I wrote Friday about weaknesses in the HDCP handshake protocol that is being used to set up encryption of very high-def TV content that is in transit from devices like next-gen DVD players to television monitors. This was not news to those who follow the area. The ideas in my post came from a 2001 paper by Crosby, Goldberg, Johnson, Song, and Wagner – all I did is abstract away some of the mathematical detail to simplify the explanation.
As far as I can tell, the publication of the Crosby paper, and the spread of the news about HDCP’s flaws, did not trigger any change in Hollywood’s plans for next-gen TV. They’re still relying upon HDCP, in the same way they seemed to be planning five years ago. As far as I can tell, HDCP’s vulnerability hasn’t changed anything – yet.
This is quite interesting, when we consider that the system as designed is almost certain to be completely broken. The security of the design relies entirely on the secrecy of 1600 special numbers (which form a 40-by-40 matrix), whose disclosure to the public would release the knowledge to build a device that could do absolutely everything that HDCP is supposed to prevent. It is well known how to extract these numbers – though it requires some technical effort – but once the numbers are published, HDCP’s security is shot forever. This is virtually certain to happen in the next few years.
There’s a good chance that the HDCP people knew beforehand that this would be the case. If they used a good due diligence process on the HDCP algorithm, they would almost certainly have discovered these weaknesses. But even if they didn’t know from the very beginning, they found out in 2001.
There’s no doubt that they could have done better. Instead of using the flawed homebrew algorithm they chose, the HDCP designers could have avoided this security problem by using a well-known algorithm known as offline Diffie-Hellman.
Recall from Friday that each HDCP device has a private value and a public value. When two devices – call them A and B – handshake, they send each other their public values. Then A combines its private value with B’s public value, and vice versa. The result of that computation is a secret key, which is guaranteed to be the same for both participants.
In HDCP as designed, the recipe for combining public and private values involves only addition. And because is uses only addition, a would-be attacker (like the conspiracy I discussed on Friday) can set up a series of N equations in N unknowns, and those equations involve only addition – not multiplication, division, or other mathematical operators. Because the equations are this simple (“linear” in math-speak), you can solve them by standard methods, assuming you have enough equations.
The offline Diffie-Hellman algorithm, which I mentioned above, combines the public and private values in a particularly nasty non-linear fashion, to prevent the equation-solving attack. (For more detail on how Diffie-Hellman works, see the entry in Wikipedia.) An adversary can set up equations, but as far as we know there is no practical way to solve them.
The Crosby paper suggests an explanation for the use of a homebrew algorithm: the HDCP design requirements said that the entire design had to implementable in hardware with no more than 10,000 logic gates. (Logic gates are one of the simplest building blocks used to design digital circuitry. In 2001, a state-of-the-art microprocessor chip would have contained tens of millions of gates.)
Indeed, the structure of the homebrew algorithm they used is so similar to that of offline Diffie-Hellman (with simpler mathematical structures replacing the more secure ones used by offline D-H) that it seems likely that the designers knew what they really wanted but couldn’t figure out how to fit it within the 10,000-gate budget they were given – so they settled for a less secure design.
The alternative, of course, would have been to increase the gate budget in order to allow a more secure design. Why didn’t that happen? I’ll discuss some possible reasons next time.
I have a 4 year old HYUNDAI 42″ plasma TV that is now, as far as HD goes, useless as a result of this monstrous prohibition technology that has been imposed on the world by the greedy morons that inhabit that capitalist cesspit called Hollywood, I will find a way around it or find a way of getting £1,800 I spent on my long life TV back from the inverters of HDCP one way or another.
May they burn in hell slowly……
HDCP stands for HANDICAPPED!
@Johndori:
The weakness of HDCP as written lies in the key exchange part of the algorithm; keys are checked through the use of an operation whose inverse can be computed in linear time (as opposed to Diffie-Hellman, who uses an operation whose inverse is somewhere in NP, therefore probably requiring exponential time).
The RSA-equivalent in the system is a stored matrix of ‘magic numbers’, which essentially constitutes a cached copy of the certificate authority’s bank of authorized certificates. The results of the meta-Diffie-Hellman computation are checked against this matrix instead of being shipped off to the authority directly.
