EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

https://ottverse.com/eme-cenc-cdm-aes-keys-drm-digital-rights-management/

by jayjohn436 • 6 years ago

92 48 6 years ago

ottverse.com

shmerl6• 6 years ago

That's a good breakdown of how much effort is spent on unethical application of technology.

But advertising DRM on the site: "buy DRM"? That's already disgusting.

Thorrez2• 6 years ago

The post was apparently sponsored by them. I've got to at least applaud them for bringing a lot of this info out into the open.

jayjohn436• 6 years ago

True that.

bitwize4• 6 years ago

If you know anyone involved in creative work, you would bite your tongue before saying DRM is unethical.

Such people universally, to a man (or woman) believe that unauthorized distribution of their output is unethical because it makes them unable to make money for all their hard work. Inasmuch as DRM prevents this, it is a boon to these people.

DRM is a part of life now. Without it, you would not be able to enjoy the rich variety of content available on today's internet.

shmerl6• 6 years ago

Some people in the creative field have sense and don't respect DRM. Check Lexy Alexander's posts on this topic. Check also releases by CD Projekt Red and their DRM-free games store GOG.

We need something like this to eventually succeed and disrupt current messed up DRM situation in video too:

https://www.gog.com/forum/general/introducing_gogcom_drmfree...

DRM is and will remain unethical, no matter how much its proponents will try to whitewash it with demagoguery, claiming it's "part of life now".

And for the reference, DRM doesn't do anything good for creators. It's always a crooked tool, especially when combined with policy laundering that produces stuff like DMCA 1201.

ls65536• 6 years ago

And if you know anyone who has paid for content that suddenly they had lost access to because of shut down DRM servers or intermittent internet connectivity, then you might be inclined to think a bit differently.

Ultimately I think there needs to be a balance here, and most importantly users ought to be made more aware of what they're usually getting when purchasing DRM-protected content: a limited license to consume their paid-for content for a (possibly unspecified) period of time on a specific set of devices under certain circumstances that often lie well beyond their control.

I'd like to think that some kind of free market-based approach of consumers choosing to support the content creators who take a more balanced approach to DRM (or just avoid it entirely) would "solve" these problems, but I'm not too hopeful of this ever working out given the enormous knowledge asymmetry between content creators/distributors and consumers about how stuff like this works.

account42• 6 years ago

DRM is a part of life now.

So is piracy^Wcopyright infringement.

Without it, you would not be able to enjoy the rich variety of content available on today's internet.

Why not?

prudhvis• 6 years ago

Very informative article. Never knew different aspects of the DRM. However i chuckled when I saw the names Ram, Shyam and Hari. Not too often do you see any names besides Alice and Bob.

young_unixer• 6 years ago

So, the only thing stopping a user from obtaining a clean copy of the content is the fact that the CDM is closed source?

What if a CDM vendor leaked the source code? I guess the DRM server would block them after a while, but before they notice, the user would have free access to the content, right?

drudu• 6 years ago

You're completely right but the source code doesn't even need to be leaked. Just reverse engineered. How else would we pirate movies from Netflix/Amazon/etc :)

grishka7• 6 years ago

DRM is the epitome of security through obscurity.

ponderingfish2• 6 years ago

Exactly - which is why the CDM is a contentious topic because you have no way to see what's inside it. Also, technologies such as HDCP, Trusted Execution Environment prevent the decrypted and decoded frames from being leaked. At least, that's the intention.

And the CDM vendors are Google, MSFT, and Apple. There's no way they are going to leak their code :)

What's really strong is the rotation of decryption keys. Content providers rotate the keys often (at times, in the middle of a movie, and very often during a live stream) to deter people from cracking the key.

Cracking DRM can be done and the goal from the other side is to make it hard and expensive. Nothing is impossible :)

grishka7• 6 years ago

IMO it isn't that hard to crack a DRM system. My understanding is that most of the protections are legal, not technical, as in, if you do it, they'll sue the hell out of you and win.

MaxBarraclough• 6 years ago

the CDM vendors are Google, MSFT, and Apple

Also Adobe, although I'm not sure if their CDM (Adobe Primetime) is still relevant.

which is why the CDM is a contentious topic because you have no way to see what's inside it

Related to this: Firefox takes steps to try to contain the CDM blob within a sandbox. [0] See also this old blog post from before Firefox switched from Adobe's CDM to Google's WideVine CDM. [1]

[0] https://wiki.mozilla.org/Security/Sandbox/Architecture#GMP_p...

