AACS Vows to Fight Bloggers

Jonas Wisser writes "The BBC is carrying the story that AACS has promised to take action against those who have posted the AACS crack online. Michael Ayers, chairperson of AACS, noted that the cracked key has now been revoked, and went on to say, 'Some people clearly think it's a First Amendment issue. There is no intent from us to interfere with people's right to discuss copy protection. We respect free speech.' The AACS website tells consumers how they can 'continue to enjoy content protected by AACS' by 'refreshing the encryption keys associated with their HD DVD and Blu-ray software players.'"

Cue oft-used Leia quote...

...The more you tighten your grip, Tarkin, the more star systems will slip through your fingers.

Actually, as I said yesterday [slashdot.org], ignore these threats. Go out and blog. Understand that freedom of speech is NOT a government-granted freedom, it is an inherent one that all people of all citizenship must understand. The U.S. Constitution's (Bill of Rights) 1st Amendment does not say "You are free to speak," it says that Congress shall make NO LAW restricting the freedom of speech -- NO law. Discussing encryption mechanisms is free speech, and Congress shall not abridge that. As for patents and trademark and the rest, as long as you do not mimic the mechanism in your own hardware or software, you're fine, Constitutionally. As long as you do not quote verbatim the actual code used to create this mechanism, you're not violating copyright. The DMCA is unconstitional, and regardless of what Congress, the Supreme Court, the President, or any company says, it is non-binding in terms of the moral realization that Congress, and honestly no State organization, can prevent you from freely airing your opinions. You are free to talk, but no one has to listen.

From yesterday's post I made about "legal recommendations for bloggers," go out and blog. Say what you want to say. There are more of us than there are of them -- not only can they not afford to go after everyone, they can not afford to go after even a small percentage. Let some bloggers get caught, and all it will do is show other people that non-violent actions should not be criminalized or penalized.

AACS, your days are numbered. Your salaries will end. Your powers will be diminished. It won't be because of competition from another company (that you are likely in bed with, in terms of promoting the abuse of State power), it will be because millions upon millions of people will ignore you, and all you do, in trying to revoke our inherent (and in my opinion, God-given) right to speak freely amongst ourselves.

Re:Cue oft-used Leia quote...

Who would want to put 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 into their hardware or software? :)

Re:Cue oft-used Leia quote...

Who would want to put 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 into their hardware or software? :)

Well, here's a screencap of HD-DVD.org showing the key [mac.com] on their own web site!

I guess they're going to have to go after themselves, now. Ve haff the evidence!

Re:Cue oft-used Leia quote...

the quesion i have is this.. say you post the key on your site.. you get a take down notice.. what does that notice say? does it say to take down the key or to take down "insert key here" - what if you post it and play dumb that you don't know it is the key.. they would have to tell you what it is they wnat taken down.. and in the document would need to be "insert key here" at that point cause it is a leagl document if they take you to court the key is in the document and is now public record.

then you take it down and repost it with a refrence to the public record document.

Re:Cue oft-used Leia quote...

Here's a timeline:

The hex code is a key. The key has certain protections under U.S. law. They have revoked the key. It is no longer a key. It no longer has certain protections under U.S. law. It is just a number that used to be a key. You publish the former key on your website. Nothing happens.

There, wasn't that fun? :)

Re:Cue oft-used Leia quote...

They (the AACS-LA) are playing games with words.

When they say they have "revoked the key", they mean they have revoked the device key for a specific software player. They have not done anything about the processing key that is floating around.

Re:Cue oft-used Leia quote...

...The more you tighten your grip, Tarkin, the more star systems will slip through your fingers.

Yes. Just before the Death Star blew her home world to smithereens.

But let's hope that's not the case here, eh?

Re:Cue oft-used Leia quote...

> > ...The more you tighten your grip, Tarkin, the more star systems will slip through your fingers.
>
> Yes. Just before the Death Star blew her home world to smithereens.

"I feel something hilarious has happened. As if 13,256,278,887,989,457,651,018,865,901,401,704,640 geeks cried out in laughter, and were never silenced."

