HDCP Blu-Ray DRM reportedly cracked wide open

Although this story is not directly related to e-books, it serves to show the untenability of DRM schemes in general in the long term and as such is important and worth repeating. Engadget reports that a putative “HDCP master key” has been found and released.

It hasn’t been confirmed yet whether this key actually is what it claims to be, but if true, this would render the protection scheme used to protect Blu-Ray, in which individual players’ keys could be revoked if compromised, obsolete—this is the key that is used to generate those keys, and the release also includes a description of how to use it to do just that.

It might also throw a kink into the MPAA’s plans to stream movies to customers at home while they’re still in theaters, for which they got the FCC to allow them to send content only through secured HDMI connections rather than through any of the other, recordable analog ones.

It’s unclear who released this key or how it was found. The key, which was uploaded to Pastebin and by now is presumably being mirrored all over the place, is being publicized by a twitter account called “Intel Global PR”.

It is apparently theoretically possible to derive the master key from fifty individual keys, but Cory Doctorow posts on BoingBoing that he suspects it happened via a plain old leak. If “three can keep a secret if two of them are dead” then something like a security key that would have had to be in the possession of a number of people was doomed sooner or later. It’s yet another proof that “security through obscurity” just doesn’t work. (Security researcher Niels Ferguson, who wrote the first paper proposing the fifty-key method, suspects it was a hybrid approach.)

HDCP DRM is used to implement the controversial HDMI connection scheme, in which high-definition content would be degraded unless output specifically through a secured HDMI connection that would prevent it from being intercepted and recorded along the way. The controversy arises because this would prevent high-definition sets that are too old to have HDMI but are still technically capable of displaying the content at its full resolution from doing so.

The leak is reminiscent of the early discovery through a compromised DVD player’s key that DVDs’ encryption, CSS, relied on remarkably weak encryption, which subsequently led to DeCSS and the ability to play DVDs through countless unlicensed Linux player applications. Will a “DeHDCP” soon follow? Will the motion picture industry try as fruitlessly to quash this key as they tried to quash DeCSS?

I now have a picture in my head of all the previously-cracked encryption schemes welcoming HDCP to their club. Not just CSS, but also all the e-book schemes: Microsoft Reader, Adobe, eReader, Mobipocket/Kindle, and so on. More proof that all DRM schemes will eventually fall wasn’t necessary, but it certainly is nice to have.