Frontmatter Pages
Total Page:16
File Type:pdf, Size:1020Kb
Lecture Notes in Computer Science 2696 Edited by G. Goos, J. Hartmanis, and J. van Leeuwen 3 Berlin Heidelberg New York Hong Kong London Milan Paris Tokyo Joan Feigenbaum (Ed.) Digital Rights Management ACM CCS-9 Workshop, DRM 2002 Washington, DC, USA, November 18, 2002 Revised Papers 13 Series Editors Gerhard Goos, Karlsruhe University, Germany Juris Hartmanis, Cornell University, NY, USA Jan van Leeuwen, Utrecht University, The Netherlands Volume Editor Joan Feigenbaum Yale University Department of Computer Science P.O. Box 208285, New Haven, CT 06520-8285, USA E-mail: [email protected] Cataloging-in-Publication Data applied for A catalog record for this book is available from the Library of Congress. Bibliographic information published by Die Deutsche Bibliothek Die Deutsche Bibliothek lists this publication in the Deutsche Nationalbibliografie; detailed bibliographic data is available in the Internet at <http://dnb.ddb.de>. CR Subject Classification (1998): E.3, C.2, D.2.0, D.4.6, K.6.5, F.3.2, H.5, J.1, K.4.1 ISSN 0302-9743 ISBN 3-540-40410-4 Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer-Verlag. Violations are liable for prosecution under the German Copyright Law. Springer-Verlag Berlin Heidelberg New York a member of BertelsmannSpringer Science+Business Media GmbH http://www.springer.de © Springer-Verlag Berlin Heidelberg 2003 Printed in Germany Typesetting: Camera-ready by author, data conversion by Olgun Computergrafik Printed on acid-free paper SPIN: 10927984 06/3142 543210 Preface Increasingly, the Internet is used for the distribution of digital goods, includ- ing digital versions of books, articles, music, and images. This new distribution channel is a potential boon to both producers and consumers of digital goods, because vast amounts of material can be made available conveniently and inex- pensively. However, the ease with which digital goods can be copied and redis- tributed makes the Internet well suited for unauthorized copying, modification, and redistribution. Adoption of new technologies such as high-bandwidth con- nections and peer-to-peer networks is currently accelerating both authorized and unauthorized distribution of digital works. In 2001, the ACM initiated an annual series of workshops to address technical, legal, and economic problems posed by the digital distribution of creative works. The 2002 ACM Workshop on Digital Rights Management (DRM 2002), held in Washington, DC on November 18, 2002, was the second in this annual series. This volume contains the papers presented at that very well attended and stimulating workshop. The success of DRM 2002 was the result of excellent work by many people, to whom I am extremely grateful. They include Sushil Jajodia, Charles Youman, and Mary Jo Olsavsky at George Mason University, the members of the Program Committee, my assistant, Judi Paige, and my student Vijay Ramachandran. April 2003 Joan Feigenbaum New Haven, CT, USA Program Chair, DRM 2002 VI Program Committee Yochai Benkler (New York University, Law School) Dan Boneh (Stanford University, Computer Science Dept.) Willms Buhse (Bertelsmann Digital World Services) Joan Feigenbaum (Yale University, Computer Science Dept.) Neil Gandal (Tel Aviv University, Public Policy Dept.) John Manferdelli (Microsoft, Windows Trusted-Platform Technologies) Moni Naor (Weizmann Institute, Computer Science and Applied Math Dept.) Florian Pestoni (IBM, Almaden Research Center) Tomas Sander (Hewlett-Packard Labs) Michael Waidner (IBM, Zurich Research Center) Moti Yung (Columbia University, Computer Science Dept.) Organization DRM 2002 was held in conjunction with the 9th ACM Conference on Computer and Communication Security (CCS-9) and was sponsored by ACM/SIGSAC. Table of Contents ACM DRM 2002 A White-Box DES Implementation for DRM Applications .............. 1 Stanley Chow, Phil Eisen, Harold Johnson (Cloakware Corporation), and Paul C. van Oorschot (Carleton University) Attacking an Obfuscated Cipher by Injecting Faults .................... 16 Matthias Jacob (Princeton University), Dan Boneh (Stanford University), and Edward Felten (Princeton University) Breaking and Repairing Asymmetric Public-Key Traitor Tracing ......... 32 Aggelos Kiayias (University of Connecticut) and Moti Yung (Columbia University) Key Challenges in DRM: An Industry Perspective ...................... 51 Brian A. LaMacchia (Microsoft Corporation) Public Key Broadcast Encryption for Stateless Receivers ................ 