Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GPU, not the TPM, is the root of hardware DRM

mjg59.dreamwidth.org

Post reply on HN
Print view View original

421–430 of 493 posts

Re: The GPU, not the TPM, is the root of hardware DRM

#421

Post by notpushkin »

nine_k wrote: post #368
notpushkin wrote: post #310

Earlier quoted context omitted.

The DRM doesn’t really make pirating any more inconvenient for the (pirate) consumers (they get e.g. an MKV file without any of it). If there was no DRM on the legal platforms, it would be easier for pirates to release new stuff, but just marginally so. If there was no DRM, ordinary viewers would still choose Netflix over torrents, and perhaps some more tech-savvy users would choose it as well (since many do want to…

No, with DRM, you can't make and sell a player that allows to skip ads, ignore regional limitations, etc. If you do, your key is revoked. Pirating high-res videos already requires special hardware to remove HDCP. It's cheap now because HDCP is notoriously weak. A future standard may start needing a $500 device, or even a $5000 one.

> No, with DRM, you can't make and sell a player

Is it still relevant nowadays? I thought most people just went to online streaming, and you don’t need DRM to enforce all that stuff there.

> Pirating high-res videos already requires special hardware to remove HDCP.

That is true, and a new standard might make it harder for a few years, but:

1. The switch won’t happen overnight, which means pirates would still use HDCP while working on the new one.

2. It’s possible to make piracy prohibitively expensive, but the standard would have to be really really complex. Like, “putting hidden watermarks with display serial number on the stream and revoking keys just for that display” kind of complex. I don’t think it’s feasible.

Re: The GPU, not the TPM, is the root of hardware DRM

#422

Post by shmerl »

snvzz wrote: post #183
CamperBob2 wrote: post #5

Earlier quoted context omitted.

DRM shouldn't be illegal, but works protected by DRM should be ineligible for copyright protection unless a key is placed in escrow somewhere. Basically, rightsholders should be be able to choose enforceable legal protection or unbreakable technological protection, but not both. Copyright was supposed to be a two-way street, but DRM permanently barricades one lane.

>should be be able to choose enforceable legal protection or unbreakable technological protection No. The latter would effectively mean rightsholders make their own laws, rather than follow the law. DRM should simply be abolished, as it interferes with the premise of copyright: To grow the public domain.

The point is that they are already effectively making their own laws through DMCA 1201 being a loophole that allows them to negate constitutional rights and fair use. So making DRM void copyright would be still an improvement over current status quo.

But I agree, DRM should just be illegal in the first place.

Re: The GPU, not the TPM, is the root of hardware DRM

#423

Post by fc417fc802 »

lxgr wrote: post #416
fc417fc802 wrote: post #414

Earlier quoted context omitted.

By that same logic evil is not inherent to attested bootchains either. When used to verify that the computer loaded the OS that the end user expected it is a very powerful security tool. It is only bad when the keys aren't under the control of the device owner.

You're mixing up the authentication and attestation parts of secure boot here. You can absolutely install Linux, run secure boot (e.g. to protect you against "evil maid attack"), use your TPM to store your SSH keys, and live a happy and attestation-free life. You can also do other things, but if you don't want to, why would you?

[dead]

Re: The GPU, not the TPM, is the root of hardware DRM

#425

Post by [deleted] »

rustcleaner wrote: post #315
mike_hearn wrote: post #173

Earlier quoted context omitted.

No, the GPUs have their own hardware RoT that measures the firmware. Modern GPUs are basically parallel computers with their own RAM, bootup sequence, BIOS, operating systems (drivers and firmware together are basically an OS), compiler toolchains, debuggers, sub-drivers and so on.

One which needs to be opened to users/owners instead of locked away. A price-doubling 100% sales tax on Universal Machines which lock owners out like with video cards (and their firmware), should make products which are not fundamentally significantly GNU-ideals friendy unaffordable to the average consumer (and therefore not economically viable anymore). Siemens can still sell their $5MM machine for $10MM to BASF or…

[deleted]

Re: The GPU, not the TPM, is the root of hardware DRM

#426

Post by lxgr »

Suggestion for a compromise: Make it mandatory for TPM vendors to provide a user option to wipe all attestation keys and rebrand them as “embedded security keys” (and maybe promise to never use them for DRM, which per TFA nobody is anyway).

I feel like untangling the attestation capability (which I do believe has non-user-hostile/non-zero-sum uses!) from the secure key storage one might ultimately help their adoption.

