5 ms·

As someone who isn't in the jailbreaking space I don't really know what this means. Can you sign your own PS5 code and run it on the hardware?

_notreallyme_ 5y ago
No, signing is done with asymmetric keys. Someone sign with their private key so you can verify it with their public key, basically. Symmetric keys are used to encrypt the code for updates, generally to prevent unintentional leak of secrets or just to prevent reverse engineering. I'm not in the jailbreaking space, but I guess that what it means here is that some people may find flaws in the code and leverage them to potentially bypass the signature verification, although this might prove very difficult to do. It might also help emulating the PS5 behavior which in turns could lead to some modding/cheating for some games. Who knows ?
- qwerty456127 5y ago
  I hope they also get the asymmetric keys once. I'll buy the thing then. I'm not buying hardware I can't patch to have root access and run custom firmwre on.
  - mabbo 5y ago
    It's almost certainly impossible. With symmetric encryption, both the encryptor and decryptor need a copy of the same key- that's what makes it 'symmetric'. But with asymmetric encryption, the keys do not match. This means you can encrypt or sign the data with your private key, and then keep it private. The matching pubic key will decrypt or verify. The device would not have a copy of the private key in it, so it's unlikely it will ever leak.
    - qwerty456127 5y ago
      I know but everything is likely to leak sooner or later.
    - brokenmachine 5y ago
      PS5 is too attractive a target, anyone who cracks it will be etched in history forever. The hackers will come up with a workaround, they always do. I eagerly await the 33c3 presentation.
politelemon 5y ago
These keys are symmetric, so they can be used for decryption. With these symmetric keys you might be able to decrypt games, videos, save files etc sitting on the disk. I don't believe signing will be possible, nobody uses symmetric keys for signing games. What this does is increase the possibility of someone finding how to bypass the signature verification check and then running their own code.
- wizardofdos 5y ago
  Why don't they use asymmetric keys for everything?
  - Nursie 5y ago
    Because we don't generally use asymmetric keys for much data encryption. The operations are (IIRC) comparatively computationally expensive.
    - oleganza 5y ago
      First of all, we are talking about on-device decryption, so there is no difference in terms of security whether people extract a symmetric secret key or an asymmetric secret key. Secondly, yes, asymmetric encryption is slower, so you almost always use hybrid scheme: asymmetric scheme (ElGamal, for instance) for encrypting the symmetric key, and then a symmetric scheme (e.g. AES) for the bulk of the data. Only in very exotic protocols such as digicash blind signatures or anonymous credentials with "algebraic MACs", you want your actual content encrypted directly via ElGamal or RSA, so that you can do some operations or proofs about the ciphertext — in those cases you can't encrypt symmetrically as that would erase all the algebraic relations.
      - Nursie 5y ago
        > First of all, we are talking about on-device decryption, so there is no difference in terms of security whether people extract a symmetric secret key or an asymmetric secret key. Sure, but we might (potentially) be interested in the encryption part later on too, and having a symmetric key will make that easier (though of course it won't get you past any signature checks. I've never come across those more exotic protocols, but I'm familiar with symmetric kex under public/private encryption.
isaacfrond 5y ago
Does this mean I can buy a PS5 now?
- ralusek 5y ago
  Absolutely not

_notreallyme_ 5y ago

No, signing is done with asymmetric keys. Someone sign with their private key so you can verify it with their public key, basically. Symmetric keys are used to encrypt the code for updates, generally to prevent unintentional leak of secrets or just to prevent reverse engineering. I'm not in the jailbreaking space, but I guess that what it means here is that some people may find flaws in the code and leverage them to potentially bypass the signature verification, although this might prove very difficult to do. It might also help emulating the PS5 behavior which in turns could lead to some modding/cheating for some games. Who knows ?

qwerty456127 5y ago
I hope they also get the asymmetric keys once. I'll buy the thing then. I'm not buying hardware I can't patch to have root access and run custom firmwre on.
- mabbo 5y ago
  It's almost certainly impossible. With symmetric encryption, both the encryptor and decryptor need a copy of the same key- that's what makes it 'symmetric'. But with asymmetric encryption, the keys do not match. This means you can encrypt or sign the data with your private key, and then keep it private. The matching pubic key will decrypt or verify. The device would not have a copy of the private key in it, so it's unlikely it will ever leak.
  - qwerty456127 5y ago
    I know but everything is likely to leak sooner or later.
  - brokenmachine 5y ago
    PS5 is too attractive a target, anyone who cracks it will be etched in history forever. The hackers will come up with a workaround, they always do. I eagerly await the 33c3 presentation.

politelemon 5y ago

These keys are symmetric, so they can be used for decryption. With these symmetric keys you might be able to decrypt games, videos, save files etc sitting on the disk. I don't believe signing will be possible, nobody uses symmetric keys for signing games. What this does is increase the possibility of someone finding how to bypass the signature verification check and then running their own code.

wizardofdos 5y ago
Why don't they use asymmetric keys for everything?
- Nursie 5y ago
  Because we don't generally use asymmetric keys for much data encryption. The operations are (IIRC) comparatively computationally expensive.
  - oleganza 5y ago
    First of all, we are talking about on-device decryption, so there is no difference in terms of security whether people extract a symmetric secret key or an asymmetric secret key. Secondly, yes, asymmetric encryption is slower, so you almost always use hybrid scheme: asymmetric scheme (ElGamal, for instance) for encrypting the symmetric key, and then a symmetric scheme (e.g. AES) for the bulk of the data. Only in very exotic protocols such as digicash blind signatures or anonymous credentials with "algebraic MACs", you want your actual content encrypted directly via ElGamal or RSA, so that you can do some operations or proofs about the ciphertext — in those cases you can't encrypt symmetrically as that would erase all the algebraic relations.
    - Nursie 5y ago
      > First of all, we are talking about on-device decryption, so there is no difference in terms of security whether people extract a symmetric secret key or an asymmetric secret key. Sure, but we might (potentially) be interested in the encryption part later on too, and having a symmetric key will make that easier (though of course it won't get you past any signature checks. I've never come across those more exotic protocols, but I'm familiar with symmetric kex under public/private encryption.

isaacfrond 5y ago

Does this mean I can buy a PS5 now?

ralusek 5y ago
Absolutely not