> But let's hope that's not the case here, eh?

Not very long ago, on a website only a few dozen hops away, a great adventure took place.

(cue scrolling text)

Code Wars IV: A New Hope

"It is a period of civil war. Rebel bloggers, striking from all your base, have won their first victory against the evil MAFIAA Empire.

"During the battle, Rebel spies managed to steal secret keys to the MAFIAA's ultimate weapon, the AACS, an armored DRM system with enough power to annoy an entire planet.

"Pursued by the AACSLA's sinister agents, Princess Leia races home aboard her starship, custodian of the leaked key that can save her people and restore fair use to the digital media..."

Re:Cue oft-used Leia quote...

Let's not forget since this is an HDDVD related discussion, the scene after this one in the new HDDVD special edition, in which Han shoots ET with a walkie talkie.


C-3PO: I would much rather have gone with Master Luke than stay here with you. I don't know what all this trouble is about, but I'm sure it must be your fault.
R2-D2: 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
C-3PO: You watch your language!

Re:Cue oft-used Leia quote...

This may be one of them. How much does it matter if you can't speak a string of hexes for copyright/DMCA reasons? It doesn't.

Dude it's a number. Granted a large number, but still just a number.

Are you telling me that projects like the one trying to find the largest prime can't publish that they've tested this number as a prime?

There are certain things you should NOT be allowed to own - a number is one of them.

All information can be codified as a number. As much as I disklike copyrights themselves,saying it's just a number doesn't change the issue one bit.

Re:Cue oft-used Leia quote...

1 (C) Me. I just copyrighted the number one. Therefore, all numbers, since they can be derived from a number I copyrighted, also belong to me. Layne P.S. Are these colors pretty??? I'm thinking about using this as my web site color scheme..... (just paste this into an HTML document to see the colors).

<html>
<body>
<table>
<tr><td bgcolor="#0009F9">00 09 F9</td></tr>
<tr><td bgcolor="#11029D">11 02 9D</td></tr>
<tr><td bgcolor="#74E35B">74 E3 5B</td></tr>
<tr><td bgcolor="#D84156">D8 41 56</td></tr>
<tr><td bgcolor="#C56256">C5 63 56</td></tr>
<tr><td bgcolor="#88C000">88 C0 00</td></tr>
</table>
</body>
</html>

Re:Cue oft-used Leia quote...

All information can be codified as a number. As much as I disklike copyrights themselves,saying it's just a number doesn't change the issue one bit.

However, what might change the issue is the fact that this is not a creative work, or anything even remotely resembling one. Rather, it is a purely functional number, essentially the equivalent of a password (which are not copyrightable). You are correct, people skew the issue by focusing on the fact that it is a hexadecimal number; the real issue is that it contains no expression of anything, it is merely a key to a digital lock somewhere, likely spat out by a random number generator. The distribution of such a key might be illegal as well (trade secret perhaps?), but I see absolutely no reason it should be prohibited based on copyright.

From what I can tell, the AACS are not actually claiming copyright protection for the key, though, they are instead invoking part of the DMCA, claiming that the key's distribution violates the prohibition on releasing software to circumvent copyright protections. This is a separate issue, and one that is not easily resolved. To be honest, in spirit, they are probably right - people who distribute this key are doing so to stick it to the industry, and by the spirit of the law (whether you agree with it or not - I do not), should probably be considered to be doing something illegal. But I don't really think the key itself could reasonably qualify as software, and I think the DMCA is very specific about banning software that undoes copy protection, and never mentions a password that could be USED in software to undo copy protection, so everyone might be on fairly good legal ground, technically at least. Then again, I'm no lawyer, so who knows...I imagine judges get annoyed at people for this stuff since at root, people disagree with the laws in place and are pushing the boundaries of those laws just to piss on them, so I wouldn't want to be the guinea pig that tests out this stuff in court...

Re:Cue oft-used Leia quote...

But I don't really think the key itself could reasonably qualify as software, and I think the DMCA is very specific about banning software that undoes copy protection

Actually, it isn't. What it actually says is:

No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that--

• is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;
• has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or
• is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.

