Re: DeCSS, crypto, (regions removed??!)
On Thu, 9 Jan 2003, Bill Stewart wrote: > At 03:54 PM 01/08/2003 +0100, Martin Olsson wrote: > >Hi, > >I dont know if this is relevant to the discussion, but in Sweden (not a > >region-1 country) people where so pissed at the regionsystem (and the fact > >that most computer geeks could go around it, but the average person could > >not) that the whole region concept had to be removed. Ie. this forced the > >large companies to rethink and nowadays we have commercial region-free DVD > >players in most stores. > > That's an interesting change - a couple of years ago, > friends from Sweden told me that the standard was to > strictly sell only region-enforcing DVD players > and then charge a bit extra for installing the > region-free mod chips that everybody bought. > I guess they've stopped bothering with the games by now. I wonder how they deal with the RCE (Region Code Enforced) discs? RCE is a sceme that causes the disc not to work in region free players. If you want a good test disc, try the region 1 version of "Spider-man". In a region free player it will bring up a map of region codes and make nasty noises about how you need a region one player. The disc works fine in players where you can set the region. (Some region ocdeless players can do this, some cannot.) You can find places that sell region free players by searching on Google for "Apex region free DVD". The only one I have used is www.220-electronics.com and I will not order from their insecure web page. - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: DeCSS, crypto, law, and economics
On Tue, 2003-01-07 at 21:09, bear wrote: > On Tue, 7 Jan 2003, alan wrote: > > > > Not to mention the two seasons of Futurama that are only available > > on Region 2 PAL DVDs. (Or the other movies and TV shows not allowed > > by your corporate masters.) "They Live" is another film only > > available from Region 2. Maybe it tells too much about the movie > > industry... > > This makes an interesting point. While the argument that market > segmenting may increase the ability to provide material in all > markets, the fact is that given region coding, the producers of > this stuff *DON'T* provide the material in all markets. > > If their argument, that the increased market size available with > region coding enables economies of scale, were actually the driving > force behind region coding, there should be no such thing as content > available in one region that is unavailable in another. > > Thus their actions betray that they have a different motive. Therefore > the public skepticism regarding the truth of their assertions about > their motivations seems fairly solidly grounded on fact. The reasoning seems to be pure greed. If you look at the zones, they are more economic than anything else. Another theory is it allows them to edit movies for different markets. (Such as what Miramax does to movies out of Hong Kong. Region codes help prevent the average viewer from being able to see the film in the original form and realize just how much they screwed up the film.) Another argument for the regions is the differing formats for TV signals. (NTSC v.s. PAL.) It is a bogus argument as you can find DVD players that will convert the signal with little or no problem. (Apex produced one that was incredibly cheap and works great.) > ( who likes a fair amount of stuff that is only available > coded for region 6 ). You made me have to look up what region 6 was. (Here is a good reference for those of you who don't know or remember: http://www.ilovedvd.co.nz/regioncodes.asp ) Most of the titles i have seen from China are region free. (Hong Kong makes a good deal of money from Americans who want to see Chinese films uncut. I know, because they are making a fortune off of me...) -- Alan <[EMAIL PROTECTED]> - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: DeCSS, crypto, law, and economics
On 7 Jan 2003, Perry E. Metzger wrote: > I don't know anyone who trades video files -- they're pretty big and > bulky. A song takes moments to download, but a movie takes many many > hours even on a high speed link. I have yet to meet someone who > pirates films -- but I know lots of hardened criminals who watch DVDs > on Linux and BSD. I'm one of these "criminals". There is some trading of TV shows, but not movies. (Some, but only things that you cannot buy legally.) The few "pre-release" things you find on the file-sharing networks have the same (lack of) quality that the bootleg tapes have. The only large films worth the time are things that you cannot buy. (Although "Song of the South" should be required viewing in schools. It makes racism *boring*.) A XVCD copy of a 22 minute TV show runs about 425 megs. Anything smaller tends to look like crap. Multiply that out to a feature length film and you find out why it is impractical to trade films in this manner. (It is not worth the 2 days it will take for the download. Most people will go out and buy it than waste the time.) > Many nights, I close the blinds and illegally use the computer I > lawfully paid for to view the DVDs I lawfully paid for. To do that, I > make use of DeCSS. My nice Unix based DVD player, ogle, needs it to > read the drive. A little later this evening I'll be watching an > episode of "I, Claudius" I bought and paid for, using this "criminal" > software combination. Hopefully no one will learn of my shamefully > immoral act. Please don't tell anyone. Not to mention the two seasons of Futurama that are only available on Region 2 PAL DVDs. (Or the other movies and TV shows not allowed by your corporate masters.) "They Live" is another film only available from Region 2. Maybe it tells too much about the movie industry... - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: DeCSS, crypto, law, and economics
On Wed, 8 Jan 2003, Nomen Nescio wrote: > John S. Denker writes: > > The main thing the industry really had at stake in > > this case is the "zone locking" aka "region code" > > system. > > I don't see much evidence for this. As you go on to admit, multi-region > players are easily available overseas. You seem to be claiming that the > industry's main goal was to protect zone locking when that is already > being widely defeated. Try selling a regionless player in this country. It happens, but not in public. Region codes make them tons of money. (They are economic zones, nothing else.) > Isn't it about a million times more probable that the industry's main > concern was PEOPLE RIPPING DVDS AND TRADING THE FILES? Movies are > freely available on the net, just like MP3s, and the DeCSS software was > the initial technology that made ripping DVD's possible. Many people > would rather get something for free than to pay for it, and DVD ripping > allows that for movies. The MPAA obviously is afraid of following the > RIAA into oblivion. The think that does not get press is that there is a bunch of money being made on the players themselves. Having DeCSS allows you to counterfeit players and avoid the licence fees. It also showed that they were generally stupid gits since the CSS algorythm has only 24 effective bits in the key. Brute forcing the key once you know this takes *seconds* on my PC. Snake oil makes the discs play so much smoother... - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Did you *really* zeroize that key?
