4 ms·

To look at this another way it took 10 years for this crack to be feasible. Not many content protection systems can say that they have stood the test of time fo

To look at this another way it took 10 years for this crack to be feasible. Not many content protection systems can say that they have stood the test of time for that long.

ldar15 15y ago
Yes and no. The content was cracked almost immediately. We don't need an HDCP crack to rip blurays, so there wasn't much motivation to go after the pipe. That said, I assume the "crack" was dependent on the key being released in September, which basically demonstrates that these things are uncrackable, and its your key security that's the determining factor. However, the truest part of the article for me was "In the meantime, HDCP continues to bother only a single group of people: those who buy stuff legally."
- keeperofdakeys 15y ago
  In the case of HDCP, the master key wasn't found because of bad key security, but because of the design of the encryption algorithm. The keys are matrices, and given enough keys from devices that use HDCP, you can calculate the master key using matrix algebra.
  - __david__ 15y ago
    Interestingly, the algorithm is apparently the same as the 1394 (FireWire) 5c "restricted authentication" encryption. I assume they have different seeds for their matrices but if you can crack one of them you can crack the other. If only anyone used 1394 any more (let alone 5c over 1394)...
- mortenjorck 15y ago
  What's interesting to me is how the landscape has changed since the early days of non-broadcast HD consumer content, and what this crack might mean for the future of it. In 2006, if you wanted to see a movie at home in HD, you bought a Blu-Ray or HD-DVD player and picked up the movie on disc. If you wanted to attempt to copy it, the disc was clearly the most attractive vector; the pipe would be inefficient. In 2011, however, if you want to see a movie at home in HD, you have several choices, only one of which involves a disc. Netflix, Vudu, Hulu, iTunes, CinemaNow, and others all offer HD content without a physical media vector – if you want to attempt a copy, suddenly your only vector is the pipe.
  - wmf 15y ago
    You could always try cracking whatever DRM those streaming services use; instead of an FPGA all you'd need is a Norwegian teenager, a six-pack of Mountain Dew, and a cracked copy of SoftICE.
- rufugee 15y ago
  However, the truest part of the article for me was "In the meantime, HDCP continues to bother only a single group of people: those who buy stuff legally." AMEN. HDCP is the reason I can't use my large computer monitor to play my PS3 while my wife is using our television...my monitor won't support HDCP, but it does have an HDMI input. Very frustrating.
bryanlarsen 15y ago
For most of those 10 years, HDMI was protected simply via its data rate of 1.8TB/hour. Even today data rate and data size considerations require a RAID-0 array, so it's still out of the grasp of most casual copiers.
- mbell 15y ago
  HDMI is "protected" for the same reason HDCP lasted as long as it did. There was simply a more efficient way to access the data. Also, HDMI's data rate rose to ~3.56 TB/hour in the 1.3 release (circa 2006ish).
  - bryanlarsen 15y ago
    For a good portion of those 10 years, there wasn't a more efficient way to access the data, since it took a while before Blu-Ray and HD-DVD were cracked. Also, the maximum data rate is fairly irrelevant, it's the typical data rate that matters. 1080p60 is 1.34 TB/hour.
    - mbell 15y ago
      This is not correct. "Blu-Ray" was officially released in June 2006, individual title/production house keys were cracked during 2006 and AACS was cracked at its root in the beginning of 2007. Both Blu-Ray and HD-DVD were cracked wide open LONG before either was remotely popular.
      - bryanlarsen 15y ago
        blu-ray continued to be a cat and mouse game for a while after that, utilizing the vm specified by blu-ray.
        buff-a 15y ago
        If by "cat and mouse" you mean "the cat takes a day or two to learn how to find and eat each new type of mouse but having done so immediately eats such mice the instant it appears almost as if the mouse is teleported into the cats mouth" then yes it is. The reality is that the cat always catches the mouse, and engineering new types of mice costs money, so most blurays don't even bother. Its amazing that they bother at all. But if you meant, "a contrived action involving constant pursuit, near captures, and repeated escapes." then, no, I'd completely disagree. Its a pretty straightforward, routine process, guaranteed to end only one way.
Quequau 15y ago
When HDCP first was announced Ed Felten (Director of the Center for Information Technology Policy at Princeton University) described a workable attack vector (which was shortly confirmed) and labeled it so weak that most plausible explanation of its existence as: "only as a hook on which to hang lawsuits" https://freedom-to-tinker.com/blog/felten/hdcp-why-so-weak https://freedom-to-tinker.com/blog/felten/hdcp-why-so-weak

