Hacker News Reader

Comment by Townley | Hacker News Reader

Mind helping me understand this a bit better?

The link mentions that to produce a HDCP-compatible device (eg one that has an HDMI port) it needs to be licensed, pay an annual fee, and make promises to frustrate DRM-mitigation efforts.

If I wanted to make my own monitor with a VGA input (or, more practically, pipe the signals coming from VGA into a program that does something with the feed) I would just have to find a suitable adapter and receive the serial data.

Does this mean that doing so with HDMI (either the real-world DIY monitor, or the in-software feed-ingestion program) would be:

A) Difficult/time-consuming to write due to a lack of open drivers B) Run afoul of IP laws pertaining to the HDMI standard and get me sued C) Prevented by the cryptographic handshake that happens between an approved display and the output drivers D) All of the above?

View on HN

Most of the above, with a couple caveats.

For HDMI, specifically:

A is true, as HDMI requires a pretty ugly IP core on an fpga or an asic to process or produce the phy.

B is also true, as to sell a device with an HDMI port you have to join the group and pay fees. If you're just hacking stuff together for personal use I think you're A-okay here.

C is true ONLY in the case of HDCP protected content, as that handshake does not occur for unprotected content or HDMI 1.0

Also, side note, VGA uses analog R/G/B channels so if you want to pipe signals into the program you'd need an ADC to get useful values from it, and a pretty fast one depending on your resolution.

Also I'm pretty sure the hdcp private keys have been factored, so anyone can now make unauthorized but compatible devices.

All DRM solutions eventually fail. It's an endless race. Companies pour millions and millions into media DRM, and yet all of the content is cracked and uploaded on pirate sites, without fail. They don't seem to understand how much of a waste their efforts are, and the government doesn't seem to realize how pointless, and stifling of innovation and competition laws like DMCA are.

I imagine their argument looks something like: We earn billions of dollars a year and want to earn more. We see people are downloading our stuff without paying us. This technology/company/etc promises to make copyright infringement more difficult and it'd only cost us $y million. If we see even a 0.01% increase in sales, it'll pay for itself in x years. Do it!

And government is even more straight forward. Media companies/individuals donate lots of money to campaigns, and there's a typical unspoken quid quo pro. They donate getting politicians into office and hire some lobbyists who know how to get those politicians what they want. In turn, those politicians then pass the media company's legislation. Like much of what the government does, the motivation is not a holistic effort to create a better country but an individual effort to get elected or reelected.

Hahah, come to think of it - it emphasizes that governments and capitalism suffer from the exact same problem. Capitalism works great when people put out good products and look to get rewarded for doing so. And similarly governments work great when politicians do good stuff and look to get rewarded for it. Things only get really messed up when companies start with the goal of making money instead of making a good product. And similarly, politics gets messed up when politicians start with the goal of getting [re]elected instead of creating good legislation. Because in both cases what makes the most money is not necessarily the best product, and what gets you reelected is not necessarily the most beneficial legislation.

it's really a pitch that starts with the hardware companies and the media companies buy into it because more DRM has no downside for them.

You better believe some "HDCP-certified 2.0" badge or whatever is on every hdtv and gpu you find at best buy. I wonder if the engineers on hdcp 1.0 knew how fast it would get cracked, but they knew that would just let them sell another round of hardware for the 2nd version.

Pretty sure the latest version of HRCP (required for 4k Netflix) replaces the factored keys and the entire key scheme.

Outputting an image via HDMI using an FPGA is relatively straightforward, almost as easy as VGA. I don't know about HDCP but expect it to be next to impossible.

Inputting any pulse-based high-frequency signal is more difficult, be it VGA or Ethernet or HDMI.

A little bit of A and all of B/C/D. Not all of HDMI is encrypted, but for the part that is the protocol is known, but you also need the keys which are meant to be stored in secure hardware and difficult to extract.

Also, old keys are frequently phased out, with new media requiring newer keys for playback.

How does that work? If I have an old player that is perfectly technically capable of playing new media, will it fail to play requires new keys? If so, that's atrocious, and I'm glad I jumped off the physical media train post-DVD.

>If I have an old player that is perfectly technically capable of playing new media, will it fail to play requires new keys?

Yes. It will require a soft/firmware update, which won't be available if the device has widely known vulnerabilities which cannot be software patched that would allow for key extraction. HDPC is not limited to physical sources.

> which won't be available if the device has widely known vulnerabilities

Probably won't be available full stop. Very few devices ever get manufacturer updates - they're all focussed on just making a new version of the device.

If it's still in warranty, sometimes they'll take it back for a refund.

I'm not an expert on HDCP but I don't think this is exactly correct. The standard doesn't rotate through new generations of keys; instead, revoked hardware keys are burned into all Blu-Ray disks burned after the time of revocation, and compliant HDCP implementations are required to check their own hardware key against that list before allowing playback. I don't know whether a hardware manufacturer could remediate the vulnerability that caused their key to get revoked and distribute a new key via a firmware update, but that sounds reasonable.

Reply on news.ycombinator.com