5 ms·
This doesn't make sense, because you have to have the key to play the video. Cryptography and security practices are the medical science to DRM's snake oil, and
by gue5t 13y ago
This doesn't make sense, because you have to have the key to play the video. Cryptography and security practices are the medical science to DRM's snake oil, and I don't really expect this usage will help security at all.
A "known key" attack isn't an attack at all, cryptographically speaking.
In addition: it doesn't even look like they're meaningfully using "web crypto" APIs, but rather the much-debated proposed DRM blob APIs.
- lukifer 13y agoI only know the basics of crypto, but couldn't the key be hidden and itself encrypted within the machine code for IE, and then authenticated via HTTPS? I would think this is mainly a problem for open-source browsers, which would require closed-source plugins.
- ZitchDog 13y agoYou can't hide a key for long. And you can't encrypt a key without another key.
- lukifer 13y agoBut doesn't client-side encryption already function at the OS level? For instance, the keys for FairPlay and the App Store have not been cracked, as far as I know.
- X-Istence 13y agoFairPlay has been cracked a lot of times, there have been many tools to remove the DRM from FairPlay encrypted songs/videos/books. App store apps have also been cracked in that their keys have been stripped, on a jail broken phone you can run all those apps without needing a valid key.
- lukifer 13y agoFairPlay for video still hasn't been cracked (I wish it were). But I take your point.
- ajasmin 13y agoFairPlay video was (kind of) cracked a few years ago I was in the habit of decrypting TV episodes using Requiem so I could watch them on my Linux netbook. You had to decrypt the files on a computer with iTunes installed though. I don't know if Requiem has been keeping up with the latest iTunes releases.
- gizmo686 13y agoThe user has access to the machine code for IE. However, you are onto the right track. One proposed solution to DRM (that I believe was impleneted with DVD and/or blueray) is to establish a chain of trust in the hardware. The idea would be that you send an encrypted signal to the monitor, and the monitor has a tamper resistant decryption chip with its own key. Obviously, this only gets you so far, as once someone cracks the chip (or acquires the master key through other means, as happened with DVD), then the entire scheme is broken. Ultimatly the problem is that you need to provide the user with enough information for them to be able to view the decrypted content, while at the same time not let them know the decrypted content. The real question is how difficult/expansive can you make it to bypass. Unfourtantly, in every system I am aware of, once one person figures it out, it become cheap and easy for every else; and coming up with a new crypto-system is a great way to get the academic community to try and break it.
- bradydoll 13y agoThe hardware DRM you are talking about, is HDCP. It is required for Blu-ray.
- gizmo686 13y agoThanks. For anyone interested, it looks like HDCP has been broken on pure crypto grounds [1]. As much as I agree that this type of DRM is fundamentally not possible, I'm still kind of surprised that their was a direct attack on the crypto. [1] http://www.cs.rice.edu/~scrosby/pubs/hdcppaper.ps http://www.cs.rice.edu/~scrosby/pubs/hdcppaper.ps