Re: The GPU, not the TPM, is the root of hardware DRM

#427

Post by fc417fc802 »

lxgr wrote: post #420
fc417fc802 wrote: post #417

Earlier quoted context omitted.

I am fully aware of what a TPM is. I was speaking about trusted computing - ie the "general purpose attestation capability" that you referred to above. As you say, a TPM alone can't do much of anything and doesn't pose much of a threat. Of course expanding the acronym - Trusted Platform Module - is a bit of a giveaway. They were always fully intended to serve as the root of trust for much more nefarious things.

People keep saying that, yet the only thing I’ve ever seen TPMs used for is full disk encryption and user authentication. Conversely, DRM is alive and well on almost universally TPM-less devices. By the way, all of your comments in this thread end up dead – I had to vouch for them to be able to answer. Not sure what’s up with that.

> the only thing I’ve ever seen TPMs used for is full disk encryption and user authentication.

Aren't all device attestation schemes underpinned by authenticated boot which itself is underpinned by a TPM? This is certainly the case for Android - AVB is implemented on top of secure boot on all the devices I've ever owned (and Play Integrity, if I had ever permitted it to run, on top of that). Do I have some misunderstanding about the stack?

> Conversely, DRM is alive and well on almost universally TPM-less devices.

You mean software DRM I assume? Because the only TPM free hardware backed DRM that comes to mind is GPU based encrypted streams where the GPU does the decoding and final compositing locally. And even then the TPM-equivalent exists, it just isn't accessible to the end user.

SGX can be used to do various interesting things without attesting the state of the broader system, but none of the examples that immediately come to mind feel much like DRM to me.

> comments in this thread end up dead

Thanks for letting me know. I guess I should email them?

Re: The GPU, not the TPM, is the root of hardware DRM

#428

Post by fc417fc802 »

hex4def6 wrote: post #359
TacticalCoder wrote: post #301

Earlier quoted context omitted.

> the future for personal computing is looking grim I don't know. They could lock up the hardware stack as much as they want, in the end it's pixels being pushed to arrays. It's extremely hard to prevent these pixels from being intercepted. You'll have pirate groups just going deep in the hardware (opening the monitors and soldering and hacking and whatnots) and eventually tap these. As for personal usage: I've got h…

I'm not so optimistic. Yes, you can never "plug the analog hole" completely, but you can definitely lock stuff down to the point it's impractical for 95% of people. For instance, imagine some sort of audio / video fingerprint system that resides in Intel and/or nVidia's GPU drivers. Content gets played through the on-GPU HEVC / h.264 decoders already. Doesn't seem like a huge stretch to add a fingerprint authenticati…

[dead]

Re: The GPU, not the TPM, is the root of hardware DRM

#429

Post by argomo »

mike_hearn wrote: post #383
no_time wrote: post #377

Earlier quoted context omitted.

>Some remote servers won't give you service if you do that This is exactly my problem. Before ideas like this surfaced, the demarcation line between who controls what was purely based on ownership. The machine that I own acts only on my behalf and in my best interests, the server that you own does so for you (or atleast for PCs this has always been the case) TPMs, attested bootchains and whatnot trample on this whole…

It's not just you but what people who hate remote attestation tend to forget is that it's a sword that cuts in both directions. Servers can remotely attest to you, not just the other way around. Signal is an example of an app that demands a remote attestation from the server before uploading your sensitive data. Attestation is just a tool. It can be used for all kinds of things and doesn't privilege one side or anoth…

> Attestation is just a tool. It can be used for all kinds of things and doesn't privilege one side or another.

It priveleges the side that designs and uses it. By and large that's going to be the corporations, not individuals or those acting to maximize their interest.

Re: The GPU, not the TPM, is the root of hardware DRM

#430

Post by fc417fc802 »

majormajor wrote: post #10
MadnessASAP wrote: post #4

I have to wonder A) What does DRM realistically accomplish for the media companies? And, B) How are these DRM schemes actually being defeated? I do occasionally don my pirate hat* and have never had an issue finding what I want at the quality I want within an hour of a episode/movie being released to streaming. That would seem to indicate that these efforts at DRM are actually failing to have any noticeable effect at…

DRM has likely had a big impact in shifting the casual consumer conversation to "hey they're gonna start down on account sharing" from early-2000s style "here's a straight-up copy I made for you." And this helps prop up the "they'll get a Netflix account to binge the same three shows over and over" part of the business model. The cumulative monthly cost adds up but it feels cheaper than forking over a few hundred buc…

[dead]
Post reply on HN