How the Dreamcast Copy Protection Was Defeated

> SEGA engineers knew that MIL-CD booting could be used as an attack vector so they added a protection.

> The mashed potatoes problem was solved when a Katana SDK (the official Sega SDK for the Dreamcast) was stolen[6] by the hacking team "Utopia" in late 1999. It turned out that the scrambler was nothing more than "security through obscurity".

I doubt this was security through obscurity. Most likely, it was hard (or impossible) to burn a GD-ROM for internal testing. Thus, this mechanism was probably used to burn games onto CDR for internal testing.

I haven't seen anything that explains how scrambling and descrambling work; but it's important to understand that, at a certain level, all encryption is "security by obscurity." It just comes down to how easy or hard it is to figure out how to bypass. In this case, hacking to get ahold of the scrambler is no different than getting ahold of the private part of a key pair.

Edit:

> SEGA quickly released a DC v2 which disabled MIL-CD altogether but unfortunately damage had been done. With revenues plummeting and the PS2 ogre coming out, developers abandoned the Dreamcast and SEGA retired from the hardware manufacturing business in order to focus on software.

I also wonder if disabling this system was "the straw that broke the camel's back?" If I were a developer and it suddenly became much harder to test, I'd probably think very critically if it's "worth it" to jump through so many hoops for such a small market.

There was an active Usenet news group for Dreamcast binaries and that would have almost all content available.

> Even though the Dreamcast had similar or better specs than the PS2 it wasn’t considered a real 3D platform by a lot of the game magazine critics.

Wat? That sounds like you confused the Saturn and DC. The Saturn had iffy hardware choices for 3D (because nobody saw the PlayStation coming), but the DC was a 3D system through and through. I don't recall anyone at the time claiming otherwise.

> I haven't seen anything that explains how scrambling and descrambling work; but it's important to understand that, at a certain level, all encryption is "security by obscurity." It just comes down to how easy or hard it is to figure out how to bypass. In this case, hacking to get ahold of the scrambler is no different than getting ahold of the private part of a key pair.

This isn’t true at all. There is a very significant fundamental difference between obscure information and secret information. Obscure information is by its nature known to many people. There are likely hundreds (if not thousands) of engineers who had access to the code or design documents that describe the scrambler. Information about it was probably given to sales people and representatives at other companies, and transmitted insecurely over a variety of communication mediums. Compare that to secret information, which is known only to the parties using it to authenticate.

Perhaps you could argue that in this case, security by obscurity was not the reason that the system failed, but that isn’t the same as saying all encryption isn’t security by obscurity.

Uhh, CDs were of high quality and burners were cheap, easy to use, fast and reliable.