3 ms·
With DRM the user who owns the machine is the "attacker". The keys have already been handed to the user, he only needs to get them out. This is like hiding an A
by the8472 4y ago
With DRM the user who owns the machine is the "attacker". The keys have already been handed to the user, he only needs to get them out.
This is like hiding an API key in a public website's javascript with rot13. Very much security by obscurity.
Proper security means that the attacker should never be in possession of the key.
- klodolph 4y agoYou’re saying that a hardware security module is like rot13? When you say the attacker “only” needs to get them out, the “only” is doing a lot of work, there.
- yipbub 4y agoYes, but it only has to be done once.
- the8472 4y agoThe standard for cryptographic security is that the attacker can do no better than brute force. And the complexity for that is usually set high enough that it is out of range for the entire computational capacity of our civilization for years to come. I'd say handing the key to the attacker in a package that requires somewhere between a skilled reverse-engineer and a semiconductor lab to untangle falls far short of that standard.