You could screw up Diffie-Hellman+RSA real bad like if you could get a hold of the contents of the certificate authority’s database. This can be done through unconventional theft of the database itself, or by reverse-engineering some or all of the contents of that database by analysing the results of a bunch of DH+RSA handshakes. This is really hard because the inverse of the DH encoding algorithm is an exponential problem (in the number of possible keys). However, because the inverse of the HDCP encoding algorithm is linear in the number of possible keys (40), you only need 40 different HDCP handshakes to collect the full set of keys–and have effectively stolen the certificate authority’s database.
So basically some enterprising group of individuals need only collect together 41 HDCP-active components (40 sources and a TV, say) and one encrypted data stream, watch the sources handshake with the TV, and compute the matrix. Net cost: way less than $41,000.
Caveat: Hopefully my analysis of the situation is accurate; I may have missed a couple of details.
I think there is some mistake here in the assumption the Diffie-Hellman algorithm could be used for the DHCP purpose.
The Diffie-Hellman algorithm provides for secure key exchange but does not provide authentication of the players so any one that implements the algorithm can communicate.
RSA provides the Authentication as one level up but it requires a third Authentication center.
“Well in that case, I think we all need to sit back and ask ourselves do we really need or want that HDMI enabled TV, HD Player, Blu Ray player etc..”
I’m waiting for:
a) the HD-winner to be declared
b) prices of computer drives (writable) to fall to $100
c) a full-featured, free, open source, cracked player to be available on the internet.
It’ll be awhile. Until then, my current solution works just fine.
Well in that case, I think we all need to sit back and ask ourselves do we really need or want that HDMI enabled TV, HD Player, Blu Ray player etc..
It’s never about preventing piracy, they honestly couldn’t care less. It’s about exerting control, and one day renting the movies you bought back to you. In short, it’s about you paying for the content many times over.
When you buy a book in a shop, you know the terms you’re getting it under. You shouldn’t photocopy it, but it’s going to be yours, and the only way it can be removed from your possession is theft.
In DRM terms, you don’t know the terms you’re getting it under. You shouldn’t strip the DRM away, and it’s not necesarily going to be yours. It could be removed from your possession by the content holder simply flicking a switch. So when the business model changes so everything is rented, how will it make you feel that you paid for it in full already, but you’re paying for it many times over in rental fees too?
Content used to be about content, now content matters not. Hollywood comes out with crap film after crap film, and yet we still buy the DVDs. I won’t be getting an HDDVD player, I won’t be getting a BluRay player, and I couldn’t give a f**k if my TV supports one of the thousands of rivals to HDCP. The EUCD bans only the sale of items that remove protections, it doesn’t actually stop you from making one yourself. And when macrovision removers were banned, they just changed name to `signal cleaners`. Bottom line: Consumers have a choice to act now, and now is indeed the time to act. One day you aren’t going to have that choice, so make sure you stand up for it while you have the chance.
`The death of freedom is not likely to be an assassination from ambush. It will be a slow extinction from apathy, indifference and under nourishment.` –Hutchins, modified.
–James
Well, Jim, your points concur with something I conjectured recently elsewhere.
DRM isn’t about preventing file-sharing or piracy, or even asserting restrictions granted by copyright, it’s about extracting more money for very little additional effort from those whose wallets are open.
If you figure you can’t sell to technophiles, then introducing measures like DRM that piss them off won’t hurt – you can’t lose the same customer twice.
Instead, DRM enables you to obtain far greater revenues from the rest of your customers by asset stripping unencumbered content, into umpteen encumbered variations.
And the core market of couch potatoes remain ever loyal and gratified, like babies convinced a toy presented in a new orientation is a new toy.
Can such contempt for customers as simple consumers of content continue?
Both Ed Felten and Fred von Lohmann speculate that HDCP isn’t secure because the industry couldn’t afford to make it secure. (Ed says it’s because of gate counts, while Fred says it’s because of time).
I suspect that the story is different: HDCP isn’t secure because the industry *wants* it to be insecure. The technical people who designed it aren’t stupid; they know that taking an existing protocol and dumbing it down will decrease security. If there’s one technical object lesson from CSS, it’s that you shouldn’t use a stupid protocol if you want it secure.