To look at this another way it took 10 years for this crack to be feasible. Not many content protection systems can say that they have stood the test of time for that long.

ldar15 15y ago

Yes and no. The content was cracked almost immediately. We don't need an HDCP crack to rip blurays, so there wasn't much motivation to go after the pipe. That said, I assume the "crack" was dependent on the key being released in September, which basically demonstrates that these things are uncrackable, and its your key security that's the determining factor. However, the truest part of the article for me was "In the meantime, HDCP continues to bother only a single group of people: those who buy stuff legally."

keeperofdakeys 15y ago
In the case of HDCP, the master key wasn't found because of bad key security, but because of the design of the encryption algorithm. The keys are matrices, and given enough keys from devices that use HDCP, you can calculate the master key using matrix algebra.
- __david__ 15y ago
  Interestingly, the algorithm is apparently the same as the 1394 (FireWire) 5c "restricted authentication" encryption. I assume they have different seeds for their matrices but if you can crack one of them you can crack the other. If only anyone used 1394 any more (let alone 5c over 1394)...
mortenjorck 15y ago
What's interesting to me is how the landscape has changed since the early days of non-broadcast HD consumer content, and what this crack might mean for the future of it. In 2006, if you wanted to see a movie at home in HD, you bought a Blu-Ray or HD-DVD player and picked up the movie on disc. If you wanted to attempt to copy it, the disc was clearly the most attractive vector; the pipe would be inefficient. In 2011, however, if you want to see a movie at home in HD, you have several choices, only one of which involves a disc. Netflix, Vudu, Hulu, iTunes, CinemaNow, and others all offer HD content without a physical media vector – if you want to attempt a copy, suddenly your only vector is the pipe.
- wmf 15y ago
  You could always try cracking whatever DRM those streaming services use; instead of an FPGA all you'd need is a Norwegian teenager, a six-pack of Mountain Dew, and a cracked copy of SoftICE.
rufugee 15y ago
However, the truest part of the article for me was "In the meantime, HDCP continues to bother only a single group of people: those who buy stuff legally." AMEN. HDCP is the reason I can't use my large computer monitor to play my PS3 while my wife is using our television...my monitor won't support HDCP, but it does have an HDMI input. Very frustrating.

bryanlarsen 15y ago

For most of those 10 years, HDMI was protected simply via its data rate of 1.8TB/hour. Even today data rate and data size considerations require a RAID-0 array, so it's still out of the grasp of most casual copiers.

mbell 15y ago
HDMI is "protected" for the same reason HDCP lasted as long as it did. There was simply a more efficient way to access the data. Also, HDMI's data rate rose to ~3.56 TB/hour in the 1.3 release (circa 2006ish).
- bryanlarsen 15y ago
  For a good portion of those 10 years, there wasn't a more efficient way to access the data, since it took a while before Blu-Ray and HD-DVD were cracked. Also, the maximum data rate is fairly irrelevant, it's the typical data rate that matters. 1080p60 is 1.34 TB/hour.
  - mbell 15y ago
    This is not correct. "Blu-Ray" was officially released in June 2006, individual title/production house keys were cracked during 2006 and AACS was cracked at its root in the beginning of 2007. Both Blu-Ray and HD-DVD were cracked wide open LONG before either was remotely popular.
    - bryanlarsen 15y ago
      blu-ray continued to be a cat and mouse game for a while after that, utilizing the vm specified by blu-ray.
      - buff-a 15y ago
        If by "cat and mouse" you mean "the cat takes a day or two to learn how to find and eat each new type of mouse but having done so immediately eats such mice the instant it appears almost as if the mouse is teleported into the cats mouth" then yes it is. The reality is that the cat always catches the mouse, and engineering new types of mice costs money, so most blurays don't even bother. Its amazing that they bother at all. But if you meant, "a contrived action involving constant pursuit, near captures, and repeated escapes." then, no, I'd completely disagree. Its a pretty straightforward, routine process, guaranteed to end only one way.

Quequau 15y ago

When HDCP first was announced Ed Felten (Director of the Center for Information Technology Policy at Princeton University) described a workable attack vector (which was shortly confirmed) and labeled it so weak that most plausible explanation of its existence as: "only as a hook on which to hang lawsuits" https://freedom-to-tinker.com/blog/felten/hdcp-why-so-weak https://freedom-to-tinker.com/blog/felten/hdcp-why-so-weak