6 ms·

There’s some technical details missing here. I get decrypting the video on a gpu makes it harder to screen capture, but can’t you just still emulate the GPU in

by _yb2s 2y ago

There’s some technical details missing here. I get decrypting the video on a gpu makes it harder to screen capture, but can’t you just still emulate the GPU in software or directly capture the digital video output? The GPU still has no unique hardware private key, right?

mjg59 2y ago
The details don't seem clear, and I don't know that there's necessarily a unique key rather than stuff being batched, but basically yeah there's a cert chain back to a "trusted" source
- elthjan 2y ago
  how does the decryption key get into the GPU? are GPU's currently shipping preprogrammed with keys used in DRM?
  - transpute 2y ago
    Some GPUs have their own silicon root of trust. Intel ME has a role in PAVP (Protected Audio/Video Path).
  - Mindwipe 2y ago
    Yes, every* card since the Kaby Lake iGPUs or Nvidia 1080 cards. *To all intents and purposes, I'm sure there's some exceptions with no market share.
jsheard 2y ago
Capturing the digital video output is supposed to be prevented by HDCP encrypting the signal, but in practice that's pretty well broken. That is a (slowly) moving target though, each time they roll out a new HDMI version (e.g. for 4K) they get to enforce a new version of HDCP which needs to be broken all over again. I don't think the version of HDCP attached to HDMI 2.1 has been broken yet but that's kind of a moot point because no current video formats require more than HDMI 2.0.
- timewizard 2y ago
  It's hilarious to imagine the meeting where they finally convinced themselves they could put worthwhile lasting encryption in consumer devices with a 10 year+ installation lifetime. What a complete and total waste of effort.
  - _yb2s 2y ago
    I suspect bad encryption still does exactly what they intend, because it means there is no simple one click solution built into an OS or browser to download streaming media for later watching or sharing with friends. For example, a lot of regular modern OSs have the ability to rip and share an unencrypted audio CD in a simple intuitive way with no shady pirate software to install. It's a legal hurdle, not a technical one that prevents the 'above the board' software suppliers from adding this feature. Pirates clearly are able to extract the 4K video and upload them to torrent sites, but the average media consumer would rather pay a netflix subscription fee that deal with the shady underworld of those sites with the virus installing and crypto mining popups, warning letters from your ISP, etc. They've managed to make it hard enough that the number of people that do it is insignificant to their bottom line.
    - madars 2y ago
      Torrenting hasn't been the most popular form of piracy for a while: many subscribe to a couple streaming services and use pirate streaming sites to fill in the gaps [1]. This is so prevalent that even entertainment industry talent use pirate sites for both series [2] and sports [3]. Takedowns mean that sites change from year to year but FMHY-style curation makes casual piracy easy: one can always find a site with 1080p content (unsure about the bitrate though) and great UX. [1] https://torrentfreak.com/could-piracy-help-netflix-win-the-streaming-wars-240108/ https://torrentfreak.com/could-piracy-help-netflix-win-the-s... [2] https://www.indy100.com/celebrities/sydney-sweeney-pirating-law-order https://www.indy100.com/celebrities/sydney-sweeney-pirating-... [3] https://arstechnica.com/gadgets/2024/10/nfl-player-illegally-streams-his-own-teams-game-garners-mostly-sympathy/ https://arstechnica.com/gadgets/2024/10/nfl-player-illegally...