(Emphasis mine.) I think the AACS LA could easily argue that the processing key is at the very least a "part thereof".

Re:Cue oft-used Leia quote...

The source code to Windows Vista is "just a number" too. Alan Turing described all this decades ago. Although I think we can all agree that it is protected by copyright.

I don't think you can copyright 14 bytes. But the issue is not copyright, it is the violation of DMCA by providing a tool necessary to break any sort of copyright protection measures.

you can't post plans to view scrambled cable TV anymore (in the US), you can't post utilities designed to decode CSS so you can watch your DVDs on your computer. etc.

What's dumb is these companies going after average joes rather than people who are pressing boatloads of DVDs and importing them to the US. Or people who are hosting huge pay torrent sites to download movies. Or couriers posting the latest films on Usenet to be distributed to sites all over the world.

so will I be in trouble? My DNS resolves any string you give it, so if someone goes to http://09f911029d74e35bd84156c56356.rm-f.net/ [rm-f.net] they will get a page. (although not [currently] related to those keys)

Re:Cue oft-used Leia quote...

The source code to Windows Vista is "just a number" too. Alan Turing described all this decades ago. Although I think we can all agree that it is protected by copyright.

No we cannot. Many of us believe that for that very reason (attempt at "ownership" or integer numbers, in defiance of the very phillosphical ideas of "ownership" or "trade") the so called "copyrights" are nothing but a scam, although they might have originated as an badly thought out, naive scheme to promote arts and science.

All of the so-called "intellectual property" schemes invariably fail the test of basic logic when analysed in depth, primarily due to the fact that they attempt to treat information as an entity which is subject to "trade" or "private ownership", for which information simply lacks the required attributes.

Re:Cue oft-used Leia quote...

Dude it's a number. Granted a large number, but still just a number.

+1 Funny, -1 Dishonest.

To wit: Can I publicly post your credit card number, expiration date, and CVN? They're just numbers... and how can ordinary numbers have implications for property and finances?

In fact, I have a list here of 10,000 valid bank-account and PIN numbers. My right to distribute them is a First Amendment Issue, damnit!

inapt analogy

Every one of the words in your post can be used as a password. That doesn't justify prohibiting their publication.

The AACS key is a password that's, in effect, distributed to everyone who owns a HDDVD and is furthermore useless to you unless you possess an HDDVD. It's an open secret. In that respect it's different from a credit card, and your analogy is inapt.

And it's not illegal to post a string of digits that may or may not be a credit card, without more, and the same should apply in the case of the HDDVD key.

Re:Cue oft-used Leia quote...

But, to be honest, we all know that a truly free society isn't free at all. You have to have some rules for life to continue. This may be one of them.

I disagree. A free society is one where all citizens are equally free from legal force that gives power to some and takes power away from others, without their express consent (ie, a contract). In a free society, you and I can contract to limit each other -- but the State can not unless we individually tell them that they can. Also, a free society is one where an individual can make any decision they want, as long as they do not directly harm the physical property or body of another individual. Speech can not do physical harm, so speech can not be criminal, no matter how repulsive it is. The effect of the speech could be a physical reaction, but if that physical reaction is performed by a person other than the speech giver, the speech giver has not caused harm.

People will visit their library more. They'll go walk at the park with friends more. So while I think it's good to fight for our rights, the result wouldn't be that bad. "Burn the land, boil the sea, but you can't take the sky from me..." We'll find plenty other things to occupy ourselves with. Who cares about AACS and movies and stuff when you can find something else just as, if not more entertaining, for half the price?

Entertainment has more to do with time preference decisions than just saving "money" doing something that might seem entertaining. Someone who is very busy and who has a high hourly-value to the market may want a quick relief of "getting away from reality" and may be more than happy to pay $150 per person to see an Opera. Someone who is not so busy, and may not command a high hourly-value to the market may be more entertained reading a book, which could take hours or days or weeks. It all boils down to how you (and the market) value yourself.

