The Nuts and Bolts of Digital Rights Management
•
1 gefällt mir•897 views
This document provides an overview of the basic tools and techniques used for digital rights management (DRM), including symmetric and asymmetric encryption, hashing, digital signatures, and certificates. It explains how ciphers, hashes, public/private key pairs, and certificates work and are used together to provide authentication, integrity, and non-repudiation for securing digital content and communications. Specific examples are given to illustrate symmetric encryption, digital signatures, and the certificate signing request process.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (12)
Andere mochten auch
Andere mochten auch (20)
Ähnlich wie The Nuts and Bolts of Digital Rights Management
Ähnlich wie The Nuts and Bolts of Digital Rights Management (20)
Mehr von BookNet Canada
Mehr von BookNet Canada (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
The Nuts and Bolts of Digital Rights Management
- 1. Beyond Good & Evil The Nuts and Bolts of DRM Dave Cramer / Hachette
- 2. <nav role="doc-‐toc"> <ol><li>Toolbox: nuts and bolts <ol><li>Ciphers <li>Symmetric key cryptography <li>Public Key Encryption <li>Hashes <li>Digital Signatures <li>Certificates</ol> <li>Application: Secure Browsing <li>Copyright <ol><li>ebook DRM <li>Readium LCP
- 3. Ciphers
- 5. Cqll ,e Ish,qel: So,e yeqrs qgo]never ,ind hoz long)exqtly
- 6. Vigenère Cipher le chiffre indéchiffrable
- 7. text C A L L M E I S H M A E L key E B O O K C R A F T E B O cipher G B Z Z W G Z S M F E F Z key E B O text C A
- 9. echo "Call me Ishmael" | openssl enc -‐e -‐ aes-‐256-‐cbc -‐a -‐p enter aes-‐256-‐cbc encryption password: salt=364338BE2F9FE6FC key=AE99F254C8F7D4314494B62736AD3E97ACCC4541 34F48D486FCA9C248F138C45 iv =A3FCB694B8CEFA792854874826F6D415 U2FsdGVkX182Qzi+L5/m/ PdnBH6KrzpCgW92xFCQbUXSpwGg0t7p3XrjNNyqEZOl
- 10. echo "U2FsdGVkX182Qzi+L5/m/ PdnBH6KrzpCgW92xFCQbUXSpwGg0t7p3XrjNNyqEZOl" | openssl aes-‐256-‐cbc -‐d -‐a enter aes-‐256-‐cbc decryption password: Call me Ishmael
- 14. The Math 1. Pick two large prime numbers P and Q 2. Multiply them together to form N = P*Q 3. Pick E, an odd number between 3 and N-1 that’s relatively prime to (P-1)(Q-1) 4. Compute D such that DE = 1 mod (P-1)(Q-1)
- 15. Do The Math 1. P = 11, Q = 13 2. Multiply them together to form N = 143 3. E = 7, which is not a factor of (P-1)(Q-1)=120 4. 7D= 1 mod 120 = 103 5. D = 103 Public Key is (143, 7) Private Key is (143, 103)
- 16. The Magic ciphertext = messageE mod PQ message = ciphertextD mod PQ
- 17. Encrypt(m) = mE mod PQ Message is “99” (ascii code for “c”) Encrypt(99) = 997 mod 143 Encrypt(99) = 93206534790699 mod 143 Encrypt(99) = 44
- 18. Decrypt(ciphertext) = message = cD mod(PQ) m = 44103 mod 143 m = 18863647751783874097093622186761307641 67139589651012467002758103474511583590 0579054247760433265371183425069323507 066622936418037086042241347409034030 626680951825376477184 mod 143 m = 99
- 19. Hashes
