IEEE Working Group Considers Kinder, Gentler DRM

[Shaggy]

Originally Posted by Steve Jordan

Why is that, exactly?

The exact same reason that current DRM is useless.

People who don't understand how this works keep thinking that all they need to do is come up with a better/stronger DRM model. The real issue is that no DRM model will solve the problem they are trying to solve.

[Steven Lyle Jordan]

Originally Posted by Shaggy

The exact same reason that current DRM is useless.

That's not an answer to my question... try reading the essay and giving me reasons to back up your assertions, please.

[Shaggy]

Originally Posted by Steve Jordan

That's not an answer to my question... try reading the essay and giving me reasons to back up your assertions, please.

I'm not sure this is the proper forum for an education on how digital encryption algorithms work.

However, in a nutshell (although I've explained this to you before on other threads), think of DRM like the lock on the front door of a rental property. That lock is designed to keep the bad guys (pirates) from getting inside and stealing all of the furniture (data). In order to rent the property to a tenant (customer) you give them the key to the front door so that they can get inside and have access to your furniture (data).

Here's the catch. The lock on the front door does nothing to stop the tenant from stealing all of your furniture, no matter how strong of a lock you use.

Digital data is the same way. There is no technological solution to the problem of granting access for legitimate uses and preventing access for illegitimate uses when both are being done by the same user. Once you give a key to a customer who buys your eBook, that customer is then free to pull out the text and put it up on a filesharing site. There is nothing DRM can do to stop them. The only way you can prevent piracy is to not give anyone a key to the file. But then you won't have any customers either.

The whole notion of putting bigger/stronger DRM/biometrics/etc on digital files in an attempt to prevent piracy is an exercise in futility. You could require that a customer submit a DNA sample each time they want to open the data, it wouldn't matter. Once you let them in, they can take it and do whatever they want with it.

[MovieBird]

To follow up on Shaggy's excellent analogy (I'm going to steal that one), the breaker of ADE DRM has this to say:

Originally Posted by i♥cabbages

ADEPT is pretty close to faultless as a crypto system -- a per-user RSA key encrypts a per-book AES key which encrypts the content. It uses AES in CBC mode with a random IV. It uses RSA with PKCS#1 v1.5 padding, which is perfectly adequate for this case. Unfortunately for Adobe, this isn't a crypto system, but a DRM system. DRM systems ultimately depend not on the strength of their cryptography, but the complexity of their obfuscation. There is very little obfuscation in how Adobe Digital Editions hides and encrypts the per-user RSA key, allowing fairly simple duplication of exactly the same process Digital Editions uses to retrieve it.

Essentially, the requirement that you give the key to the purchaser means that they can discover the key in the future. You can obfuscate it, but eventually someone smart enough, with enough time, will crack it if it's popular.

For those that insist on DRM, the only viable option I see is a model where you can only read while connected to the internet, so the program can query a server for the key. However, think of the bandwidth and storage costs to implement such a scheme.

[CyberSmoke53]

Originally Posted by Elfwreck

Every time I read that, it gets more funny. Maybe they mean it can't be *used* when it's copied. (You can copy Kindle Topaz books onto a Sony Reader. Can't read them there, but you can copy them.) I think it's hilarious when tech orgs fail at basic computer terminology. Especially if they're doing it deliberately to appease corporate sponsors, and hoping that other techies won't bring it up.

(I'm not much of a computer geek. However, "can move but can't copy" hurts my head. If that's true, then they need to explain how the transfer is 100% safe--what happens if there's a power hiccup during the file movement?)


And publishers & media corps won't object at all to online "playkey share groups" that collect hundreds of playkeys into a digital library, which anyone *could* grab & keep, but most people don't. Authors won't mind reading groups springing up on Twitter, saying "who's next for this playkey?"

And of course, none of them will mind resale of playkeys on Craigslist & ebay.

I would guess that someone would have to provide "playkey archive backup software" rather quickly, since I am guessing folks will need some recovery method for missing playkeys when someone "grabs and keeps" your playkeys or the servers holding / tracking these things get hacked or the keys just don't MOVE like they are supposed to!

If I pay my hard earned money for something as nebulous as this playkey idea I would expect to be able to backup and recovery them. We can currently backup/recover DRM books, music and such...

[Shaggy]

Originally Posted by MovieBird

For those that insist on DRM, the only viable option I see is a model where you can only read while connected to the internet, so the program can query a server for the key. However, think of the bandwidth and storage costs to implement such a scheme.

It wouldn't take long to reverse engineer that either. Redirect the IP, put up your own server...

[Shaggy]

Originally Posted by MovieBird

Essentially, the requirement that you give the key to the purchaser means that they can discover the key in the future. You can obfuscate it, but eventually someone smart enough, with enough time, will crack it if it's popular.

Exactly. Pirates don't strip DRM by defeating the cryptography, they strip DRM by figuring out how to use the key that the copyright holder gives them. So coming up with stronger/different DRM schemes is a waste of time. At the end of the day you still have to hand out keys to your customers.

That's why DRM is fundamentally flawed as a digital protection mechanism.

[JSWolf]

Originally Posted by MovieBird

To follow up on Shaggy's excellent analogy (I'm going to steal that one), the breaker of ADE DRM has this to say:



Essentially, the requirement that you give the key to the purchaser means that they can discover the key in the future. You can obfuscate it, but eventually someone smart enough, with enough time, will crack it if it's popular.

For those that insist on DRM, the only viable option I see is a model where you can only read while connected to the internet, so the program can query a server for the key. However, think of the bandwidth and storage costs to implement such a scheme.

And if the server(s) are down or your net is or you don't have net access, you are well and truly screwed. No thanks.

[DawnFalcon]

Originally Posted by Shaggy

That's why DRM is fundamentally flawed as a digital protection mechanism.

Not at all. DRM has a number of uses. DRM front-ends to encryption software can be very useful, and there are certainly uses for time-limited DRM in business and so on.

What it's not good at is hiding content from an end-user.

[Shaggy]

Originally Posted by DawnFalcon

What it's not good at is hiding content from an end-user.

You're right. That's what I meant to say.

[DawnFalcon]

The really good one is the HDCP software "monitor" interface I've seen recently which can capture and re-record "protected" content quite handily.

[Shaggy]

Originally Posted by DawnFalcon

The really good one is the HDCP software "monitor" interface I've seen recently which can capture and re-record "protected" content quite handily.

I think I've seen HDCP hardware "dongles" as well that turn off the broadcast flag.