Personally, I see nothing wrong with paying $20+ to buy a movie -- if I can use it the way I want to. I prefer to live in a tiny home so that I do not have to pay for extra unused space. This means I have no room for the clutter of physical movies (DVDs, VHS, etc). Instead, I have a great Media Center PC (yes, Microsoft), and I have 1TB of movies and TV shows available to watch based on my mood. This is considered illegal, even though I have paid for all the movies and shows I watched. I also used my own time/labor to put those movies/TV shows on that PC. I've harmed no one physically, so the law is unjust and ridiculous. Provide me with a process to reimburse the authors/distributors/producers of a given content, and also allow me to put that content into a system that works with my life, and I will pay AND continue to be a customer. I don't believe in NOT reimbursing those actively involved in the creation of content. I have no desire to pay for the lawyers, DRM researchers, or those who lobby the State to use force against me to uphold their monopoly.

Re:Cue oft-used Leia quote...

I just wrote this:
#include <stdio.h>
#include <stdlib.h>

unsigned char key[16] = {
  0x09, 0xf9, 0x11, 0x02,
  0x9d, 0x74, 0xe3, 0x5b,
  0xd8, 0x41, 0x56, 0xc5,
  0x63, 0x56, 0x88, 0xc0};

int main() {
  int s; /* start char */
  int b; /* byte # */
  for(s = 65 ; s <= 75 ; ++s) {
    printf("Start = %c: ", s);
    for(b = 0 ; b < 16 ; ++b) {
      fputc(s + ((key[b] & 0xf0) >> 4), stdout);
      fputc(s + (key[b] & 0x0f), stdout);
    }
    fputc('\n', stdout);
  }
  exit(0);
  return 0;
}

And its output:

Start = A: AJPJBBACJNHEODFLNIEBFGMFGDFGIIMA
Start = B: BKQKCCBDKOIFPEGMOJFCGHNGHEGHJJNB
Start = C: CLRLDDCELPJGQFHNPKGDHIOHIFHIKKOC
Start = D: DMSMEEDFMQKHRGIOQLHEIJPIJGIJLLPD
Start = E: ENTNFFEGNRLISHJPRMIFJKQJKHJKMMQE
Start = F: FOUOGGFHOSMJTIKQSNJGKLRKLIKLNNRF
Start = G: GPVPHHGIPTNKUJLRTOKHLMSLMJLMOOSG
Start = H: HQWQIIHJQUOLVKMSUPLIMNTMNKMNPPTH
Start = I: IRXRJJIKRVPMWLNTVQMJNOUNOLNOQQUI
Start = J: JSYSKKJLSWQNXMOUWRNKOPVOPMOPRRVJ
Start = K: KTZTLLKMTXROYNPVXSOLPQWPQNPQSSWK

Let's just start making blog posts where the first letter of each word fits one of these patterns (and include the key via the subject line).  Hell, you could write the README to a hddvd playing program so that each paragraph started with one letter, and the Makefile could generate the key from the README, so you wouldn't be distributing the key with the program...

Re:Cue oft-used Leia quote...

Forget stealing.

I just want a working Video jukebox solution. The major players like Sony don't seem very interested in providing one and the industry will sue anyone else that tries.

The whole point of capitalism is that the garage shops get to fill niches that the megacorps don't want to bother with.

The sad fact remains that I will easily be able to pull BR/HD-DVD's into my Myth setup before there's a proper BR/HD-DVD jukebox from Sony.

Re:Cue oft-used Leia quote...

Try Philips instead of Sony, the difference is obvious when you look at their players. Philips have no labels, or movie making divisions, so they have nothing to lose with hardware that is lax about playing as many file types as possible. They already have DVD players with USB ports for Harddrives that play Divx, and media players that record video feed to MPEG-2, play back DivX, and don't have any DRM to speak of.

Also very easy to crack players, as far as region free goes.

Re:Since they're just using Primes

But it's not a prime - that's obvious, since the last digit of the decimal expansion is 0.

Oops - have I just infringed someone's valuable intellectual property?

