Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

ottverse.com

Post reply on HN
Print view View original

21–30 of 50 posts

Re: EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

#21

Post by brigade »

kevingadd wrote: post #20
brigade wrote: post #13

Earlier quoted context omitted.

For HD, you'd also need a valid vendor-signed key to do the key exchange (which would get swiftly revoked once public), and/or to crack the trusted execution environment.

This isn't true. Multiple Google devices have had their Widevine keys leaked/recovered and Google has waited around before revoking them since it would break hardware playback on the device or cause other issues. The Nexus 6, for one, has been downgraded from Widevine L1 to L3 as a result.

I guess I'm sort of surprised that a unique key per device isn't common yet...

Re: EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

#22

Post by raxxorrax »

kmeisthax wrote: post #11
young_unixer wrote: post #4

So, the only thing stopping a user from obtaining a clean copy of the content is the fact that the CDM is closed source? What if a CDM vendor leaked the source code? I guess the DRM server would block them after a while, but before they notice, the user would have free access to the content, right?

The primary purpose of content encryption tools is to trigger DMCA 1201 anti-circumention provisions to prohibit people from writing decryption tools. Nothing more and nothing less. All DRM schemes are a form of obfuscation; some particularly secure ones use hardware decoding enclaves not present on desktops that are harder to crack, but that's about it. The only practically useful DRM schemes are ones where any tool…

Does the term marketing encompass open source software? Microsoft thinks so, but is that legally confirmed?

It could be argued that DRM is an inconvenience or does the manufacturer determine that?

Re: EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

#23

Post by svenpeter »

grishka wrote: post #10
ponderingfish wrote: post #8

Earlier quoted context omitted.

Exactly - which is why the CDM is a contentious topic because you have no way to see what's inside it. Also, technologies such as HDCP, Trusted Execution Environment prevent the decrypted and decoded frames from being leaked. At least, that's the intention. And the CDM vendors are Google, MSFT, and Apple. There's no way they are going to leak their code :) What's really strong is the rotation of decryption keys. Cont…

IMO it isn't that hard to crack a DRM system. My understanding is that most of the protections are legal, not technical, as in, if you do it, they'll sue the hell out of you and win.

Yeah, there are many trivial systems out there that mostly provide legal protection. But there are also some pretty sophisticated DRM systems that are technologically quite well implemented and take a large effort to break. BD+ is one of these for example.

And maybe going to platforms where the whole hardware is specialized is not what most people have in mind when they think DRM but the basic building blocks are similar. Microsoft's "Guarding Against Physical Attacks: The Xbox One Story" talk is also one of the few examples I know of where a manufacturer explains how they implemented such a system. [1]

[1] https://www.platformsecuritysummit.com/2019/speaker/chen/

Re: EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

#24

Post by throw0101a »

kmeisthax wrote: post #11
young_unixer wrote: post #4

So, the only thing stopping a user from obtaining a clean copy of the content is the fact that the CDM is closed source? What if a CDM vendor leaked the source code? I guess the DRM server would block them after a while, but before they notice, the user would have free access to the content, right?

The primary purpose of content encryption tools is to trigger DMCA 1201 anti-circumention provisions to prohibit people from writing decryption tools. Nothing more and nothing less. All DRM schemes are a form of obfuscation; some particularly secure ones use hardware decoding enclaves not present on desktops that are harder to crack, but that's about it. The only practically useful DRM schemes are ones where any tool…

> The primary purpose of content encryption tools is to trigger DMCA 1201 anti-circumention provisions to prohibit people from writing decryption tools.

What if those tools are hosted outside of the US where the DMCA has to force?

Certainly the US is a larger centre of gravity when it comes to tech, but it's not the only place.

Re: EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

#25

Post by MaxBarraclough »

ponderingfish wrote: post #8
young_unixer wrote: post #4

So, the only thing stopping a user from obtaining a clean copy of the content is the fact that the CDM is closed source? What if a CDM vendor leaked the source code? I guess the DRM server would block them after a while, but before they notice, the user would have free access to the content, right?

Exactly - which is why the CDM is a contentious topic because you have no way to see what's inside it. Also, technologies such as HDCP, Trusted Execution Environment prevent the decrypted and decoded frames from being leaked. At least, that's the intention. And the CDM vendors are Google, MSFT, and Apple. There's no way they are going to leak their code :) What's really strong is the rotation of decryption keys. Cont…

> the CDM vendors are Google, MSFT, and Apple

Also Adobe, although I'm not sure if their CDM (Adobe Primetime) is still relevant.

