Managing licenses in Gnutella

Philippe Verdy posted about manageing licenses in another thread, and I 
criticised him harshly, because he proposed trying to solve a problem 
(license management) with a worse problem (DRM). 

That said, I think that managing licenses is a good thing. It just must not be 
done with DRM. 

So this post is about two things: 
- 1: How licenses can be managed without DRM, and 
- 2: Why DRM must not be used, if you have your users in mind. 


=On license management=

- This is a draft. Constructive comments are very welcome. -

To manage and verify licenses, you can just use signed license files (a task 
which can already be accomplished by GnuPG quite easily. I use GnuPG as an 
example, because it already works very well, is GPL and is well tested and 
secure). 

GnuPG: http://gnupg.org

==General==

If you buy a file, you also get a license, which includes a file-ID (for 
example a hash over the content, id3 tags stripped), your ID and/or name and 
your public key. 
It gets signed by the previous owner of that file. 

==Selling files==

If you sell the files, you pass on your license and add to it the file-ID, the 
buyers ID and the buyers public key and sign the whole license again. 

This results in a tree, which lists all previous owners of the files, so you 
can track it back to the origin and check if it really was acquired legally. 

If you are the first seller of a file, you can get your public key signed by a 
trusted authority. 


==Buying files==

When you buy a file, you ask for the license to prove that the owner may sell 
it to you. Then you check the signature, if it is valid and if it comes from 
a trusted seller (there needs to be a trusted authority where sellers can 
register). 

After that you check the signatures of all subsequent sellers, by testing the 
license against the public-key included in the part which lists their public 
key (if you buy a file, your public key gets written into the license and 
signed by the seller). 

If all conditions are met, you know that it is safe to give the seller money 
for the rights for that file.  

This way, you can trace the way of files back to the origin and verify every 
step on the way without even needing access to any outside resources safe the 
keys of the first trusted seller, and those can reside in a public ID signed 
by a trusted authority. 


==Trusted authorities==

Verifiying your public key is quite simple, and even I can play that part. To 
verify you, I can use two ways: 

- 1: You send me a mail with your Public Key and your contact details. I then 
send you a snail-mail letter with a verification code. If you send it back by 
mail and pay a small fee (for the snail mail, and also as second 
verification), I sign your key and send you 
an ID file signed by me (this is how email-providers make sure that they get 
no fake addresses). 
For this I take a small fee, so I can afford the snail mail. 

- 2: You put your public key online on your own domain. I check the details 
you post against the entries in the whois database, and if it fits (and you 
pay a small fee for the work and as second verification), I sign your key and 
send you an ID file signed by me. The domains registering agencies already 
check you. 

If people buy from you, you can show them your signed ID-file, so they know 
for sure who they are dealing with. 

The main trusted authorities need self-signed ID-files, which they add to 
the ID files they sign and which get signed by other main trusted authorities. 

For LimeWire: If you want every user of your software to be able to sell their 
own files, you can just use their buyers-ID to verify their identity and give 
them a public key and an ID-file which you sign yourself. You in turn let your 
ID-file be signed by other trusted authorities. 
They can then claim songs, and if they claimed wrongly, their claim can easily 
be traced back to them. 

That way, many groups can cooperate on common grounds without having to know 
everyone yourself. 


I hereby make the offer to play the part as one of the main trusted 
authorities, if this scheme gets used. 
My Public key can be found at http://draketo.de/inhalt/ich/pubkey.txt
Key: FE96C404
E-Mail: <[email protected]>
Fingerprint: 6B05 41F0 94FF 2163 6FBA  2433 3307 469B FE96 C404

At a later stage one could and should implement a real web of trust, as it is 
already done in GnuPG. That web of trust also knows trust ratings (unlimited, 
completely, partly, none), which show how much you trust the owner of the 
signed key to carefully check the identities of the keys he/she signs. 


Done. A decentral license management protocol which doesn't invade your 
privacy and is secure. 

To implement it, we need a format for the ID-files and for the license files. 

The only external resource we need is GnuPG which is GPL, well tested and 
already in use by other applications for years (for example by my mail 
program to sign this very message). 
http://gnupg.org

It is even supported by the german agency for security in information 
technology (BSI) through the project aegypten: 
http://www.gnupg.org/aegypten/


=On DRM=

Now to the second argument in this post: Why DRM must never be used if you 
care about your users. 

DRM means: Some technology which denies or allows you certain useages of your 
computer based on a list of rights and restritcions you have been assigned. 
A license is a receipt. DRM means to take away your goods, if you loose your 
receipt. 

This one is short, because the weakness of DRM is pretty obvious if you 
look at it from the correct angle. 

DRM is either a farce, or it is a danger to the privacy and security of its 
users, because it takes over control of the whole computer. 

Most DRM is a farce, because it can be cracked easily by ripping the content 
in some way which isn't controlled by it (for example digital audio output of 
the computer). You can esily see this from the fact, there isn't any 
significant DRM scheme which wasn't circumvented and even cracked quickly. 

This means that DRM which isn't a farce needs to control the whole computer 
and every peripheral, and so it takes away control of the computer from its 
user and gives it to someone else. 

And this is completely incompatible with free software and free operating 
systems, because it relies on controlling all connections between the DRM 
crippled software and other software or hardware. 

Since you can change free software any way you like, no part of that chain may 
be free software. 


In effect, that kind of DRM is equivalent to imprisoning you in your own house 
and then gracefully allowing you to use certain parts of your house for which 
you get the allowance. 

And that means: If you have any kind of efficient DRM on your computer, you no 
longer own your computer. 

For more indepth information, please visit 
http://www.defectivebydesign.org/


For a license management Scheme you don't need DRM, since you only need to be 
able to tell the user "this license is valid" or "this license is invalid" and 
let the user decide how to act (because he could just have other ways to get 
permissions which can't be tracked, like knowing the original author and just 
asking him/her by phone or even snail mail)


Best wishes, 
- Arne  (http://gnufu.net - Gnutella For Users)
PS: Please make sure that you change the subject of your messages if you 
switch the topic. 
PPS: Show me a weakness in the license management scheme and I'll fix it. 
PPPS: An ID-file can be identified by its file-hash and its name so it can be 
found on Gnutella. It must contain the public key.


[Non-text portions of this message have been removed]