Declaration of Digital Rights

One application of Digital Rights Management(DRM) is to supply digital content such as text, music, video or executable, and preventing that this content is used in an inappropriate way. Copying and sharing could be prohibited and even how and when you have access to the data. The basic ingredient here is to encrypt the media using a bulk cipher. A bulk cipher is an algorithm that is fast and appropriate for encrypting large amount of data. Often you also want the decryption to be able to start at an arbitrary position in a file, then you will have to use a so called block cipher. Today the most common such algorithm is called AES which is a symmetric key(encryption key is the same as the decryption key) cipher available in CBC(Cyclic Block Cipher) mode and stream cipher mode. No asymmetric fast algorithms are known, RSA, the most common asymmetric cipher, is about 1000times slower than AES in most implementations. If an asymmetric cipher is invented that is fast enough and available for block and stream ciphering this could make many cryptographic protocols much easier. The advantage of the asymmetric algorithms is that the key transportation issue becomes easier, you can share the public part of the key. Therefore RSA and other asymmetric algorithms such as El Gamal and Diffie-Hellman are used to transport symmetric keys to be used for the actual bulk data decryption, this is done in a similar way as the one described in the sharing a secret post.

So, assuming a symmetric encryption, you have an encrypted media file, and you somehow must get hold of the key to decrypt the media. Passing the key can be done in three ways. Either you send the key along with the content and hope that the device that receives the content won't allow anyone to read the file. It has a great flaw in that if someone catches the file before it reaches a safe environment the key can be read by anyone. Another way is to have a method for generating the key based on a password. When you purchase the file a password is supplied and you will receive a specially designed content file just for you. A problem with this scenario is that the security here is based on obscurity, which means that once the key generation method is discovered the whole system breaks. This is basically what has happened to MS-DRM and forces MS to supply patch after patch of new key generation methods. Some solutions allow the user to choose a password himself. The flaw with this is that a malicious user can distribute his password and then everyone can use the file. The eReader DRM tries to circumvent this by using the credit card number of the user as input for the key generation method. This is quite smart as most users are not keen on giving their credit card numbers out to everyone. Still the flaw of security by obscurity remains. The third solution to the key transportation issue is to deliver the key separately in a license file. This allows the content provider much more flexibility and can be made very safe. This is used in OMA V2 DRM and to some extent in OMA V1, but in OMA V1 the licenses just contains the keys in plain text so it is not really safe. OMA V2 describes a much more sophisticated way of building and acquiring the license. This system requires a protocol called ROAP to be followed. This protocol is quite similar to SSL/TLS protocols used for safe transactions on the Internet, using digital certificates for authentication. These solutions relies heavily on asymmetric ciphers for key transportation.

The system with a license catches the essence of DRM. The license describes the rights granted by the issuer. This means that scenarios where the content itself plays a minor role appears. You can focus on the rights and use the license on its own to prove your rights. I think many speakers who have put forward the notion that DRM actually should be called 'Digital Restrictions Management' have totally missed this important fact about DRM.

Content providers using the simpler versions of DRM still have one more card up their sleeve. They can use digital watermarking. If a user cracks a certain file and this file is distributed unencrypted the content provider can track the file to a certain user. A digital watermark can be described as changing the original digital content in a way that does not distort the content. Take a picture for example. Every pixel in the picture is described by a number. Usually this number can range from 0 to 65535 or more. This number describes the color and intensity of the pixel. Two numbers that are close are very hard for the human eye to distinguish. This means that some of the pixels can be changed my a minute amount and no one can tell the difference. The content provider who has the original picture can compare the two digitally and see the difference, the hidden code will point to a specific user.