So, I conclude that they want it insecure. The next question is “Why?” Answering this requires more deep strategic thinking than I’m capable of, but here’s one guess:
1. HDCP’s security or lack thereof is irrelevant to the stated goal of preventing piracy (either way, it happens).
2. HDCP’s security or lack thereof is irrelevant to the goal of causing volume hardware manufacturers to toe Hollywood’s line (either way, they do).
3. The incsecurity of HDCP guarantees that there will be various low-volume manufacturers of HDCP strippers. Their target market will be videophiles and hobbyists. These are exactly the people for whom the additional flexibility of no controls probably results in increased sales of movies.
4. The existence of HDCP strippers serves as a safety valve for screwed up control systems. That is, if perchance a senator’s home video system quits working due to things like revocation lists or whatever, someone can quickly install a small box to keep him from raising the roof.
5. The existence of HDCP stripper manufacturers allows Hollywood to easily identify the most dangerous opponents of DRM (those who have both the means and the will to defect it). Once identified, it’s easier to turn or neutralize them (“if you ever want to enter the US, you’ll need our permission first.”) In short, it’s a case of keep your friends close, but your enemies closer.
So, points 1 and 2 are neutral on the question of security, but 3, 4 and 5 favor insecurity.
Any other ideas?
Crosbie Fitch Says:
“Let’s say that there’s a hidden agenda to saturate consumer electronic devices with HDMI until there are no non-HDMI devices left.”
That is not a hidden agenda. It is the agenda.
The first time digital matters were ever aired in the courts was when Aolean manufacturered player pianos. The Supreme Court held that the perforated rolls were not a breach of copyright. So the music industry went to Congress. But their demands went beyond extending copyright to cover mechanical storage of music. They wanted the exclusive right to manufacture the player pianos – a demand which Congress rejected.
I think that the entertainment industry are scared that the new technology is capable of creating a market in which they are superfluous. Music groups are emerging who earn a living out of live performances and merchandising, sell CD’s cheap, and give mp3’s of their music away free on the Internet. And they self-distribute without the big labels.
And who knows. How long will it be before small companies can make and self-distribute movie material on a similar type of business model.
I think it is that type of threat that the big boys are worried about, and all of this aacs and hdcp is to do with controlling the technology, rather than protecting the rights of artists.
So Wendy, like all good defenders, you survey your ramparts and consider an attack against them from the attacker’s perspective. You certainly don’t simply throw your hands up in despair, and consider exploration of countermeasures premature and futile.
The content creation/distribution industry considers it retains control over its IP even after it’s published it to you.
And now we have the content storage/processing/performance industry considering that it retains control over its devices even after it’s sold them to you.
I wouldn’t take it lying down if I were you.
A problem with conspiracy theories is that it’s hard to distinguish the likely ones from the unlikely ones. And even within the realm of likely conspiracies, there are so many possibilities that it seems difficult to attempt to counteract all of them in advance. As Schneier says, the attacker can choose where to attack, but the defender cannot. (In this case, we are the defenders of fair use, first sale, and other rights, while the entertainment industry is the attacker.)
Let’s say that there’s a hidden agenda to saturate consumer electronic devices with HDMI until there are no non-HDMI devices left. Everyone’s been quite happy because unencrypted content enjoys access to all features.
And then, someone flicks a switch (like the military resolution switch in the GPS service) and the only content able to exploit higher resolution or other features is AACS/ICT/HDCP content. And as we know this switch can be flicked via updates from fresh content.
Then there’ll be an incentive to create home grown, unlicensed AACS content.
Mobile phones are bad enough (being remotely configurable), but letting other devices like TVs remain the effective property of the manufacturer sounds like an ‘interesting’ development.
I don’t quite follow this.
If I want to record some music and distribute it in an un-protected form on CD, then I can. If I want to make a movie, and distribute that on DVD in unprotected and region free form, then I can do that as well.
What I cannot do, is to scramble a movie using CSS, and then distribute it and give users permission to circumvent the protection, and then try to argue that this authorises device makers to market a circumvention device.
