3 ms·
The DRM module could be on a separate bit of memory from the actual OS, meaning that it would stay upgraded even if the rest was downgraded. It doesn't use fuse
by krageon 6y ago
The DRM module could be on a separate bit of memory from the actual OS, meaning that it would stay upgraded even if the rest was downgraded. It doesn't use fuses (AFAIK anyway), but f.e. the baseband on your phone works like this.
- Hackbraten 6y agoWouldn’t the decrypted stream still have to go through the actual OS’s main memory?
- xg15 6y agoIsn't this effectively what a TPM is? But I think this only works to an extent as, if you want your DRM not be trivially circumventable, it will be a cross-cutting concern and not easily restricted to a module. E.g., the most secure TPM is useless if the OS simply ignores any responses and shows the movie anyway. What you could do is to close off the whole media path: The OS only sees the encrypted media, which it sends to some combined TPM/decoding hardware, which more or less sends it directly to the screen. I believe to some extent this is what is done in practice. You could technically see the TPM/graphics card/screen assembly as a "module" and can keep the OS separate of it - but this risks your "module" becoming so essentiall that it'll be unclear what is the dog and what is the tail.