> which is why the CDM is a contentious topic because you have no way to see what's inside it

Related to this: Firefox takes steps to try to contain the CDM blob within a sandbox. [0] See also this old blog post from before Firefox switched from Adobe's CDM to Google's WideVine CDM. [1]

[0] https://wiki.mozilla.org/Security/Sandbox/Architecture#GMP_p...

[1] https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...

Re: EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

#26

Post by grishka »

svenpeter wrote: post #23
grishka wrote: post #10

Earlier quoted context omitted.

IMO it isn't that hard to crack a DRM system. My understanding is that most of the protections are legal, not technical, as in, if you do it, they'll sue the hell out of you and win.

Yeah, there are many trivial systems out there that mostly provide legal protection. But there are also some pretty sophisticated DRM systems that are technologically quite well implemented and take a large effort to break. BD+ is one of these for example. And maybe going to platforms where the whole hardware is specialized is not what most people have in mind when they think DRM but the basic building blocks are sim…

Thanks for linking this talk, it was indeed interesting. Especially the part where he said that "if the hack costs more than 10 games, we're fine". Indeed, you probably aren't breaking this thing unless you have millions of dollars worth of equipment and the expertise to use it.

But then video game consoles are special. They were always these closed, tightly-controlled ecosystems. General-purpose devices, like phones and computers, typically lack this kind of integration between their components. Yes, there's ARM TrustZone, and that's about it. Thankfully. And I'm not aware of anything similar on x86 PCs (besides the Apple T2, which was recently compromised).

Re: EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

#28

Post by bitwize »

marcan_42 wrote: post #9
young_unixer wrote: post #4

So, the only thing stopping a user from obtaining a clean copy of the content is the fact that the CDM is closed source? What if a CDM vendor leaked the source code? I guess the DRM server would block them after a while, but before they notice, the user would have free access to the content, right?

It's security through obscurity. For pure software stuff, like Widevine L3, you can just patch the browser or insert a shim to spit out the decrypted video somewhere. https://github.com/artemist/widevineproxy

Illegal to distribute under the DMCA.

Re: EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

#29

Post by kmeisthax »

throw0101a wrote: post #24
kmeisthax wrote: post #11

Earlier quoted context omitted.

The primary purpose of content encryption tools is to trigger DMCA 1201 anti-circumention provisions to prohibit people from writing decryption tools. Nothing more and nothing less. All DRM schemes are a form of obfuscation; some particularly secure ones use hardware decoding enclaves not present on desktops that are harder to crack, but that's about it. The only practically useful DRM schemes are ones where any tool…

> The primary purpose of content encryption tools is to trigger DMCA 1201 anti-circumention provisions to prohibit people from writing decryption tools. What if those tools are hosted outside of the US where the DMCA has to force? Certainly the US is a larger centre of gravity when it comes to tech, but it's not the only place.

DMCA 1201 is not an American law, it's just the American implementation of the anti-circumvention provisions of the WIPO Copyright Treaty. It exists in the EU (ISD Article 6), at the least. Given that the underlying treaty has 95 parties to it you're probably going to have to go deep into the third world to find a hospitable jurisdiction willing to host circumvention tools.

Re: EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

#30

Post by kmeisthax »

raxxorrax wrote: post #22
kmeisthax wrote: post #11

Earlier quoted context omitted.

The primary purpose of content encryption tools is to trigger DMCA 1201 anti-circumention provisions to prohibit people from writing decryption tools. Nothing more and nothing less. All DRM schemes are a form of obfuscation; some particularly secure ones use hardware decoding enclaves not present on desktops that are harder to crack, but that's about it. The only practically useful DRM schemes are ones where any tool…

Does the term marketing encompass open source software? Microsoft thinks so, but is that legally confirmed? It could be argued that DRM is an inconvenience or does the manufacturer determine that?

It's relative to the behavior of whoever is providing the software. So, if I make a page with an OBS download on it entitled "DOWNLOAD ALL MUSIC OFF YOUTUBE FOR FREE", then I'm violating DMCA 1201. But OBS itself isn't illegal - just my particular actions.
Post reply on HN