way for an implementation to know whether the program is running/will run in emulated hardware rather than real hardware, nor whether or not a logic alalyser is/will be attached to the bus. Logic analysers and hardware emulators would allow the accesses to volatile storage to be observed, and the implementation would have to ensure that the observations matched the behaviour intended by (the orthodox interpretation of) the volatile qualifier. >* standards-compliant compilers normally distinguish > between "conformant" source programs and "noncon- > formant" source programs. [...] so, in the case of > "volatile," a compiler won't necessarily be bound > by the "rules of the abstract machine," unless the > source program strictly conforms to the language > spec's "best practice" definition of how a C/C++ > program ought to look. True. But any compiler that tried to use such arguments to weasel out of the requirement to handle volatile in the expected way would become unpopular. >* finally, my friend gives the example of a compiler > that might decide to make a copy of our key buffer > at runtime, in pursuit of some optimization. the > compiler might have the program zeroize one copy of > the key, but not the other copy. as long as the > program's end result turns out to be "correct," > such a bizarre trick can still fulfill the language > spec. Declaring the buffer as volatile would remove the compiler's licence to do such optimisation. --apb (Alan Barrett) - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Palladium -- trivially weak in hw but "secure in software"??(Re: palladium presentation - anyone going?)
On Tue, 22 Oct 2002, Rick Wash wrote: > Hardware-based attacks cannot be redistributed. If I figure out how > to hack my system, I can post instructions on the web but it still > requires techinical competence on your end if you want to hack your > system too. > > While this doesn't help a whole lot for a DRM goal (once you get the > non-DRM version of the media data, you can redistribute it all you > want), it can be very useful for security. It can help to eliminate > the 'script kiddie' style of attackers. Not really. It depends on what they are exploiting. Does every piece of code need to be validated all the time? Once a program is running, does something running in its code space get revalidated or soes it just run? I don't see how paladium stops buffer overflows or heap exploits or format bugs or any of the standard exploits that are in use today. (Not without crippling the entire system for bot the user and the programmer.) It seems to change little for script kiddies if the machines are going to communicate with other systems. (Unless the DRM holders will control who and how you can connect as well. And they just might do that as well...) The perveyors of this also claim it will stop spam and e-mail viruses. They only way it can do that is by making paladium based systems incompatable with every non-DRM machine on the planet. (So much for getting e-mail from your relatives!) The only problem this hardware seems to solve is shackling the user into what data they can see and use. If Microsoft follows their standard coding practices, the script kiddie problem will not go away with this technology. It will probably increase. And it will be illegal to effectivly stop them. - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Palladium -- trivially weak in hw but "secure in software"??(Re: palladium presentation - anyone going?)
On Tue, 22 Oct 2002, Nelson Minar wrote: > I doubt it, though. Even a paper-thin shred of hardware protection is > enough to prevent 99% of the people from circumventing DRM technology. > Joe Sixpack isn't going to install a mod chip, and his local computer > store can't do it for him for fear of prosecution for circumventing > copyright protection. If the appliance enforces DRM when you buy it, > that's good enough to guarantee revenue to the copyright holders. In > the US, at least. Until they find out that proper backups are in violation of copyright. Or what happens when the company that controls the DRM mechanism goes under. (Just ask DIVX users how much they enjpy the movies they bought from Circuit City.) - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Horseman Number 3: Osama Used 40 bits
From: "Stef Caunter" <[EMAIL PROTECTED]> > An attacker with floppy boot access to a Win2K system would get reverse > access to that machine's encrypted files only if the recovery cert for > the domain was locally available (unlikely), or if the machine was not > part of a domain. In the two years or so since that EFS attack surfaced, I don't recall ever seeing anyone ask *why* you get access in the stand-alone case. The theory says a private key is encrypted under a random account 'master key' which in turn is encrypted under a key derived from account credentials (password and SID). Since the floppy based chntpw program works by simply overwriting an account's password hash, any subsequent attempt to access a private key should fail. It works because the protected storage service can't handle password resets when they are performed via a different (administrative) account, so it maintains a second copy of each account's master key to recover from such events. I believe the second copy is encrypted under some system secret (in a domain this secret lives on the domain controller), but information about this Win2K feature is scarce or opaque. The documentation for WinXP implies this has changed i.e. there is no automagic recovery of an account's master key if the password is reset via another account. However there is a suggested recovery method that uses the umm.. innovative Password Reset Disk. -Alan- - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: password-cracking by journalists...
