Schneier on Security

Clive Robinson • September 17, 2010 3:15 PM

As I noted to Randall’s original post ( http://www.schneier.com/blog/archives/2010/09/dhs_still_worri.html#c461802 ) there are two issues involved,

1, You can become an HDMI data source or sink.
2, You can get the secret key of the wire as it’s negotiated between a source and sink.

The first option will require some custom hardware but I realy don’t think a custom chip and maybe not even an FPGA (the logic is not that hard).

the second issue requires no custom hardware just the rental/ purchase of the appropriate test equipment to pull the data of the wire onto an HD or other media. Once the key is known it’s game over.

You can then transcode the data to another format and also re-encrypt it for your particular HDMI monitor/sound system with little difficulty.

Thus the Intel spokes person was either ill-informed or makeing a false statment.

The problem with making such a silly false statment is it will now be bait to old fashioned hackers to prove him wrong and they will a lot lot faster than otherwise would have happened (Think back to the NSA and DES which prompted the DES Cracker hardware project)

Are the media owners actually that concerned wel to be honest I don’t think so. They now have been given the excuse to go to HDCP2 or whatever with the latest generation tech and the industry will follow along quite happily as will many consumers.

We saw with DeCSS the actual loss to the industry was so small it would probably cost more to calculate it. This was because DeCSS was very late to the party when it came to cracking DVD’s.

As long as whatever offline content protection lasts for a couple of technology generations the media owners will not realy care, they might mouth off about it but they know their bottom line will be better for having to go with “new improved technology”. All the fuss they will create is effectivly an excuse to con more money out of you one way or another.

The simple fact is Off Line Content Protection with Retail Media is always going to be broken it is just getting past the physical barriers that stops it happening faster. And the media owners (should) know this.

If their bottom line was realy going to be effected then they would switch to an Online Media solution which could be made as secure as required.

Clive Robinson • September 17, 2010 9:23 PM

@ Bruce (),

“No disrespect, but I’m not sure about this statement from Clive”

Fair comment, I worded it badly (that’s the trouble with trying to sum it up in a single sentance).

DVD’s have been ‘ripped’ since just about day one, one way or another in some cases by simply taking the video output and re-encoding it. Others by plain duplication after modification to the writer, and later by hacks to various DVD playing software on PC’s (one of which is where DeCSS came from) again by getting at the decoded video.

DeCSS arived after other techniques where fairly well entrenched with those ripping “for profit” as oposed for “personal use”. The International Intellectual Property Aliance (IIPA) wrote a report about Hong Kong etc and DVD ripping (google for rbc_hong_kong_301_99 )

The Big use for the DeCSS process and program originaly was (and still is ) the home user running *nix for which the media owners had little time. Later to transcode to other much better codecs to put DVD’s onto various personal media players.

Jim Cardwell of Warner Home Video more or less said just this when interviewed on CNN’s “Showbiz Today” back in Jan 2000 ( http://edition.cnn.com/TRANSCRIPTS/0001/11/st.00.html ),

“We expected the source code to be broken. We were surprised it wasn’t broken earlier. We believe there is no economic incentive to hack this product. The cost of the blank is more expensive than the cos of the finished product, and the amount of time it takes to download is several hours. There’s no real economic incentive for anyone to hack this product.”

A big part of DeCSS was the fact that media owners where not interested in *nix and this stuck in some peoples craw so a German coder reversed engineered a DVD software player running under MS Windows to find out just how CSS worked and to get at some of the keys.

Although there where rumours in some places that MS did a tied deal with the media owners not to allow *nix DVD players, I have not seen evidence of this (but then if MS did do it I’m sure they would be very careful after other legal runnins they had had 😉

Clive Robinson • September 21, 2010 5:40 PM

@ o.s.,

“Any algorithm implemented with hardware can be implemented with software. I see no reason HDCP can’t be emulated in software.”

I assume you mean “determanistic algorithm”?

The real issue of software -V- hardware is generaly one of speed, the software is frequently several orders of magnitude slower.

But speed is not of necessity important even in the “inline” case as the purpose is to discover the secret key which as it’s a function of both the source and sink nodes “secrets” once known it can (if the hardware alows) be injected into existing hardware…

Likewise provided you have a storage system capable of keeping up with the data rate then no mater how slow the software emulation of the hardware is it will unlock (eventualy) the secret.

As I originaly said the Intel spokes person was either ill informed or making a false statment.

As has been noted by others a “HDCP stripper” could be made of first or second generation chip sets either unintentionally (as in a splitter box) or by deliberate design.

HDPC is effectivly “point to point” (node to node) not “end to end” encryption, which means the nodes have to have “plain text” in them. Thus if you can “probe out” the node there is a chance you will get access to the “plain text” (although it sounds easy in practice it may well not be).

However it is all fairly immaterial as the “Pirates” will have little interest in stripping HDCP as their business model and thus their methodology is different.

As has been noted HDCP is in reality little to do with security and a lot to do with licensing revenue…