What if I said it's also divisible by 19?

Or that the next-to-last digit is 4?

Could a lawyer please advise how many clues I can provide before I might get sued?

Re:Since they're just using Primes

AFAIK, AACS is just AES. So they key is just 128 bits of random data; it does not have to have any other special qualities.

HAND!

Michael, you're dumb even by MAFIAA standards

"This is the first round and will not be the last," he added.

Well, he certainly has that part right. What he fails to appreciate is that he will be on the losing end of every single one of those rounds. Even as he tries to downplay the key by saying it has been revoked, AACS has already lost the second round [arstechnica.com] (as hackers have created a hack that CAN'T be revoked).

Always a step behind, buddy. But feel free to keep wasting your money and pissing people off.

Re:Michael, you're dumb even by MAFIAA standards

They most definitely won't be on the losing side in every round - they just won one, by revoking the key making it useless for future discs. There will be new rounds, and they will go back-and-forth in this fashion for quite some time.

And that Ars Technica article is widely misunderstood and misinterpreted. That hack is, indeed, irrevokable, but it is also completely impractical for anyone but the most dedicated hacker, and it doesn't give you all the data needed to decrypt a disc, but only the Volume ID.

Re:Michael, you're dumb even by MAFIAA standards

Thats an odd definition of "winning the round"...that the key won't be useful on future discs? That's kind of like a boxer getting the crap beat out of them in round 1 and then claiming they won round 1 because they are going to come back fighting in round 2.

I'm not sure bloggers are the real audience

What he fails to appreciate is that he will be on the losing end of every single one of those rounds. Even as he tries to downplay the key by saying it has been revoked, AACS has already lost the second round (as hackers have created a hack that CAN'T be revoked).

The real target of this action is likely a different audience, namely Hollywood. The AACS doesn't have to make their DRM undefeatable. They do need to convince their customers - and remember, that's not us - of the value of their work. And when their DRM is broken and seen to be broken, they need to convince those who want to believe that they at least have not lost faith in the cause.

So we may talk about winning and losing, and people like use may be the targets of lawsuits. But I think we may be giving ourselves airs when we assume that for the other side it's about us. If, on the other hand, we figure out who our real audience is then we have a better chance.

The 'unrevocable hack'

(as hackers have created a hack that CAN'T be revoked)

I spent a while trying to get my head around AACS last night, and the bottom line is that what comes out of the un-revocable hack that you mention isn't the same thing as what's being posted around the internet, and what the AACSLA has the whole revocation scheme for.

Oversimplification ahead, and I may have some of the details wrong or, but this is the gist of it: the content -- the movie itself -- is encrypted with title keys. These title keys are encrypted with a volume unique key (VUK). The VUK is composed of two parts, a media key and a Volume ID.

The Media Key is the thing that you get with the code that's being posted all over the Internet (the Processing Key). Processing Keys can be revoked, but only for new discs -- so the discs that are out in circulation as of the compromise of the Processing Key, are out. They're cracked. However, future discs will use a new Processing Key, and that one that's around on the internet won't work ... so the hackers will need to go back and sniff/debug an updated software player to figure out the new Processing Key.

The "un-revocable hack" you mentioned, doesn't have anything to do with the Media Key, it's all about the Volume ID. The purpose of the Volume ID is to prevent bit-for-bit copying. In a lot of ways it's very similar to parts of the CSS system used on DVDs right now; it's a key specific to each batch of pressed discs, written to the disc in a way that's difficult to read off manually (the drive isn't supposed to let the user see it at all), and impossible to write to a blank disc ... so if you made a "bit-perfect" copy of a disc, the Volume ID wouldn't be there (because you can't read it and/or because you can't write it to the new disc) and you'd be missing one of the elements required to decrypt.