  - 2y ago
Stagnant 2y ago
Yes, you can get around it by playing the video in a virtual machine and capturing it from the host. For widevine videos playing in browser it is also as trivial as disabling hardware acceleration from the browser's settings.
- Wowfunhappy 2y ago
  But doesn't this limit you to 1080p?
  - Retr0id 2y ago
    Correct
    - Wowfunhappy 2y ago
      Yeah, so that's not really relevant. Hardware DRM is generally only used for 4K, as mentioned in the article.
      - Retr0id 2y ago
        Indeed, note that I'm not the same user you were originally replying to
        Wowfunhappy 2y ago
        (Thanks, yes I know! I still wanted to finish the point!)
p_l 2y ago
The parts involved in protected Audio/Video path do have their own encryption keys and hardware support outside of anything touched by the OS. In fact it's major part of what Intel Management Engine does if you do not have the "advanced" license for remote management, and AFAIK why AMD PSP on normal AMD cpus has closed source firmware. Both are responsible for setting up protected media path and both are interrogated by DRM modules to setup encryption.
Mindwipe 2y ago
> The GPU still has no unique hardware private key, right? GPU's have had unique hardware private keys and secure memory for a decade.
- _yb2s 2y ago
  How does the remote streaming server know a key is an authentic hardware GPU that hasn't been compromised, and not something you just generated in software, to enable software level decryption of the media? It seems like you'd need some central SSL like certificate authority to verify and revoke credentials that were universally implemented in the same way by all GPU manufacturers.... surely there is no such thing?
  - kbolino 2y ago
    At least for HDCP, that's exactly how it works. From the HDCP 2.2 spec [1]: > Device Key Set. An HDCP Receiver has a Device Key Set, which consists of its corresponding Device Secret Keys along with the associated Public Key Certificate. > Public Key Certificate. Each HDCP Receiver is issued a Public Key Certificate signed by DCP LLC, and contains the Receiver ID and RSA public key corresponding to the HDCP Receiver. > The top-level HDCP Transmitter checks to see if the Receiver ID of the connected device is found in the revocation list. [1]: https://www.digital-cp.com/sites/default/files/specifications/HDCP%20Interface%20Independent%20Adaptation%20Specification%20Rev2_2_FINAL.pdf https://www.digital-cp.com/sites/default/files/specification...
    - _yb2s 2y ago
      Thanks, that clarifies my confusion about how this could be realistically implemented. I couldn't see a practical way to verify every device on every connection via a central authority without massive scaling and reliability issues, but maintaining a small revocation list that can be cached everywhere media is distributed from seems quite practical.
      - mike_hearn 2y ago
Asooka 2y ago
Making your own GPU sounds intriguing. You could hook up a small ARM computer to the PCI slot and implement a GPU in software. A very slow GPU obviously, but fast enough to decrypt the video frames. I'm not sure if you'll be able to write a driver for it that will seem legit to Windows.

