0

Recently my friend and I were discussing his idea of protecting the digital media that he has been generating.

His initial idea was to encode the data using proprietary encoding algorithm and distribute the media player to the customers separately. My first reaction was, if it's so easy, everyone would have done that. The problem is that this implementation can easily fall prey to chosen plaintext attack.

His later idea was to encrypt the file using a key (say a combination of some metadata of the media file) and then distribute it to the customers. He would use a standard encryption library instead of writing his own implementation. My concern here is that if the decrypting and then rendering the file would slow down the system to be useful for use cases like live streaming.

Is the above approach an efficient way to securely serve content to a limited audience? Also, the sharing method could be live streaming watched on the proprietary software (not a web application).

  • Media should be encoded using standards like H264. Then encrypted using standards too. If you cannot use DRM standard due to costs, you can use AES. Live video you can encrypt with AES and make client request keys bases on their login and password. You can make it a bit harder by obfuscating this part. You could also add asymmetric crypto to make it even harder (for example, to get the AES key), so that without disassembling it, it would be impossible to decrypt. It's always possible to grab the screen of the player. Making its window locked would make this player a bit crappy. – Aria Aug 22 '16 at 22:49
1

Is the above approach an efficient way to securely serve content to a limited audience? No, not really.

For example,

There is nothing that prevents customers from copying both the media and the player, and distributing it to whoever they want.

There is nothing that prevents a clever customer from starting the player and starting playback, then dumping the memory and grabbing the unencrypted content.

There is nothing that prevents customers from recording the output of the player (e.g. by spoofing an audio driver) and converting it into a non-protected format.

2

Ultimately DRM for multimedia ends up being security through obscurity by necessity. You HAVE to give the person all the information to display the information so they can consume it which means they have all the information they need to save it/copy it/etc. There is ultimately no way to get around that.

The only possible way to get around this is by using things like TPM and secure boot that are built into the hardware and supported by the OS. This can then theoretically limit what you are able to do and protect the video but that isn't something you can throw together itself and is still only as secure as all the combined components are (TPM, Secure boot, OS, Video card driver etc).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.