thewayne | AACS update has been cracked before it ships

Two weeks ago, the AACS encryption scheme was cracked. Some of you may have been wondering at the strange post that I made a couple of weeks ago which is the phonetic representation of the hexadecimal code key. This is the key that encrypts HD-DVD discs. So if you know the encryption key, you can decrypt the disc and make a copy of a hi-def movie on your hard drive.

Changing this code is a non-trivial process -- the disc manufacturers have to change things, the HD-DVD player makers have to change things, not easy. Plus player owners must have their players upgraded with the new key. The old/compromised key is no longer encoded on the players (as I understand it), I have no idea if the discs coded with the old key become unplayable at that point, but I would assume so.

But since their code was broken, they "had to" change it. And the new code has now been broken. Except the new code hasn't shipped yet. :-)

http://blog.wired.com/gadgets/2007/05/aacs_update_cra.html

Here's the issue. Music and movie media makers make a code that they think is pretty spiffy. They patent it. Anyone who breaks it is threatened with a law suit under the Digital Millennial Copyright Act (DMCA), and the code-makers think the threat is enough to keep the crack or the cracked key from being publicized.

Well, that didn't work too well two weeks ago. People slathered the compromised key all over the world. Probably 95%+ of people interested in the key are not pirates. They're not going to start burning copies of Titanic II: The Gathering and selling them at local flea markets. If they do rip the disc to their computer's drive, it's because they want to have a media player or they want to watch it when they travel and they don't want to cart the disc around.

So why is it breakable? BECAUSE THEY DON'T USE STRONG ENCRYPTION. They make it obfuscated, a process laughingly called security through obscurity. And they patent the method. A strong encryption method (such as DES, 3DES, AES, TwoFish, Blowfish, etc.) is peer-reviewed by professional mathematicians and cryptologists, people who work with numbers and encryption for a living. These are algorithms that are proven to be extremely resistant to compromise. Keep in mind that it doesn't mean that a code can't be broken, it's just that it can't be broken in a practical manner -- you can break Secure Code X, but it's going to take the currently most-powerful supercomputer 50,000 years to do it. Maybe in ten years there will be a breakthrough in quantum computing and a supercomputer then can break it in an hour, we don't know. And we can't know. After all, how many of us have flying cars and personal jet packs and get an entire meal's worth of nutrition out of one pill?

So why don't they use strong encryption? I think largely for two reasons. First, cost. It's expensive in terms of computer hardware to encrypt and decrypt strong encryption. More powerful hardware = $$$ and heat. So the cost to make your player goes up. It generates more heat and requires more cooling. And it eats more electricity. So they go for lousy encryption that is not too difficult to break and rely upon the threat of lawsuits to try and keep it secure.

Sounds like a losing game for the manufacturers to me.

Me? I have no interest in cracking the encryption on movies. But one thing does interest me -- I want to know that the movie that I buy today can be played in ten years. They appear to be on the road that they'll be jerking around this technology so much that I'm not too confident of that. So I may well invest in a large hard drive and rip some of my DVDs that I'm not interested in replacing every five years because of changing tech.

Hmmmm. Kinda makes me sound like an anti-capitalist commie. :-)

(I'm going to try to avoid dupe entries in both this and my computerstuff blog, but I thought this should be in both)