Freedom to Tinker

Proponents of HD-DVD, one of the two competing next-gen DVD standards, have harsh words for the newly announced DRM technologies adopted by the competing Blu-Ray standard, according to a Consumer Electronics Daily article quoted by an AVS Forum commenter.

[Fox engineering head Andy] Setos confirmed BD+ [one of the newly announced Blu-Ray technologies] was based on the Self-Protecting Digital Content (SPDC) encryption developed by San Francisco’s Cryptography Research. That system, which provides “renewable security” in the event AACS is hacked, was rejected for HD DVD over concerns about playability and reliability issues (CED Aug 2 p1). BDA [the Blu-Ray group] obviously had a different conclusion, Setos said.

…

[Hitachi advisor Mark] Knox also took a shot at the BD+ version of SPDC, calling its “Virtual Machine” concept “a goldmine for hackers.” He said the Virtual Machine “must have access to critical security info, so any malicious code designed to run on this VM would also have access. In the words of one of the more high-tech guys ‘This feeble attempt to shut the one door on hackers is going to open up a lot of windows instead.’”

There’s an interesting technical issue behind this. SPDC’s designers say that most DRM schemes are weak because a fixed DRM design is built in to player devices; and once that design is broken – as it inevitably will be – the players are forever vulnerable. Rather than using a fixed DRM design, SPDC builds into the player device a small operating system. (They call it a lightweight virtual machine, but if you look at what it does it’s clearly an operating system.) Every piece of content can come with a computer program, packaged right on the disc with the content, which the operating system loads and runs when the content is loaded. These programs can also store data and software permanently on the player. (SPDC specifications aren’t available, but they have a semi-technical white paper and a partial security analysis.)

The idea is that rather than baking a single DRM scheme into the player, you can ship out a new DRM scheme whenever you ship out a disc. Different content publishers can use different DRM schemes, by shipping different programs on their discs. So, the argument goes, the system is more “renewable”.

The drawback for content publishers is that adversaries can switch from attacking the DRM to attacking the operating system. If somebody finds a security bug in the operating system (and, let’s face it, OS security bugs aren’t exactly unprecedented), they can exploit it to undermine any and all DRM, or to publish discs that break users’ players, or to cause other types of harm.

There are also risks for users. The SPDC documents talk about the programs having access to permanent storage on the player, and connecting to the Internet. This means a disc could install software that watches how you use your player, and reports that information to somebody across the Net. Other undesirable behaviors are possible too. And there’s nothing much the user can do to prevent them – content publishers, in the name of security, will try to prevent reverse engineering of their programs or the spread of information about what they do – and even the player manufacturer won’t be able to promise users that programs running on the player will be well-behaved.

Even beyond this, you have all of the usual reliability problems that arise on operating systems that store data and run code on behalf of independent software vendors. Users generally cope with such problems by learning about how the OS works and tweaking its configuration; but this strategy won’t work too well if the workings of the OS are supposed to be secret.

The HD-DVD advocates are right that SPDC (aka BD+) opens a real can of worms. Unless the SPDC/BD+ specifications are released, I for one won’t trust that the system is secure and stable enough to make anybody happy.

Blu-Ray, one of the two competing next-gen DVD standards, has decided to up the ante by adopting even more fruitless anti-copying mechanism than the rival HD-DVD system. Blu-Ray will join HD-DVD in using the AACS technology (with its competition-limiting digital imprimatur). Blu-Ray will add two more technologies, called ROM-Mark and BD+.

ROM-Mark claims to put a hidden mark on all licensed discs. The mark will be detected by Blu-Ray players, which will refuse to play discs that don’t have it. But, somehow, it is supposed to be impossible for unlicensed disc makers to put marks on their discs. It’s not at all clear how this is supposed to work, but systems of this sort have always failed in the past, because it has always proved possible to make an exact copy of a licensed disc (including the mark).

BD+ will apparently allow the central Blu-Ray entity to update the anti-copying software in Blu-Ray players. This kind of updatability will inevitably add to the cost, complexity, and fragility of Blu-Ray players. Trying to do this raises some nasty technical issues that may not be solvable. I would like to find out more about how they think they can make this happen, especially for (say) cheap, portable players. (This technology was reportedly Fox’s reason for joining the Blu-Ray camp.)

As always, content will be copied regardless of what they try to do, and the main effect of these technologies will be to make player devices more expensive and less reliable, and to limit entry to the market for the devices. My guess is that some movie studio people actually believe these technologies will stop copying; and some know the technology won’t stop copying but want the power to limit entry.

Both groups must be happy to see the Blu-Ray and HD-DVD camps competing to make the most extravagant copy-prevention promises. To law-abiding consumers, each step in this bidding war means more expensive, less capable technologies.

A recent white paper (2MB Word file) from Microsoft details the planned “output content protection” in the upcoming Windows Vista (previously known as Longhorn) operating system product. It’s a remarkable document, illustrating the real costs of Hollywood’s quest to redesign the PC’s video hardware and software.

The document reveals that movie studios will have explicit veto power over what is included in some parts of Vista. For example, pages 22-24 describe the “High Bandwidth Cipher” which will be used to encrypt video data is it passes across the PC’s internal PCIe bus. Hollywood will allow the use of the AES cipher, but many PCs won’t be able to run AES fast enough, leading to stutter in the video. People are free to design their own ciphers, but they must go through an approval process before being included in Windows Vista. The second criterion for acceptance is this:

Content industry acceptance
The evidence must be presented to Hollywood and other content owners, and they must agree that it provides the required level of security. Written proof from at least three of the major Hollywood studios is required.

The document also describes how rational designs are made more expensive and complicated, or ruled out entirely, by the “robustness” rules Hollywood is demanding. Here’s an example, from page 27:

Given the data throughput possible with PCIe, there is a new class of discrete graphics cards that, to reduce costs, do not have much memory on the board. They use system memory accessed over the PCIe bus.

In the limit, this lack of local memory means that, for example, to decode, de-interlace, and render a frame of HD may require that an HD frame be sent backward and forward over the PCIe bus many times – it could be as many as 10 times.

The frames of premium content are required to be [encrypted] as they pass over the PCIe bus to system memory, and decrypted when they safely return to the graphics chip. It is the responsibility of the graphics chip to perform the encryption and decryption.

…

Depending on the hardware implementation, the on-chip cipher engine [which wouldn’t be necessary absent the “robustness” requirements] might, or might not, go fast enough to encrypt the 3 GByte/sec (in each direction) memory data bandwidth.

These are just a few examples from a document that describes one compromise after another, in which performance, cost, and flexibility are sacrificed in a futile effort to prevent video content from leaking to the darknet. And the cost is high. As just one example, nearly all of us will have to discard our PC’s monitors and buy new ones to take advantage of new features that Microsoft could provide – more easily and at lower cost – on our existing monitors, if Hollywood would only allow it.

There can be little doubt that Microsoft is doing this because Hollywood demands it; and there won’t be much doubt among independent security experts that none of these compromises will make a dent in the availability of infringing video online. Law-abiding people will be paying more for PCs, and doing less with them, because of the Hollywood-decreed micromanagement of graphics system design.