61 Yevgeniy Dodis and Nelly Fazio (New York University) Traitor Tracing for Shortened and Corrupted Fingerprints ............... 81 Reihaneh Safavi-Naini and Yejing Wang (University of Wollongong) Evaluating New Copy-Prevention Techniques for Audio CDs .............101 John A. Halderman (Princeton University) Towards Meeting the Privacy Challenge: Adapting DRM ................118 Larry Korba (National Research Council of Canada) and Steve Kenny (Independent Consultant) Implementing Copyright Limitations in Rights Expression Languages .....137 Deirdre Mulligan and Aaron Burstein (University of California) The Darknet and the Future of Content Protection .....................155 Peter Biddle, Paul England, Marcus Peinado, and Bryan Willman (Microsoft Corporation) Replacement Attack on Arbitrary Watermarking Systems ...............177 Darko Kirovski and Fabien A.P. Petitcolas (Microsoft Research) FAIR: Fair Audience InfeRence ......................................190 Rob Johnson (University of California) and Jessica Staddon (Palo Alto Research Center) X Table of Contents Theft-Protected Proprietary Certificates ..............................208 Alexandra Boldyreva (University of California) and Markus Jakobsson (RSA Laboratories) Author Index .................................................221 A White-Box DES Implementation for DRM Applications Stanley Chow1, Phil Eisen1, Harold Johnson1, and Paul C. van Oorschot2 1 Cloakware Corporation, Ottawa, Canada {stanley.chow,phil.eisen,harold.johnson}@cloakware.com 2 School of Computer Science, Carleton University, Ottawa, Canada [email protected] Abstract. For digital rights management (drm) software implementa- tions incorporating cryptography, white-box cryptography (cryptograph- ic implementation designed to withstand the white-box attack context)is more appropriate than traditional black-box cryptography. In the white- box context, the attacker has total visibility into software implementa- tion and execution. Our objective is to prevent extraction of secret keys from the program. We present methods to make such key extraction diffi- cult, with focus on symmetric block ciphers implemented by substitution boxes and linear transformations. A des implementation (useful also for triple-des) is presented as a concrete example. 1 Introduction In typical software digital rights management (drm) implementations, crypto- graphic algorithms are part of the security solution. However, the traditional cryptographic model – employing a strong known algorithm, and relying on the secrecy of the cryptographic key – is inappropriate surprisingly often, since the platforms on which many drm applications execute are subject to the control of a potentially hostile end-user. This is the challenge we seek to address. A traditional threat model used in black-box symmetric-key cryptography is the adaptive chosen plaintext attack model. It assumes the attacker does not know the encryption key, but knows the algorithm, controls the plaintexts en- crypted (their number and content), and has access to the resulting ciphertexts. However, the dynamic encryption operation is hidden – the attacker has no visibility into its execution. We make steps towards providing software cryptographic solutions suitable in the more realistic (for drm applications) white-box attack context: the attacker is assumed to have all the advantages of an adaptive chosen-text attack, plus full access to the encrypting software and control of the execution environment. This includes arbitrary trace execution, examining sub-results and keys in memory, performing arbitrary static analyses on the software, and altering results of sub- computation (e.g. via breakpoints) for perturbation analysis. This research was carried out at Cloakware. J. Feigenbaum (Ed.): DRM 2002, LNCS 2696, pp. 1–15, 2003. c Springer-Verlag Berlin Heidelberg 2003 2 Stanley Chow et al. Our main goal is to make key extraction difficult. While an attacker con- trolling the execution environment can clearly make use of the software itself (e.g. for decryption) without explicitly extracting the key, forcing an attacker to use the installed instance at hand is often of value to drm systems providers. How strong an implementation can be made against white-box threats is unknown. We presently have no security proofs for our methods. Nonetheless, regardless of the security of our particular proposal, we believe the general approach of- fers useful levels of security in the form of additional protection suitable in the commercial world, forcing an attacker to expend