The same applies to the new generation of discs. Either you want to use the copy and content protection set-ups or you don’t. If you do use them, you licence them.
As far as I am aware, if the ICT token is not set, or if the disc is not a AACS disk, then hi-res will be available through all the outputs, nd can be copied.
But quite honestly, my perception is that the industry are concerned that the market will not stand a necessity to buy new players and replace existing HD monitors. I believe that there have been internal industry predictions that if the ICT is set on HD movies, sales will be poor and there will be a vicious circle that hits players and monitors, and that the whole HD thing will fail to take off.
What would stir things up would be for a movie company to produce hi-res movies that are not protected, and to pile em high and sell em cheap. I have a suspicion that would make more money than the way they are carrying on at the moment.
Ok, so AACS = yet another file format that has been patented in the land of the free
So, firstly, let’s hypothesise that we have tons of copyleft files in AACS form flying around file-sharing networks. They do not infringe anyone’s copyright, but apparently they do infringe someone’s patents.
Anyone is free to burn them to HD-DVD, or otherwise pipe them out to HDMI compatible devices.
Are we going to see the HDMI equivalent of the RIAA suing people for sharing patent infringing files?
And if encryption keys have been determined without access to trade secrets, surely there’s no violation of trade secrecy?
If you publish your age, I can deduce your date of birth – have I then violated your right to keep your date of birth private?
AACS is patented and the keys are trade secrets, so there’s no way to legally use it without a license.
Wendy:
Ok, so I have encrypted (via independent, potentially nefarious means) my Copyleft content using AACS onto HD-DVD. I also set all the encryption flags including ICT just for the hell of it.
I have not purchased any licenses from anyone.
Have I done anything illegal yet?
I insert it into an HD-DVD player, which gladly accepts it and proceeds to output an HDMI+HDCP signal.
Have I done anything illegal yet?
I connect an HD-TV which gladly accepts the signal, acknowledges the HDCP and displays my content at max res.
Have I done anything illegal yet?
I then attach a Bonkyo HDMI video editing suite, which because it is extremely cheap, can’t accept HDCP input.
So I insert an inline HDCP stripper, and the editing suite works fine.
Have I done anything illegal yet?
Do let me know if I’ve done anything illegal, and precisely when and why.
I’m trying to establish whether HDMI/HDCP devices can ever be legitimately utilised (in unhobbled form) by the free content industry – especially where this may need what some might call a circumvention device (that I might call a purchased functionality enablement device).
I’m also interested to know why on earth it is obligatory to get an HDCP license to encode content. This is surely only necessary to get valid keys the easy way, i.e. there’s no law that makes it illegal to encrypt content without obtaining approval from a key licensing authority – or is there?
Crosbie: Unfortunately, people will still have difficulty distributing players for your HDCP-defying works, because they’ll have to show that playing your works is more than a “limited commercially significant purpose or use other than to circumvent.” (1201(a)(2)(B) and (b)(1)(B)). That is, if you can even get an HDCP license to encode your content without agreeing not to encourage anyone to thwart the system.
Crosbie Fitch: Don’t bother trying to use the DMCA against the entertainment industry. They can buy laws and you can’t, so they will simply close any loophole that you find.
Most of the studios have announced that they will not be setting the ICT on releases for the time being. And as far as appears to be the case, that means that their HD movies will play down all of the outputs even if the monitor is not an HDCP.
I suppose the ultimate outcome might well be that HDCP is never actually used by the studios, but that monitor manufacturers have to pay a licence fee and build it in – in case it is used.
In which case, it is irrelevant whether or not HDCP is secure.
And if that ruse works, why not devise something that has to be embedded in connection leads. You never need to deploy it, but you collect $1 fee for each lead sold.
How many gates would it take to do ODH? Since you can build an entire %$$%$% eight-bit microprocessor in about 6000 gates I’m not sure that’s quite the answer.