[1] https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...

marcan_42• 6 years ago

It's security through obscurity. For pure software stuff, like Widevine L3, you can just patch the browser or insert a shim to spit out the decrypted video somewhere.

https://github.com/artemist/widevineproxy

Thorrez2• 6 years ago

Is that the decrypted and decompressed video, or decrypted and still compressed? If the former, that's going to be a gigantic file, and you're going to lose quality when recompressing (although if you were planning to recompress anyway the quality loss is no worse).

bitwize4• 6 years ago

Illegal to distribute under the DMCA.

kmeisthax7• 6 years ago

The primary purpose of content encryption tools is to trigger DMCA 1201 anti-circumention provisions to prohibit people from writing decryption tools. Nothing more and nothing less. All DRM schemes are a form of obfuscation; some particularly secure ones use hardware decoding enclaves not present on desktops that are harder to crack, but that's about it. The only practically useful DRM schemes are ones where any tool that could circumvent them would be so special-purpose as to be illegal.

Here's how that works legally. DMCA 1201 actually comes in two parts: the first prohibits you from circumventing ANY technological measure (yes, even something as simple as a right-click blocker, domain lock, Youtube's rolling URL cipher, or what have you) and then lays out exceptions shaped similarly enough to fair use that the first part really doesn't alter the law beyond adding another tort to the pile. What's already infringement becomes infringement with a circumvention tort; and what's already fair use stays fair use.

However, the second part is rather broad. It prohibits the marketing of any sort of tool whose sole purpose is circumvention, lacks non-circumvention uses, or is marketed for circumvention. In practice, this means that there's a dividing line between DRM that can be circumvented with standard tools and those that require domain specialists to write you a tool. You can circumvent YouTube's "rolling cipher" by just launching OBS. You can't circumvent DVD CSS with anything but a specialized tool that falls under the second part of DMCA 1201 and is thus illegal to provide - even for otherwise legal circumvention.

(Yes, I know DVD CSS is laughably bad encryption; but the law doesn't care. You still have to write some code to brute force the laughably short ITAR-compliant key lengths.)

If the CDM vendor themselves released their source code, I doubt that would be considered a circumvention tool per se. If they had also started telling people to pirate movies while they still can, then they are violating the law. However, the CDM vendor likely promises to their customers not to do so, possibly in contracts and definitely implied in their marketing material. Releasing source moves the DRM scheme from the "domain specialists only" side to the "10 minutes with developer tools" side.

ponderingfish2• 6 years ago

Super answer!

shmerl6• 6 years ago

So all this will become a pile of wasted effort once DMCA 1201 is repealed.

raxxorrax• 6 years ago

Does the term marketing encompass open source software? Microsoft thinks so, but is that legally confirmed?

It could be argued that DRM is an inconvenience or does the manufacturer determine that?

throw0101a• 6 years ago

The primary purpose of content encryption tools is to trigger DMCA 1201 anti-circumention provisions to prohibit people from writing decryption tools.

What if those tools are hosted outside of the US where the DMCA has to force?

Certainly the US is a larger centre of gravity when it comes to tech, but it's not the only place.

josephcsible• 6 years ago

the first prohibits you from circumventing ANY technological measure (yes, even something as simple as a right-click blocker, domain lock, Youtube's rolling URL cipher, or what have you)

The law does say it has to be "effective".

brigade2• 6 years ago

For HD, you'd also need a valid vendor-signed key to do the key exchange (which would get swiftly revoked once public), and/or to crack the trusted execution environment.

grishka7• 6 years ago

which would get swiftly revoked once public

And then what happens to all those devices people bought and expect to be able to watch Netflix on?

kevingadd• 6 years ago

This isn't true. Multiple Google devices have had their Widevine keys leaked/recovered and Google has waited around before revoking them since it would break hardware playback on the device or cause other issues. The Nexus 6, for one, has been downgraded from Widevine L1 to L3 as a result.

palashkulsh• 6 years ago

I've been trying to understand this drm for some uses for past 6 month. I got few bits and pieces, but this article really put them together in a marvelous fashion. kudos

gok• 6 years ago

Not sure if the author is here, but the table-of-contents links at the top are broken (all go to the first page)

EME, CDM, AES, CENC, and Keys – Building Blocks of DRM

Related Stories