The Content Scramble System (CSS) is a
digital rights management (DRM) and
encryption
In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can de ...
system employed on many commercially produced
DVD-Video discs. CSS utilizes a
proprietary 40-bit stream cipher algorithm. The system was introduced around 1996 and was first compromised in 1999.
CSS is one of several complementary systems designed to
restrict DVD-Video access.
It has been superseded by newer DRM schemes such as
Content Protection for Recordable Media (CPRM), or by
Advanced Encryption Standard
The Advanced Encryption Standard (AES), also known by its original name Rijndael (), is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001.
AES is a varian ...
(AES) in the
Advanced Access Content System
The Advanced Access Content System (AACS) is a standard for content distribution and digital rights management, intended to restrict access to and copying of the post- DVD generation of optical discs. The specification was publicly released in ...
(AACS) DRM scheme used by
HD DVD
HD DVD (short for High Definition Digital Versatile Disc) is an obsolete high-density optical disc format for storing data and playback of high-definition video. Supported principally by Toshiba, HD DVD was envisioned to be the successor to the ...
and
Blu-ray Disc, which have 56-bit and 128-bit
key size
In cryptography, key size, key length, or key space refer to the number of bits in a key used by a cryptographic algorithm (such as a cipher).
Key length defines the upper-bound on an algorithm's security (i.e. a logarithmic measure of the faste ...
s, respectively, providing a much higher
level of security than the less secure 40-bit key size of CSS.
Preliminary note
The content scramble system (CSS) is a collection of proprietary protection mechanisms for
DVD-Video discs. CSS attempts to restrict access to the content only for licensed applications. According to the
DVD Copy Control Association (CCA), which is the consortium that grants licenses, CSS is supposed to protect the intellectual property rights of the content owner.
The details of CSS are only given to licensees for a fee. The license,
[DVD CCA CSS License Agreement]
which binds the licensee to a
non-disclosure agreement, would not permit the development of
open-source software
Open-source software (OSS) is computer software that is released under a license in which the copyright holder grants users the rights to use, study, change, and distribute the software and its source code to anyone and for any purpose. Op ...
for DVD-Video playback. Instead, there is
libdvdcss, a
reverse engineered
Reverse engineering (also known as backwards engineering or back engineering) is a process or method through which one attempts to understand through deductive reasoning how a previously made device, process, system, or piece of software accompli ...
implementation of CSS. Libdvdcss is a source for documentation, along with the publicly available
DVD
The DVD (common abbreviation for Digital Video Disc or Digital Versatile Disc) is a digital optical disc data storage format. It was invented and developed in 1995 and first released on November 1, 1996, in Japan. The medium can store any kind ...
-ROM
[Standard ECMA-267, 3rd edition, 2001, 120 mm DVD - Read-Only Disk]
/ref> and MMC[Multi-Media Commands - 5 (Working Draft) T10/1675D, Revision 4, 2006-10-24]
/ref> specifications. There has also been some effort to collect CSS details from various sources.[The Content Scramble System – A Study]
/ref>
A DVD-Video can be produced with or without CSS. The publisher may for instance decide to go without CSS protection to save license and production costs.
Introduction
The content scramble system deals with three participants: the disc, the drive and the player. The disc holds the purported copyright information and the encrypted feature. The drive provides the means to read the disc. The player decrypts and presents the audio and visual content of the feature. All participants must conform to the CCA's license agreement.
There are three protection methods:
*Playback protection is based on encryption: the player requires a secret key to decrypt the feature.
*Read protection is based on the drive: access to significant disc data is only granted if the player authenticates successfully.
*Regional restriction is based on the disc and the drive: the drive can deny access if the disc does not belong to the drive's region.
The first two protection methods have been broken. Circumvention of regional protection is not possible with every drive—even if the drive grants access to the feature, prediction of title keys may fail.[ However, DVD players exist which do not enforce regional restrictions (the user has to disable the protection though), which makes regional restrictions less effective as a component of CSS.
