configure Debian'
If i look at the pastbin post this is just a complex way to publish 40 keys, not ONE master key
It's the master key matrix - not an HDCP key by itself, but THE key to generate all valid HDCP keys.
At some point, lawmakers will be from the generation that also posts on forums, that downloaded mp3's when they were younger (or still do), and that watched 2 or 3 movies illegally when they were students.
Current lawmakers all smoked dope when they were students. That doesn't mean that they are all in favor of legalizing marihuana.
And the "flower power" generation had, during 60-ies - 70-ies, some pretty liberal idea about sex ... FF 40 years (they should be in their 60 now) and... try singing that in public, you'll see it's almost as illegal as marijuana.
Questions raise, answers kill. Raise questions to stay alive.
Well, uh... for starters, it's nothing to do with DVDs. HDCP is the copy protection mechanism for display interfaces. The copy protection for DVDs is CSS, which was broken over a decade ago. HDCP is a ridiculous system which makes a display authenticate itself against the playback device before a high definition picture will be displayed. This is purportedly to prevent piracy, however most piracy takes place by decrypting the information on the disk before it's ever output to the display, and copying the raw data.
All HDCP does is limit the freedom of the end user in choosing their display device(s) and creates the risk that a device's key might be revoked. Traditional uses of display equipment, e.g. multiple displays in bars, places of worship, retail etc., is made much more difficult because of the handshaking and key exchanging involved. All HDCP really does is placate ignorant studio bosses whilst making things more costly for the consumer. The 'professional' pirates don't care about it at all.
Get this through your head: The cost of maintaining a distribution network -- be it servers in a data center, theaters in malls across the country, or warehouses and trucks -- far exceeds the cost of manufacturing a physical article in bulk. And the cost of CREATING content exceeds them both.
Uhh...I thought the big advantage of electronic distribution was that it's far cheaper than creating physical articles. I can get a server with 100mbit bandwidth + 10TB monthly transfer for $350/mo -- that will let me distribute 300K albums (at 30MB each). Or, one tenth of a cent each. Even if I hosted on Amazon EC2, my costs would be around 0.6 cents per CD.
I don't think you can press a CD for that little, even if you're buying 10 million of them at a time. I'd bet that the setup fee for a big CD run costs more than hosting the website for 6 months or a year.
Whether or not the cost of creating the content costs more than that depends on who the artist is and why they are creating it and what costs are included -- I have friends that burn CD's and give them out for free because they create music for the fun of it. I think their "recording studio" (including hardware and software) cost less than $500.
Not that I'm a big music producer or anything, but this is exactly my distribution model. I make music/video for fun on: an old DSLR, an 8mm video camera, a computer with open source software, a few m-audio products and a few Shure microphones. all said and done, To cover a 4 man band I think the complete setup cost me about $2500, (though it would have been about $5000 had I bought it all new).
to date, I think I've grossed about ~$3000, having done about twenty or so live shows at $150 a night. production quality if a lot better than the bands expect, and for the cost of my internet connection a month, they get a torrent seed to give away a link to for free copies of the production.
in either case, the total production cost for a band to release a private CD of pretty close to record industry quality, would run about $1200 for 500 discs (including the cost of the venue, mastering, discs, burning, printing, and jewel case construction/design/printing.) with additional discs running about $0.65/disc.
even at $5 a disk, that's still a HUGE profit margin. (assuming instruments and any other equipment needed to preform was already paid for. though not often the case, a few shows and a few happy buyers quickly take care of that)
It is only negligible if your time has no value, or the time of the other people involved in making the music has no value. Most people are not born musical savants - they must learn to play their instrument, they must practice their instrument, they must purchase an instrument (or multiple instruments) to play. To record, they must purchase a powerbook (or a cheap dell), they must purchase the recording software, and they must learn how to use the recording software. They must also then actually get around to *writing their own* music. And while you're doing that, you have to earn money to meet the million other obligations of daily existence - food, clothing, shelter, utilities, transportation... all of this costs money and/or time.
To suggest that the process of making music is more or less zero-cost - "cost of creation is negligible" is either willfuly ignorant or absurdly naive. It requires a lot more than patience. And the ultra-rich rock stars are the exception, not the rule. You'll find a lot more musicians that work shitty waiter and retail jobs to pay the bills while they work on their music, and for whom that $100 they could have brought in off 5-10 CD sales would mean one less shitty double-shift.
Production AND distribution are a very small portion of "content creation," whether it be a P2P distribution scheme, or shipping by trucks to hundreds of stores around the country. If you place any sort of value on the work of the musicians whose music you love, then paying them $10-15 to support their work and help them continue to make music is not an unreasonable expectation. Make an effort to find music produced by independent artists, who market directly to their audience, and support those people.
No one who is complaining about HDCP is trying to pirate. Cracking HDCP is utterly useless for pirates, and HDCP doesn't stop anything they're trying to do.
The HDCP 'protection' was a delusional attempt by the content providers to get a step ahead of pirate-copy-makers. They fantasized that their current media protection was 'perfect', so figured pirates would start copying from the video connection.
Of course, their protection wasn't perfect, so copier have continued to just strip the DRM off the provided media instead of rigging weird setups to copy from a monitor cable.
Which copiers could do anyway, as HDCP decoders have existed forever. This crack was the master key...before that, you had to buy a 'licensed' piece of hardware that could strip HDCP, which is fairly easy to get, although you have to order from overseas. With this crack, now, you can simply record the encrypted signal and decode it, I guess. (Maybe not, though.)
But no copier did that, or will start doing that. They'll just remove the BlueRay or cable encryption instead, like they've been doing.
In short, HDCP was 'second-level' DRM, which required, as a base assumption, that no one would be able to decode DRM before it get outputted, so HDCP was an attempt to protect the output. As people can decode the DRM before output, it's, um, utterly pointless to crack.
Even if copiers were copying from there, none of that has anything to do with 99.9999% of pirates, who download copied movies,and thus could give a flying fuck where the copy came from. Any HDCP connections will display a pirated video as well anything else.
If corporations are people, aren't stockholders guilty of slavery?