So: while the Volume ID hack involving the XBox360 drive is a major step forwards (backwards if you're the AACS!), it's not a silver bullet, and it doesn't make future titles trivial to compromise. There's still going to be a cat-and-mouse game in the near future, where the AACS will try to revoke Processing Keys and try to discourage the publication of new ones as discs are released. (It's been pointed out by several people now, that the AACS' over-the-top reaction to publication of the processing key, may indicate that they've realized that their revocation procedures aren't nearly as fast or as flexible as the people who are going to be compromising them.)

lol battle of the dumb AACS Michaels

Here's Michael Ripley from back before AACS was finished.

"Backers of the protection method are betting that AACS technology will finally thwart unauthorized copying of DVDs while allowing consumers to distribute movies legitimately over networks within their homes, play them on a variety of devices (standard televisions, portable movie players, and laptop computers), and store them on home media servers. "We wouldn't be investing our time otherwise," says Michael Ripley, the chairman of the AACS alliance's technical working group."

Well, Michael(s): any high school student could've told you this would never work. The reason is the same as always: you have to provide the machine with everything it needs to play back the disc. It's difficult (college students would say "impossible") to provide those things to the machine without providing those things to the machine. Cf. Cory's age-old piece;
http://craphound.com/hpdrm.txt [craphound.com]

09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

RC4; Base64 Encoding; Key = "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0"

mI0mUyOUE8S24UAsIVqR12Z8_P1WveIRFqpBO4FEeH_TPGuc0t Ds1V97iWQx
QDhXbGpiERffrXz6lvQpcOFlDY_AXJWGw7f9saosuSBDj7c4ex ySmgi8Bded
l4APCHQIzYXETWu"xkhR4MNnw7zI_mBf5YJOLJ3DKD6wSQ6PvG AsLVTLLTc0
ZAPkCzunB7xarymAJEOOu0fe"tdhy"rZZY5XOSiipi6vf_84xJ Yg11Y576o"
rPfhQQNneUX"JGXWhN3bgRIZwIOoIUu8c282MQ5_Grb6ALolIj Ue7R919DRx
j7cWlf2G2V467N4EjnJbR"9j_4oDCytfpkQBFX0jGOCsjRYcLl wzs_UvVSRh
HH7DzXzB2tPz7i"L1Unvljgh05d1qoFs2N38qWugtaUMGM9RXh nyCcADUH6G
yUXVAbsO9ZcD33UKD80sulFF0FiSxIr4NOiRv4EZBoIU3eY1Ff GSm7HfCs_i
yi4NfhRLz3ai50dbx0CWCJwlvti_gsXgQLJrE70ihDROzdUyjy BTwMZnuZYL
9AM2M99"s2d"hQxtoj7yTTki2M4dK3Y8_wvSyM8fp5fyyDpJWI Wn1KXh6_Rx
z3W8iYIMIObDRG1H914rayBqj3EPhUDsz2NfVhjYBIxHBPgeW2 q3ZzeFJD5M
saZXht6YNavXOyFLh24D84kXC4weBrJsI598yUpFhg41NB694Q nlxHfxzWhl
vZaHrMlSDxODtGlaU5rfJkODjrCr99Rr6hgQaegXnHE6Oe6iKj P8of4TEJU0
DwDtOw3"khTuVWYDStjRd4w2eOt2wvl24XvC3iDQBIA40uJQhk Fg3voVVPEp
29XXEh_9hplaGD1YBw6pW2yiuyW8ifdaS4Mm7IGdH"6JMgSFgn ceesWk6v0r
k8"H70be7kCOdyDSLX9jLkz"4MF_LD"yaYdWopVnoryVQ9YD5G oYSEXQH_Bo
RqZmxLv2loAoM5WFs2""qGG4yATAMz9zhyuc4wMPZZLiZJhTt_ qmXGJlSjF"
pNNm045ma6vnqBdwtEE00zdjJBhBjz5VMoqPS6EZvQbwbEyiUw wPLEWhn1kz
KJdzO7ATz47fYRWQZNWjy7Uda1P8RPnhSd2FbrL"aOegRzUX_s A1_faWxcxe
Azf

Re:09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

The lameness filter is built on compression ratios and obvious problems with the post. (e.g. ALL CAPS!) Encrypted text rarely compresses well, so it passes with flying colors.