There was a posting on Perry Metzger’s Cryptography mailing list last year discussing the HDCP handshake, and also a similar handshake from a related protocol called DTCP used for protecting Firewire video data. It points to work showing how to recover keys from devices via crypto handshakes and exhaustive search:
/msg03834.html" rel="nofollow ugc">http://www.mail-archive.com//msg03834.html
Or rather, they have to have the permission of the copyright holder. Where they do not have permission, the DMCA forbids them from attempting to circumvent any TPM.
If I encrypt my copyleft content using precisely the same encryption mechanism (albeit with different keys) and state that it is an integrity assurance mechanism (not a TPM) and that all subsequent encoding mechanisms such as HDCP are also IAMs, then the DMCA does not prohibit anyone from interoperating with my content since: a) they have my permission, b) I utilise no TPMs, and c) I explicitly encourage all hardware manufacturers to take all and any steps necessary to interoperate with my content, even if that requires stripping away my IAMs (with or without knowledge of my keys).
not to discount their intelligence, but don’t give these people ideas please ~_~, they have absolutely no respect for individual property and fair use rights.
The tradeoff is that you drive more customers into the (for want of a better phrase) black market. There are after all DVD ripping and copying utilities of various sorts available, though whether or not they are legal becomes immaterial.
The risk that all these companies take by enforcing more and more worthless copy protection is end users will become more non chalante about completely ignoring the rules. If a HDCP disc will not play at full resolution on my current video card (which it won’t apparently because no video cards actually have the keys) then people will just download a utility that lets them. Combine that with adding a fancy new drive to my now HDCP enabled PC that doubles as a poor mans TIVO and the only points on the chain the MPAA actually gets money is the sale of the drive and the sale of the disc. Both of which they may lose out on if they are too much of a hassle because people will opt to, download it (presumably illegally), and burn their own discs.
I don’t actually rip dvd’s so I’m going on 2nd hand information here, but I guess an 8.5GB DVD rips down to about 850MB (presumably with some loss). So given the choice people may chose to download High def content, and put it on blank DVD’s at DVD quality, or just circumvent the protection all together.
They charge whatever fees they want, but if there’s no market why would any company agree to pay it? I suppose this way they can forcibly close down DVD sales eventually and shift entirely to the winner of blue-ray vs HD-DVD, but that only works if people are bothering with buying your product, esspecially when, from the sounds of things, its going to be more expensive and more of a headache to use at full quality than DVD’s are, so who dare I ask will bother with that?
Think starforce, how many people buy starfoce “protected” games? There’s a massive anti starforce movement etc… its not even like starforce is exceptionally problematic for most people, though it is problematic for some, and so end users don’t bother, if it uses starforce people just don’t buy it. They just wait for pirated versions to become available.
The law and licensing deals may encourage them to use any old security because its better than nothing, but the laws and taxation encouraged cheap gas and crappy cars in the US that managed to save GM for a few years but now they’re in trouble, the MPAA should learn the lesson: Adapt to new marketplace or risk insolvency.
The DMCA makes it far more important that a protection measure be deployed ASAP, than that the measure be secure. That’s why content owners continue to develop and deploy systems that they know will not be secure — security is not the principal goal of these systems. Instead, a principal goal is that the security regime act as “hook IP” — the hook on which a licensing regime can be hung.
Under the DMCA, once you’ve encrypted (or otherwise “protected”) your content, anyone who wants to interoperate with your content has to come and ask for the keys. Access to keys is made subject to a wide variety of restrictions, imposed by licensing agreements. This gives content owners an unprecedented level of control over the technologies on which their content can be accessed.
The DMCA’s protection applies irrespective of the strength of the protection mechanism used (some have opined that even ROT13 will do). As a result, it is far more important that a protection mechanism be deployed quickly (thereby securing DMCA protection for the entire platform) than that the mechanism be secure.
For example, CSS has been thoroughly compromised. However, the licensing scheme for CSS continues to give the DVD-CCA extensive control over what features can be included on DVD players and recorders (hence, no device that can legally rip a CSS-protected DVD to a PC’s hard drive). Similarly, the HDCP licensing regime for it will continue to impose restrictions on licensed devices long after HDCP is compromised.
Hollywood is not deploying weak security because they are stupid. They are doing it because that’s what the law encourages them to do.
Quite honestly, using a flawed implementation seems to be in keeping with the way they do everything else.