OPINION: A hack job
By Paul Sweeting -- Video Business, 1/26/2007
JAN. 26 | THE AACS LICENSING AUTHORITY offered its first official response to an apparent compromise of the content-protection system used on HD DVD and Blu-ray Disc on Jan. 24, one day shy of a month after the first reports of a possible breach appeared on well-known Internet forums.
Paul Sweeting is editor of Content Agenda
In a posting to its Web site, AACS-LA acknowledged that “AACS title keys have appeared on public Web sites without authorization.”
Such unauthorized disclosures, it went on to say, “indicate an attack on one or more players sold by AACS licensees.”
In the interval between the first reports and the official confirmation, the number of title keys appearing on Web sites “without authorization,” reached several dozen, affecting both HD DVD titles and Blu-ray movies. The hacker credited with discovering the technique for uncovering the decryption keys— Muslix64—has released two versions of his key-sniffing utility: one for HD DVD and one for Blu-ray.
Muslix has also had time to become a minor celebrity of sorts within the hacker community and beyond, even giving his first online interview on the same day the AACS posted its response.
“IMHO, AACS is totally busted,” Muslix told Slyck.com. “The only thing I can see for now to prevent the attack I have described is to put different keys on every disc! It will cost a fortune for the manufacturing, so I’m not sure they will go that way.”
In response to all that activity, AACS-LA’s response has been—how shall I say?—measured.
“This development is limited to the compromise of specific implementations and does not represent an attack on the AACS system itself, nor is it exclusive to any particular format,” the group’s post said. “Instead, it illustrates the need for all AACS licensees to follow the Compliance and Robustness Rules set forth in the AACS license agreements to help ensure that product implementations are not compromised. AACS-LA employs both technical and legal measures to deal with attacks such as this one, and AACS-LA is using all appropriate remedies at its disposal to address the attack. AACS was designed to address a number of potential attacks with minimal impact using a variety of means, including the ability to renew or upgrade players.”
Muslix himself scoffs at those sentiments.
“People say I have not broken AACS but players. But players are part of this system,” he said on Slyck.com. “A system is only as strong as its weakest link. Even if players become more secure, key extraction will always be possible.
“I know many people of the industry try to cover up this breach, by saying I have only poked a tiny hole in AACS, but it is more serious than that,” he added. “Only the future will tell.”
THAT LAST POINT, at least, is indisputable, at least in my case.
I don’t understand the technology anywhere near well-enough to pass judgment on which side has more accurately described technical reality.
It’s also possible that there are tools at the disposal of AACS-LA that have not been made public—and may never be, even if deployed.
Yet whatever the technical truth, the real weakness in AACS revealed by the episode is betrayed in this sentence: Instead, it illustrates the need for all AACS licensees to follow the Compliance and Robustness Rules set forth in the AACS license agreements to help ensure that product implementations are not compromised.
Throughout the entire AACS development process, the business relationships among the various companies and industries have proved far harder to get right than the technology.
A principal reason there is still no final AACS license, for instance, is that the parties cannot agree on what the rules ought to be for managed copy. Which digital-rights management systems were going to be used was fairly obvious from the beginning.
Much (though not all) of the antipathy toward the use of BD+ among some in the HD DVD camp stems from the fact that its response to apparent hacks is under the control of the Blu-ray Disc Assn. rather than the AACS-LA, not from the technology itself.
Whatever the technical facts, it’s unlikely that the engineers who designed AACS took a full month longer to confirm them than it took the hackers who picked up and expanded on what Muslix had done.
It’s far more likely that the nearly 30 days between the breach and the first official statement was consumed in debate and negotiation over how strictly to enforce the robustness rules concerning a player’s handling of title keys during playback.
