Hollywood studios and the maker and licensing authority of the High-Bandwidth Digital Content Protection standard were scrambling Wednesday to determine whether a so-called "master key" to the anti-piracy encryption technology has leaked onto the internet.
HDCP is a copy-protection technology that encrypts high-definition video traveling between set-top boxes and televisions. The technology, built by Intel, was approved by the Federal Communications Commission in 2004, and is a standard feature in televisions, cable boxes, satellite receivers and Blu-ray players in much of the modern world.
A purported master crypto key for HDCP appeared Monday on the clipboard site Pastebin, and has since been mirrored on hundreds of other websites, in a scene reminiscent of the 1999 crack of the CSS Content Scrambling System that once protected DVDs from copying.
"We are investigating whether this is real or a rumor," said Howard Gantman, a Motion Picture Association of America vice president, in a telephone interview Wednesday.
That sentiment was echoed by an Intel spokesman. "We are still investigating the facts behind the stories on this. Until we've completed that, we don't have more to say than this," wrote Tom Waldrop in an e-mail.
But even if the code is real, it might not immediately foster piracy as the cracking of CSS on DVDs did more than a decade ago. Unlike CSS, which could be implemented in software, HDCP requires custom hardware. The threat model for Hollywood, then, isn't that a hacker could use the master key to generate a DeCSS-like program for HD, but that shady hardware makers, perhaps in China, might eventually create and sell black-market HDCP cards that would allow the free copying of protected high-def content.
"You could make a device that would impersonate a TV, that would receive the bits and save them to a hard drive," said Paul Kocher, chief scientist at Cryptography Research in San Francisco. "I don't think it is going to have an impact on Hollywood's bottom line anytime soon."
Kocher suspected somebody in the business of making HDCP-compatible devices, who had access to at least 50 individual keys, was able to reconstruct the master key -- if it turns out to be real.
"This was bound to happen, soon or later," Kocher said.
See Also:
- Google Turns on Gmail Encryption to Protect Wi-Fi Users
- Scientist Says DVD Copying Software Circumvents Encryption
- Encryption Still Good; Sleeping Mode Not So Much, PGP Says
- Law Enforcement Appliance Subverts SSL
- Hacker Spoofs Cell Phone Tower to Intercept Calls
- Encrypted E-Mail Company Hushmail Spills to Feds
- PIN Crackers Nab Holy Grail of Bank Card Security
- Bank Sends Sensitive E-mail to Wrong Gmail Address, Sues Google
- Feds: Would-be Satellite TV Pirate Offered $250000 Reward to Smartcard Cracker
