Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GPU, not the TPM, is the root of hardware DRM

mjg59.dreamwidth.org

Post reply on HN
Print view View original

111–120 of 493 posts

Re: The GPU, not the TPM, is the root of hardware DRM

#111

Post by AnthonyMouse »

jsheard wrote: post #79
soerxpso wrote: post #61

Earlier quoted context omitted.

It doesn't matter at all how out of reach it is for most people. As long as one kid in Russia can do it, the torrent is available for everyone in the world just as soon. This has already been shown with videogame DRM like Denuvo. It's so hard to crack that only a handful of people know how, and yet they end up racing eachother so eagerly every time a new game comes out that it's usually done in under 24 hours. Unless…

Denuvo has pulled back into the lead lately, it's taking a very long time for cracks to appear, if they ever do. For example Dragons Dogma 2 came out in March and still hasn't been cracked. Avatar: Frontiers of Pandora hasn't been cracked for a full year.

Active player counts:

  Minecraft: ~185,000,000
  World of Warcraft: ~7,250,000
  Dragons Dogma 2: ~4000
This seems more along the lines of nobody bothers to crack games nobody wants to play.

Re: The GPU, not the TPM, is the root of hardware DRM

#112

Post by jsheard »

Retr0id wrote: post #104
jsheard wrote: post #100

Earlier quoted context omitted.

They wouldn't necessarily need to serve different data to each client when they control the whole playback stack, they could get clever by including duplicate frame data with subtle differences and making each device key only able to decrypt one of the variants. Repeat that throughout a show to add additional bits to the signature until it's uniquely identifiable.

But they don't control the playback stack, once the attacker has the keys. The attacker brings their own stack, decrypting the data with their own software.

That doesn't help the attacker if their key can only decrypt the subset of frames which Netflix wants them to be able to decrypt.

Re: The GPU, not the TPM, is the root of hardware DRM

#113

Post by wmf »

zb3 wrote: post #15

> GPU vendors have quietly deployed all of this technology Citation or technical details needed. Obviously it "makes sense" that for 4K HD content you "probably" want to offload the decoding into the GPU, but this is the first time I see this mentioned and there are no links to technical details. In contrast, TEE / TrustZone and even the recent AVF with pVM - these are well documented technologies.

https://en.wikipedia.org/wiki/Protected_Media_Path

https://learn.microsoft.com/en-us/windows/win32/medfound/pro...

Re: The GPU, not the TPM, is the root of hardware DRM

#114

Post by wmf »

zb3 wrote: post #19
zb3 wrote: post #15

> GPU vendors have quietly deployed all of this technology Citation or technical details needed. Obviously it "makes sense" that for 4K HD content you "probably" want to offload the decoding into the GPU, but this is the first time I see this mentioned and there are no links to technical details. In contrast, TEE / TrustZone and even the recent AVF with pVM - these are well documented technologies.

Integrated GPUs exist. Wouldn't it make more sense that the "high value" content should not be exposed to any external GPU? Then we can treat those integrated ones as part of the "TEE". That's my speculation, waiting for details.

You can't give a worse experience to people who paid more for a better GPU.

Re: The GPU, not the TPM, is the root of hardware DRM

#115

Post by jsheard »

AnthonyMouse wrote: post #111
jsheard wrote: post #79

Earlier quoted context omitted.

Denuvo has pulled back into the lead lately, it's taking a very long time for cracks to appear, if they ever do. For example Dragons Dogma 2 came out in March and still hasn't been cracked. Avatar: Frontiers of Pandora hasn't been cracked for a full year.

Active player counts: Minecraft: ~185,000,000 World of Warcraft: ~7,250,000 Dragons Dogma 2: ~4000 This seems more along the lines of nobody bothers to crack games nobody wants to play.

DD2 is a single player game, those generally don't maintain their active player counts forever. It peaked at 228,285 concurrent (not total) Steam players which are pretty good numbers.

