Hacker News Reader

Comment by ekelsen | Hacker News Reader

Was there anyway to make this work unless every CD was burned with a different key used to do the encryption?

No. That cracking group would have known a priori the phone call was a pretense, because id was very unlikely to press distinct CDs. So they could focus on conventional cracking techniques.

Wouldnt you need different master-CDs for doing that, as AFAIR when pressing CDs commercially, you usually have exactly only one master?

(maybe a different one per geo-locatoin, if at all)

Maybe have n versions of the CD (maybe 16, or 32), so there are n decryption keys. When the buyer recites the code over the phone, the program run by the salesperson can identify which key is used based on the number.

The hacker groups would be a little frustrated trying to find all of the different CDs.

The setup costs for a pressed CD are substantial - manufacturing many different designs would have been much more expensive, and would have only slowed down crackers marginally. It's unlikely that this would have recovered enough sales to be worth it.

A reminder that CD-ROMs are pressed from glass masters, not burned like CD-Rs. I wonder if anyone has tried something like this with burned discs, though.

Yes, my point, if the answer is that there is no way this works without every disc being different.

It was not possible to manufacture at the time at scale.

It's still not possible. You would need to make a unique master for every individual unit.

You'd use CD-R of course.

With CD-Rs it was already possible in the mid '90s, if we're talking mass production. CD-Rs are a little more expensive to produce, but not much more so. A slight concern is that readers of the time might not have been able to read the discs, because CD-Rs are not quite as reflective as CD-ROMs.

The multisession standard actually afforded the possibility of CD-PROM; a hybrid disc with a pressed read-only session followed by a writable section. It was only used for Kodak Picture CD (not the same as Photo CD) to hold software in the pressed session. It also apparently standardized a magneto-optical hybrid that never made it to market.

It was also used by Ricoh EncryptEase - CD-Rs with encrypted backup software in an initial pressed track. https://www.youtube.com/watch?v=_5ucImqdKbY

Hmm, it could work then if they’ve pressed most of the game data first and then recorded the encrypted part for each disk. But I guess the tooling for such setup would still be too expensive.

You would need some sort of hardware serial number system for PCs and a whole security infrastructure to verify that the serial number being used for the unlock wasn't faked. Then you could do per-PC unlocks. I'm not aware of anything like that being widespread back in the Quake days, though these days every computing device you own probably has a unique ID burned into ROM somewhere.

Supposedly Xbox One+ discs are individually serialized which was originally going to be used for their DRM system at launch that was walked back.

Some sort of public key crypto scheme + including hard-to-change local device characteristics in the challenge.

I guess the path of least resistance then would have been to patch the executable to remove the check.

Right.

Reply on news.ycombinator.com