- 21. ISBN Multiplier Result 9 1 9 7 3 21 8 1 8 1 3 3 9 1 9 2 3 6 6 1 6 8 3 24 5 1 5 5 3 15 7 1 7 8 3 24 (3) 137 137 mod 10 = 7 10 -‐7 = 3
- 22. ISBN Multiplier Result 9 1 9 7 3 21 8 1 8 1 3 3 9 1 9 2 3 6 8 1 8 6 3 18 5 1 5 5 3 15 7 1 7 8 3 24 (3) 133 133 mod 10 = 3 10 -‐ 3 = 7 WRONG
- 23. Adler-32 Hash Example text ascii A B c 99 1 + 99 100 0 + 100 100 a 97 100 + 97 197 100 + 197 297 l 108 197 + 108 305 297 + 305 602 l 108 305 + 108 413 602 + 413 1015 32 413 + 32 445 1015 + 445 1460 m 109 445 + 109 554 1460 + 554 2014 e 101 554 + 101 655 2014 + 655 2669 32 655 + 32 687 2669 + 687 3356 i 105 687 + 105 792 3356 + 792 4148 s 115 792 + 115 907 4148 + 907 5055 h 104 907 + 104 1011 5055 + 1011 6066 m 109 1011 + 109 1120 6066 + 1120 7186 a 97 1120 + 97 97 1217 7186 + 1217 8403 e 101 1217 + 101 1318 8403 + 1318 9721 l 108 1318 + 108 1426 9721 + 1426 11147 1426 = hex 0592 11147 = hex 2b8b Hash = 2b8b0592
- 25. • Authentication • Integrity • Non-repudiation
- 26. message public key cipher text cipher text messageprivate key
- 27. message ciphertext ciphertext message message+ message Signing Verifying message= private key public key
- 30. REM15M:~ cramerd$ openssl genrsa -‐aes128 -‐passout pass:ebookcraft -‐out private.pem 4096 Generating RSA private key, 4096 bit long modulus ........................++ ....................................................... ....................................................++ e is 65537 (0x10001) REM15M:~ cramerd$ openssl rsa -‐in private.pem -‐passin pass:ebookcraft -‐pubout -‐out public.pem writing RSA key REM15M:~ cramerd$ openssl dgst -‐sha256 -‐sign private.pem -‐out /tmp/sign.sha256 text-‐ to-‐sign.txt Enter pass phrase for private.pem: REM15:~ cramerd$ openssl base64 -‐in /tmp/sign.sha256 -‐ out text-‐signed.txt
- 31. REM15M:~ cramerd$ openssl base64 -‐d -‐in text-‐ signed.txt -‐out /tmp/sign.sha256 REM15M:~ cramerd$ openssl dgst -‐sha256 -‐verify public.pem -‐signature /tmp/sign.sha256 text-‐to-‐ sign.txt Verified OK
- 34. Certificates
- 35. Signing Request
- 36. REM15M-‐CRAMERD:readium-‐lcp-‐server cramerd$ openssl req -‐out CSR.csr -‐new -‐newkey rsa:2048 -‐nodes -‐keyout privateKey.key Generating a 2048 bit RSA private key ...........................................+++ .+++ writing new private key to 'privateKey.key' -‐-‐-‐-‐-‐ You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. -‐-‐-‐-‐-‐ Country Name (2 letter code) [AU]:CA State or Province Name (full name) [Some-‐State]:Ontario Locality Name (eg, city) []:Toronto Organization Name (eg, company) [Internet Widgits Pty Ltd]:ebookcraft appreciation society ltd Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []:ebookcraftrocks.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request
