| |||||||||||
The EFF's report on trusted computingThe EFF's report on trusted computingPosted Oct 9, 2003 18:09 UTC (Thu) by proski (subscriber, #104)In reply to: The EFF's report on trusted computing by elanthis Parent article: The EFF's report on trusted computing I don't understand your proposal. Yes, it's possible to check that the user knows the key, but how do you check that the software that has the software key is running in pristine state? What prevents me from running the original software in an emulator as a backend to the software I want to use? What prevents me from modifying the hardware to change the code of the software I'm running, or even the way the code is interpreted? If DRM is developed by people interested in hoarding their so called "intellectual property" rather than in security, then some hard hacks won't be a big problem because it's much cheaper to buy a DVD that to implement them. But if DRM is ever used for real security, e.g. for banking, it may not live up to its promise because it wasn't designed with the real security in mind.
(Log in to post comments)
The EFF's report on trusted computing Posted Oct 9, 2003 19:17 UTC (Thu) by zlynx (subscriber, #2285) [Link] An emulator may not be possible to write.What if the security chip has more secret keys inside of it? It could have a per computer key (My PC, serial #blah), a per distributor key (Gateway), and a chip manufacturer key (IBM). If your emulator can't return the correct response to prove it is a valid security chip, it can be rejected. Now, I suppose some graduate student with time on his or her hands could use an electron microscope and a chemical bath to peel and scan a chip one layer at a time in order to extract the information, but it doesn't seem likely to me. Now, without an emulator, the hardware controls what can be loaded and that is how it knows the software is pristine. Look at Microsoft's XBox. That is using DRM. Mod chips are able to break it enough to fool the local system, but it cannot fool the XBox Live network because the mod chips cannot get real, valid security codes. These things check the software is pristine, prevent writing emulators and prevent modifying the hardware.
The EFF's report on trusted computing Posted Oct 10, 2003 1:39 UTC (Fri) by proski (subscriber, #104) [Link] Leave the chip alone. I think it's safe to assume that a secure self-desctructing chip can be made for a reasonable price with the existing technology. What I mean is that it's possible to change the way how the authorized program interoperates with other hardware, including monitor, keyboard and network.Suppose some company wants me to play their music online but not save it. The authorized software doesn't allow me to save music. But I can run rewire the system so that the decrypted audio signal goes not only to the sound card, but also to an additional device. This is possible for the analog signal, and it should be possible for the digital signal as well, unless the audio card also uses hard encryption and self-destructing technology. Suppose some company wants me to use their browser with advertizing. I can write an emulator of the operating system (not of the authorized program) that would pass through all data to the chip and to the network, but not to the GUI. Then I could write a browser that would display the cache of the authorized browser, but without advertizing. If done right, there would be no way for the contents provider to catch me. It's hard. That's why it wasn't done for X-Box. X-Box is not worth the trouble. But if a bank wants my computer to act an their behalf, they are better off reassessing the risks.
The EFF's report on trusted computing Posted Oct 10, 2003 22:07 UTC (Fri) by zlynx (subscriber, #2285) [Link] Maybe I'm missing something. Can you explain how you get the secure hardware to load your emulator?
The EFF's report on trusted computing Posted Oct 10, 2003 21:46 UTC (Fri) by Ross (subscriber, #4065) [Link] You would be sued for writing the emulator. To write a working one you would have to implement their cryptographic techinques including the secret keys. At it would not be at all easy to obtain the keys from the hardware. It certainly couldn't be done at a software level unless there was a bug in the implementation or you had a key to create an authorized operating system. Good luck.
|
|||||||||||