by _yb2s 2y ago

mjg59 2y ago

The details don't seem clear, and I don't know that there's necessarily a unique key rather than stuff being batched, but basically yeah there's a cert chain back to a "trusted" source

elthjan 2y ago
how does the decryption key get into the GPU? are GPU's currently shipping preprogrammed with keys used in DRM?
- transpute 2y ago
  Some GPUs have their own silicon root of trust. Intel ME has a role in PAVP (Protected Audio/Video Path).
- Mindwipe 2y ago
  Yes, every* card since the Kaby Lake iGPUs or Nvidia 1080 cards. *To all intents and purposes, I'm sure there's some exceptions with no market share.

jsheard 2y ago

Capturing the digital video output is supposed to be prevented by HDCP encrypting the signal, but in practice that's pretty well broken. That is a (slowly) moving target though, each time they roll out a new HDMI version (e.g. for 4K) they get to enforce a new version of HDCP which needs to be broken all over again. I don't think the version of HDCP attached to HDMI 2.1 has been broken yet but that's kind of a moot point because no current video formats require more than HDMI 2.0.

timewizard 2y ago
It's hilarious to imagine the meeting where they finally convinced themselves they could put worthwhile lasting encryption in consumer devices with a 10 year+ installation lifetime. What a complete and total waste of effort.
- _yb2s 2y ago
  I suspect bad encryption still does exactly what they intend, because it means there is no simple one click solution built into an OS or browser to download streaming media for later watching or sharing with friends. For example, a lot of regular modern OSs have the ability to rip and share an unencrypted audio CD in a simple intuitive way with no shady pirate software to install. It's a legal hurdle, not a technical one that prevents the 'above the board' software suppliers from adding this feature. Pirates clearly are able to extract the 4K video and upload them to torrent sites, but the average media consumer would rather pay a netflix subscription fee that deal with the shady underworld of those sites with the virus installing and crypto mining popups, warning letters from your ISP, etc. They've managed to make it hard enough that the number of people that do it is insignificant to their bottom line.
  - madars 2y ago
    Torrenting hasn't been the most popular form of piracy for a while: many subscribe to a couple streaming services and use pirate streaming sites to fill in the gaps [1]. This is so prevalent that even entertainment industry talent use pirate sites for both series [2] and sports [3]. Takedowns mean that sites change from year to year but FMHY-style curation makes casual piracy easy: one can always find a site with 1080p content (unsure about the bitrate though) and great UX. [1] https://torrentfreak.com/could-piracy-help-netflix-win-the-streaming-wars-240108/ https://torrentfreak.com/could-piracy-help-netflix-win-the-s... [2] https://www.indy100.com/celebrities/sydney-sweeney-pirating-law-order https://www.indy100.com/celebrities/sydney-sweeney-pirating-... [3] https://arstechnica.com/gadgets/2024/10/nfl-player-illegally-streams-his-own-teams-game-garners-mostly-sympathy/ https://arstechnica.com/gadgets/2024/10/nfl-player-illegally...
- 2y ago

Stagnant 2y ago

Yes, you can get around it by playing the video in a virtual machine and capturing it from the host. For widevine videos playing in browser it is also as trivial as disabling hardware acceleration from the browser's settings.

Wowfunhappy 2y ago
But doesn't this limit you to 1080p?
- Retr0id 2y ago
  Correct
  - Wowfunhappy 2y ago
    Yeah, so that's not really relevant. Hardware DRM is generally only used for 4K, as mentioned in the article.
    - Retr0id 2y ago
      Indeed, note that I'm not the same user you were originally replying to
      - Wowfunhappy 2y ago
        (Thanks, yes I know! I still wanted to finish the point!)

p_l 2y ago

The parts involved in protected Audio/Video path do have their own encryption keys and hardware support outside of anything touched by the OS. In fact it's major part of what Intel Management Engine does if you do not have the "advanced" license for remote management, and AFAIK why AMD PSP on normal AMD cpus has closed source firmware. Both are responsible for setting up protected media path and both are interrogated by DRM modules to setup encryption.

Mindwipe 2y ago

> The GPU still has no unique hardware private key, right? GPU's have had unique hardware private keys and secure memory for a decade.

_yb2s 2y ago
How does the remote streaming server know a key is an authentic hardware GPU that hasn't been compromised, and not something you just generated in software, to enable software level decryption of the media? It seems like you'd need some central SSL like certificate authority to verify and revoke credentials that were universally implemented in the same way by all GPU manufacturers.... surely there is no such thing?
- kbolino 2y ago
  At least for HDCP, that's exactly how it works. From the HDCP 2.2 spec [1]: > Device Key Set. An HDCP Receiver has a Device Key Set, which consists of its corresponding Device Secret Keys along with the associated Public Key Certificate. > Public Key Certificate. Each HDCP Receiver is issued a Public Key Certificate signed by DCP LLC, and contains the Receiver ID and RSA public key corresponding to the HDCP Receiver. > The top-level HDCP Transmitter checks to see if the Receiver ID of the connected device is found in the revocation list. [1]: https://www.digital-cp.com/sites/default/files/specifications/HDCP%20Interface%20Independent%20Adaptation%20Specification%20Rev2_2_FINAL.pdf https://www.digital-cp.com/sites/default/files/specification...
  - _yb2s 2y ago
    Thanks, that clarifies my confusion about how this could be realistically implemented. I couldn't see a practical way to verify every device on every connection via a central authority without massive scaling and reliability issues, but maintaining a small revocation list that can be cached everywhere media is distributed from seems quite practical.
    - mike_hearn 2y ago

Asooka 2y ago

Making your own GPU sounds intriguing. You could hook up a small ARM computer to the PCI slot and implement a GPU in software. A very slow GPU obviously, but fast enough to decrypt the video frames. I'm not sure if you'll be able to write a driver for it that will seem legit to Windows.