- 37. -‐-‐-‐-‐-‐BEGIN CERTIFICATE REQUEST-‐-‐-‐-‐-‐ MIIC2TCCAcECAQAwfTELMAkGA1UEBhMCQ0ExEDAOBgNVBAgTB09udGFyaW8xEDAO BgNVBAcTB1Rvcm9udG8xLDAqBgNVBAoTI2Vib29rY3JhZnQgYXBwcmVjaWF0aW9u IHNvY2lldHkgbHRkMRwwGgYDVQQDExNlYm9va2NyYWZ0cm9ja3MuY29tMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA+mOAIZG8lP+OIBuk6J6bPCqhT+Gx jEKzwFpOIGIV6B/uRtUJX/BF8nb6KAaoOuRab0a4yIdPNlEgvExbkGkdQdDVsc+K Qxub1SeJF2zNFlAhtmuvsLbm9ONoAFfcn0O/pwMZzbQj0bZy7U3srNee8/OvGCD5 bQdu6+ZKH+OeC5QUmPpbjv5uOmGIcT5Q0hUBP33T4XTj5vhVzSgdmhGY02T+BTC5 3V1sB+glJ11lCpTTjmdEUcVfUeagZ1UZtLHC7zMXiJuSYurCYproXIADVGvKRe4C /otZQm/T6ULReYzw7w8YygyxgRvHJAjvZKU47/wm+ShuX/A1H4D8iUKmqQIDAQAB oBcwFQYJKoZIhvcNAQkHMQgTBjEyMzQ1NjANBgkqhkiG9w0BAQUFAAOCAQEAgNDm Znf5GPCyb4Y2600/SFPioOui4BZucsip+QQpj0zNx1oo3Jlrng9vqcT78KniCGNv Zn/Un+FBXy2kOI9IQe4wYWg+u0ggVxVNTP52x5Ug3RXvAT5iTm3q1AojeIU7FYBT aZD/GNsDAEecyb5xB3T97MJCo4HtH+vLVrRXPnUgAXg9HGm4tSi6oQOsVYy+y6xU LUbWO97sWNmKTxzXkDfDbSYYTsB1PzTbDFWzX1ed+jZZFynUUavktS8ky7ImlYH0 yvpaZP3MCVE1xQCLjqAua9FmR4H6ns0y9haWxCVzXHzseyRRzfyBmXD7AkSuElVI dpOUa7WVxwra4uXIRw== -‐-‐-‐-‐-‐END CERTIFICATE REQUEST-‐-‐-‐-‐-‐
- 40. HTTPS
- 41. Acronyms • HTTPS = HTTP over TLS or HTTP over SSL • TLS = Transport Layer Seurity • SSL = Secure Sockets Layer
- 43. Hi! What ciphers do you know? Can we try AES-256-CBC? that’s my favorite. Great!
- 44. Are you really the White Whale? Ah, let me check the signature… Wow, it’s really you!
- 49. Copyright
- 52. –The Statute of Anne, 1710 Whereas Printers, Booksellers, and other Persons, have of late frequently taken the Liberty of Printing, Reprinting, and Publishing, or causing to be Printed, Reprinted, and Published Books, and other Writings, without the Consent of the Authors or Proprietors of such Books and Writings, to their very great Detriment, and too often to the Ruin of them and their Families: For Preventing therefore such Practices for the future, and for the Encouragement of Learned Men to Compose and Write useful Books; May it please Your Majesty, that it may be Enacted…
- 54. DRM
- 55. –Defective by Design “the practice of imposing technological restrictions that control what users can do with digital media.”
- 56. ebook DRM systems Scheme Users Apple FairPlay iBooks Kindle Kindle Adobe B&N, Kobo, Overdrive, Google Play Sony UMRS Numilog (France) Readium LCP just getting started
- 57. Readium LCP
- 58. Readium LCP Goals • Avoid vendor lock-in • Support library use cases • Relatively simple and inexpensive to operate • Support for a11y • Allow offline use; still function if a provider goes out of business
- 59. EPUB lcpencrypt Passphrase LCP License Server encrypted EPUB LCP License encrypted EPUB content key +
- 62. DO NOT ENCRYPT • package file (OPF) • nav • cover image • container.xml
- 64. encryption.xml
- 69. Good
- 71. Evil
- 75. Free Advice Who Are You? What Should You Do? Library Use DRM, but make it as user-friendly as possible. Trade Publisher Screw DRM. Make it easier to buy your books than pirate them. Look at watermarking. Put books on the web. Educational Publisher You already made a pact with the Devil. Use DRM. Legislator, lobbyist, rule- maker, judge Hang your head in shame.
- 76. Thank You! Dave Cramer / Hachette Book Group / @dauwhe