Re: The GPU, not the TPM, is the root of hardware DRM

#116

Post by mixmastamyk »

mjg59 wrote: post #107
ntqvm wrote: post #95

The author seems misinformed about the purpose of TPM to DRM schemes. The purpose of a TPM, in this case, is not to provide encryption, but instead to provide so-called ‘authenticity’. A TPM with its attestation capabilities can allow a remote validator to attest the operating system and system software you are running via the PCRs which are configured based on it, with Secure Boot preventing tampering. [1] Google tr…

I'm extremely familiar with the capabilities of TPMs (I've worked on deploying remote attestation services at multiple companies), but here's the thing - streaming vendors don't use TPM-based remote attestation. None of them. It doesn't happen. Could it happen? Yes, but it would buy almost nothing - remote attestation is something that's viable in enterprise environments where you can bind TPM identity to inventory e…

Why is the grandparent dead? Makes an interesting point and am glad I read it and the replies. Please vouch.

Re: The GPU, not the TPM, is the root of hardware DRM

#117

Post by baby_souffle »

Wowfunhappy wrote: post #97
baby_souffle wrote: post #93

Earlier quoted context omitted.

> The end goal is DRM all the way to the screen. No capture cards will be allowed. Sure, but the closer you get to the eye ball, the bigger the loophole is. It's not common anymore, but _way_ back in the day, some releases were made *in the projection booth* with a semi-pro camera on a tripod pointed at the screen. (look for old NFO files with `TS` or `TeleSync` in them to get an idea of when this was common-ish) The…

> The analogue loophole will remain open until there's a HDMI to optical nerve technology that we're all forced to get at birth. This is kind of a pointless tangent, but you might not have to go that far. It's probably hard to get a recording of the Apple Vision Pro for instance.

> It's probably hard to get a recording of the Apple Vision Pro for instance.

I hadn't actually thought about that! For 99.995% of my time on this earth, "screen" meant "flat, glass, viewed from some distance". I guess it's time to spend some time thinking about what new ways to exploit the analogue loophole are...

I wonder which part would be harder: designing something to fool the "am I on a head? Where are the eye balls looking?" bits or the optics needed to re-combine the stereo?

Re: The GPU, not the TPM, is the root of hardware DRM

#118

Post by wtallis »

jsnell wrote: post #69
quikthrowaway wrote: post #44

Earlier quoted context omitted.

They don't sell hardware, but they get paid when their hardware partners sell you a new laptop with Windows on it.

Ok, so the theory is that Microsoft is after the revenue from Windows 11 licenses? And the way they're achieving this is by forcing people who want to upgrade from Windows 10 to buy a new machine rather than install Windows 11 on their existing machines? If that was the motivation, there's a far more direct option available. Just charge for the upgrade. For this theory to work, it would have to be that there's a sign…

> If that was the motivation, there's a far more direct option available. Just charge for the upgrade.

That's a far more direct option, which also largely doesn't work. Corporate IT doesn't like doing in-place major OS upgrades. Consumers just plain won't, unless it's free and easy.

Re: The GPU, not the TPM, is the root of hardware DRM

#119

Post by mjg59 »

bri3d wrote: post #91
mjg59 wrote: post #23

Earlier quoted context omitted.

The Playready docs make it clear the implementation is either in TEE or implemented in GPU hardware, and x86 has no TEE, so. You can easily find driver changelogs describing it being enabled for different hardware generations.

> x86 has no TEE Not really; AMD have PSP (which, okay, isn’t x86, but it’s on the die) and Intel, as you mention in your post, had SGX and have ME. Google use PSP TrustZone to run Widevine on Chromebooks, for example. PowerDVD used SGX to decrypt BluRay, which led to BluRay 4K content keys being extracted via the sgx.fail exploit. You’re right though that PlayReady is usually GPU based on x86; on AMD GPUs PlayReady…

My fault, I meant x86 has no architectural TEE - various vendors offer their own weird things. But thanks, this is good clarification.

Re: The GPU, not the TPM, is the root of hardware DRM

#120

Post by mjg59 »

saxonww wrote: post #87
zb3 wrote: post #19

Earlier quoted context omitted.

Integrated GPUs exist. Wouldn't it make more sense that the "high value" content should not be exposed to any external GPU? Then we can treat those integrated ones as part of the "TEE". That's my speculation, waiting for details.

This is the question I had about this. The reason this design works per the article is that the GPU memory is inaccessible to the OS, so the decrypted content cannot be stolen. With a unified memory architecture, is the shared GPU memory inaccessible to the CPU?

Yes, the memory controller can simply deny accesses to specific areas from the CPU while still permitting them from the GPU.
Post reply on HN