On Mon, 21 Jan 2002, Peter Trei wrote: > >17 USC 1201(a)(1)(A): > >No person shall circumvent a technological measure that > >effectively controls access to a work protected under > >this title. > > I'm sure I'm picking nits here (and I praise God every day that > I Am Not A L*wy*r), but what does 'effectively' mean? If it can be > broken, was it effective? What level of work is required to make > it an 'effective technological measure'? If the standard is 'anything, > including rot13', then why is the word present in the rule at all? When I last brought this up (29 to 30 July 2001, Subject: Effective and ineffective technological measures), people posted references to two slightly different sections that try to define what "effectively protects" and "effectively controls" means: 1201(b)(2)(B): a technological measure ''effectively protects a right of a copyright owner under this title'' if the measure, in the ordinary course of its operation, prevents, restricts, or otherwise limits the exercise of a right of a copyright owner under this title. 1201(a)(3)(B): a technological measure ''effectively controls access to a work'' if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work.' The key phrase seems to be "in the ordinary course of its operation". If you publish the fact that you use rot to protect your copyrighted material, but keep secret the fact that n = 13, then the ordinary course of operation of the decryption process requires the application of this secret value, so the process "effectively controls access" and "effectively protects". The fact that somebody can guess the secret value would seem to have no bearing on whether rot "effectively" does anything. --apb (Alan Barrett) - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Criminalizing crypto criticism
On Tue, 31 Jul 2001, Rick Smith at Secure Computing wrote: > There are probably enough "cryptography researchers" out there that even a > large vendor won't feel tempted to harass them all proactively. All they have to do is make a messy example out of one or two. (It also helps if you can get a prosecutor that is working on a promotion to help out.) [EMAIL PROTECTED] | Note to AOL users: for a quick shortcut to reply Alan Olsen| to my mail, just hit the ctrl, alt and del keys. "All power is derived from the barrel of a gnu." - Mao Tse Stallman - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Company Awarded Patent for "Digital Tickets" (was Re: GigaLaw.com Daily News, July 30, 2001)
On 31 Jul 2001, Derek Atkins wrote: > This also looks very similar to my Master's Thesis, where I even use > the term "digital ticket"! Sheesh. It also sounds a lot like Kerberos. > Peter Wayner <[EMAIL PROTECTED]> writes: > > > I discuss this in both editiions of _Digital Cash_. I wonder if this > > is prior art that reads against the patent. > > > > -Peter > > -- >Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory >Member, MIT Student Information Processing Board (SIPB) >URL: http://web.mit.edu/warlord/PP-ASEL-IA N1NWH >[EMAIL PROTECTED]PGP key available > > > > - > The Cryptography Mailing List > Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED] > [EMAIL PROTECTED] | Note to AOL users: for a quick shortcut to reply Alan Olsen| to my mail, just hit the ctrl, alt and del keys. "All power is derived from the barrel of a gnu." - Mao Tse Stallman - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Re: Criminalizing crypto criticism
On Friday 27 July 2001 11:13, Steven M. Bellovin wrote: > In message <[EMAIL PROTECTED]>, Declan McCullagh writes: > >One of those -- and you can thank groups like ACM for this, if my > >legislative memory is correct -- explicitly permits encryption > >research. You can argue fairly persuasively that it's not broad > >enough, and certainly 2600 found in the DeCSS case that the judge > >wasn't convinced by their arguments, but at least it's a shield of > >sorts. See below. > > It's certainly not broad enough -- it protects "encryption" research, > and the definition of "encryption" in the law is meant to cover just > that, not "cryptography". And the good-faith effort to get permission > is really an invitation to harrassment, since you don't have to > actually get permission, merely seek it. Even worse is if the "encryption" is in bad faith to begin with. (i.e. They know it is broken and/or worthless, but don't want the general public to find out.) Imagine some of the usual snake-oil cryto-schemes applied to copyrighted material. Then imagine that they use the same bunch of lawyers as the Scientologists. This could work out to be a great money-making scam! Invent a bogus copy protection scheme. Con a bunch of suckers to buy it for their products. Sue anyone who breaks it or tries to expose you as a fraud for damages. I mean if they can go after people for breaking things that use ROT-13 (eBooks) and 22 bit encryption (or whatever CSS actually uses), then you can go after just about anyone who threatens your business model. I guess we *do* have the best government money can buy. We just were not the ones writing the checks... - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
Effective and ineffective technological measures
The DMCA said: > 1201(a)(1)(A): >No person shall circumvent a technological measure that effectively >controls access to a work protected under this title. What does "effectively" mean here? If it has its plain english meaning, then one could argue that ROT13, CSS (and anything else that can easily be broken) are *ineffective* technological measures, so circumventing them is not prohibited by this clause. Distinguishing effective measures from ineffective measures might reduce to measuring the resources required to break them. Or does the clause really mean "No person shall circumvent a technological measure that *purports to control* access to a work protected under this title"? --apb (Alan Barrett) - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