]
The disc
The DVD-ROM's main-data (§16
The drive
The drive treats a DVD-Video disc as any DVD-ROM disc. The player reads the disc's user-data and processes them according to the DVD-Video format. However, if the drive detects a disc that has been compiled with CSS, it denies access to logical blocks that are marked as copyrighted (§6.15.3
The cipher
CSS employs a stream cipher and mangles the keystream with the plain-text data to produce the cipher text.linear-feedback shift register
In computing, a linear-feedback shift register (LFSR) is a shift register whose input bit is a linear function of its previous state.
The most commonly used linear function of single bits is exclusive-or (XOR). Thus, an LFSR is most often a ...
(LFSR) and set up with a 40-bit seed.
Mangling depends on the type of operation. There are three types:
* the decryption of a disc- or title-key,
* the decryption of a Pack and
* the encryption of keys for the authentication handshake.
In order to decrypt a DVD-Video, the player reads the disc-key-block and uses its player-key to decrypt the disc-key. Thereafter, the player reads the title-keys and decrypts them with the disc-key. A different title-key can be assigned for the Video Manager and for each Video Title Set. The title-keys are used to decrypt the encrypted Packs.
Cryptanalysis
CSS employs cryptographic keys with a size of only 40 bits. This makes CSS vulnerable to a brute-force attack
In cryptography, a brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correc ...
. At the time CSS was introduced, it was forbidden in the United States for manufacturers to export
An export in international trade is a good produced in one country that is sold into another country or a service provided in one country for a national or resident of another country. The seller of such goods or the service provider is an ...
cryptographic systems employing keys in excess of 40 bits, a key length that had already been shown to be wholly inadequate in the face of increasing computer processing power (see Data Encryption Standard
The Data Encryption Standard (DES ) is a symmetric-key algorithm for the encryption of digital data. Although its short key length of 56 bits makes it too insecure for modern applications, it has been highly influential in the advancement of cry ...
).
Based on the leaked DeCSS
DeCSS is one of the first free computer programs capable of decrypting content on a commercially produced DVD video disc. Before the release of DeCSS, open source operating systems (such as BSD and Linux) could not play encrypted video DVDs.
...
source-code, Frank A. Stevenson published in November 1999 three exploits that rendered the CSS cipher practically ineffective:correlation attack
In cryptography, correlation attacks are a class of known-plaintext attacks for breaking stream ciphers whose keystream is generated by combining the output of several linear-feedback shift registers (LFSRs) using a Boolean function. Correlation ...
enables the recovery of a keystream's seed at complexity of 216.
* The mangling of disc- and title-keys can be reversed at a complexity of 28.
* A disc-key can be recovered from its hash-value at a complexity of 225.
The latter exploit recovers a disk-key from its hash-value in less than 18 seconds on a 450 MHz Intel Pentium III.
The CSS design was prepared for the leak of a few player-keys. New discs would not contain an encrypted variant for these player-keys in the disc-key-block. However, Stevenson's exploits made it possible to generate all player-keys. Libdvdcss uses such a list of generated player-keys.
There are cases when no title-keys are available. A drive may deny access on region mismatch but still permit reading of the encrypted DVD-Video. Ethan Hawke presented a plain-text prediction for data repetitions in the MPEG program stream that enables the recovery of title-keys in real-time directly from the encrypted DVD-Video.[Ethan Hawke: DeCSSplus (Source Code)]
/ref>
In '' Geeks Bearing Gifts'', author Ted Nelson
Theodor Holm Nelson (born June 17, 1937) is an American pioneer of information technology, philosopher, and sociologist. He coined the terms ''hypertext'' and '' hypermedia'' in 1963 and published them in 1965. Nelson coined the terms '' trans ...
states "DVD encryption was intentionally made light by the DVD encryption committee, based on arguments in a libertarian book '' Computer Lib''.", a claim cited as originating from personal communication with an anonymous source; Nelson is the author of ''Computer Lib''.
See also
* DVD Copy Control Association
* libdvdcss, a popular free software for enabling playback of discs on opensource players.
References
External links
*
*
*
{{Broadcast_encryption
History of cryptography
Compact Disc and DVD copy protection
Broken stream ciphers
Television technology
Digital rights management standards
DVD Copy Control Association