Re: more protocols: shuffle/repeat, check in/out

On Sun, Jan 12, 2003 at 05:18:42PM +0100, B&L wrote:
> I am not sure that you should expect that heavy a kind of encryption.
> 
> First of Sonys website does not report that the NetMD is a SDMI compliant 
> device.
> It does that for the MemStick walkman MS9 and MS11, which uses the 
> MagicGate MemStick.

The manual says that it is SDMI compliant.
 
> Second. Heavy encryption requires "heavy" hardware, which the walkman 
> devices are not.
> I am not saying it will be easy, but I do think it can be done.

You are ignoring the facts.  The Sony Net MD player MZ-N707 has a 40 MHz
Arm processor.  The chip used for MagicGate reportedly has crypto algorithms
built in.  The hardware in a MiniDisc player is "heavy" enough to do strong
encryption, whereas strong means the application of good cryptographical
algorithms like DES.  If I were to attack the system mathematically, I would
probably start with the random number generator, because it is quite difficult
to get high quality random numbers out of a closed environment like the Net MD
device is.  OTOH, the usual problem in math is that you know the algorithm
and try to break a key.  The problem here is finding out the algorithm, the
keys are probably right in front of our eyes.

Also, even without looking at the internals of the Sony hardware, just look
at the protocol:  The OpenMG software uses strong ecryption to restrict
access to the omg files.  The encrypted omg files are transferred almost
verbatim to the device (a header is added for each block, but the raw data is
unchanged) for LP2 and LP4.  So the Net MD device must perform the actual
decryption of the music.

OpenMG is a framework for EMD (electronic music distribution).  The idea is
to sell music over the internet.  This has several advantages for Sony and
other music distributors:

* They can save costs because every user pays themself for the distribution
  medium (internet access), Sony just has to put up a file server.  No
  actual physical medium like a CD is required.

* Music files are personalized and access restricted.  This means they can
  make you pay many times for the same music, for example each time you
  listen to it, or for each day you have access to it.  Because the files
  are personalized, they can track down copied music files to the
  originator.

* Sony can control what consumers are allowed to hear for how long, and in
  addition they get detailed, personalized statistics about each consumer's
  behaviour (which files where bought when, for how long, etc).  This is a
  paradise for the marketing department.

This is only possible if the whole way from the distributor to the
listener's eye is protected, and at no point in this chain the user gets
access to the raw digital data (apparently they don't care about analog,
which they could hardly control anyway.  To me this hints at a revival of
analog recording if the digital war is lost).   For this, the files have to
be encrypted until they get to the speaker.  OpenMG is only a start. 
Microsoft is working full speed on Palladium, which aims to control the
whole PC hardware at the level we are now seeing with OpenMG.  In the
future, Microsoft will control which music you are allowed to hear, which
videos you are allowed to watch, and which software you are allowed to run.
(This means that a Net MD program that is not written by Sony might not be
able to start up at all on a Palladium-enabled Window system).  Of course at
that time, non-palladium hardware and software (GNU/Linux, MacOS?) has to be
outlawed.  There were already bills proposed to that effect to the US senat.
(Fritz chip).

> With regards to the legality, we are not trying to circumvent coyyright 
> protection on a music piece. We are mearly trying to use the device we have 
> legally bougt. I dont know if that will hold in court ??? :-)

I am still pondering that.  I have taken the same position earlier, but now
I am not so sure anymore, in particular as there are good chances that if we
had a way to do file uploads like simple burner, we might be able to upload
omg files without the checkout restrictions (we don't know for sure, it's
only a guess).  And that would be a circumvention on the whole EMD
(electronic music distrtibution) system Sony built up.

Note that I am believing very strongly that we wouldn't do anything wrong
morally.  But some recent laws have made things illegal that should be
allowed and protected under Human Rights bills, and the legal status of work
that would allow file uploads could probably be seen as a violation of the
DMCA in the US (in fact, at least the attempt to see it that way is
something I would expect immediately, because the DMCA was just written to
allow such harrassment).  The legal situation is (yet) a bit better in
Europe.  Without a better understanding of MagicGate, and help by a couple
of smart lawyers, we will not know though.

Thanks,
Marcus

-- 
`Rhubarb is no Egyptian god.' GNU      http://www.gnu.org    [email protected]
Marcus Brinkmann              The Hurd http://www.gnu.org/software/hurd/
[email protected]
http://www.marcus-brinkmann.de/