?   L 5 L < Analysis of DVD ContentsScrambling System  W  
E

Cryptanalysis of Contents Scrambling System, 3
Frank A. Stevenson ( frank@funcom.com ) K

Abstract: CSS is a scrambling system used in the distribution Mfor movies on DVD ( Digital Versatile Disc ) a high capacity CD like storage Gsystem. Its main purpose is to prevent the unauthorized duplication of Jdisc contents. This is achieved through encrypting the files, and storing Gkeys in hardware. Here we will describe the system, and show that even Oif the keys can be securely stored in hardware, the data will not be protected Hfrom unauthorized copying. Severe weaknesses in the ciphers effectively Fvoids the need for the hardware keys when decrypting the content.
 
  

8th November 1999 (
(updated 13th Nov.)

 










/
0 General disclaimer. Q
This information is provided as is, with no warranties Mon its accuracy or usability. It is based on a piece of source code claiming Nto be the css algorithms, and which have since been confirmed to interoperate Mwith the CSS system. The author has not read any official CSS documentation, Hand any errors in the terminology is a result of this. This information Lhas not to the knowledge of the author been made available through breaches Dof the DVD consortium Non Disclosure Agreement.
 /


1 System overview. H

Every DVD player is equipped with a small set Hof player keys. When presented with a new disc, the player will attempt Jto decrypt the contents with the set of keys it possesses. Every disk has ;a disk key data block that is organized as follows:  GSuppose the player has a valid key for slot 213, it will calculate Q
(1)        Kd S= DA( dk213 , Kp213 ) O

To verify that Kd is correct, the following Kcheck is done, if the check fails, it will try the next player key. Q
(2)        Kd G= DA( hash , Kd ) J

An obvious weakness stems from this check, by trying all H240 possible Kd, disk Kkey can be deduced without knowing any valid player key. IAs will be shown later, this attack can be carried out with a complexity Mof  225, making such an attack feasible Hin runtime applications.  Another obvious attack is that by having G1 working player key, other player keys can be derived  through a Msimilar search. This can be done offline, also keys obtained from the former /attack can be used as a starting point. G

To decrypt the contents an additional key tk - Pthe title key is decrypted with the now decrypted and verified disk key. P

(3)        Kt `= DB( tk, Kd) K

Each sector of the data files is the optionally encrypted Pby a key that is derived from Kt by exclusive or of specified Ibytes from the unencrypted first 128 bytes of the 2048 bytes sector. The Mdecryption is done with the CSS stream cipher primitive described in section II.

32 CSS streamcipher primitive: I
The CSS streamcipher is a very simplistic one, Hbased on 2 LFSRs being added together to produce output bytes. There is Hno truncation, both LFSR are clocked 8 times for every byte output, and Ithere are 4 ways of combining the output of the LFSRs to an output byte. IThese four modes are just settings on 2 inverter switches, and the modes 6operation are used for the following purposes. 
    
  1. HAuthentication to DVD drive ( not discussed )
    2.  
  2. yDecryption of Disk key (DA)
    3.  
  3. zDecryption of Title key (DB)
    4.  
  4. 5Decryption of data blocks.
    5. 
GLFSR1: 17 bits ? taps, and is initialized by the 2 first Hbytes of key, and setting the most significant bit to 1 to prevent null cycling. H
LFSR2: 25 bits 4 taps, is initialized with byte 3,4,5 Hof the key shifting all but the 3 least significant bits up 1 position, 2and setting bit 4 to prevent null cycling. G

As new bits are clocked into the LFSRs, the same bits Iare clocked in with reversed order to the two LFSRs output bytes. ( With %optional inversion of bits. ) O

The output of LFSR1 is O1(1), O1(2), O1(3) ... Q
Likewise LFSR2 produces O2(1), O2(2), O2(3) ... H

These two streams are combined through 8 bits addition Kwith carry carried over to the next output. The carry bit is zero at start of stream. H
(4)        O(i) O= O1(i) + O2(i) + c     where -c is carry bit from O(i-1) _

This streamcipher is very weak, a trivial 216 Iattack is possible with output bytes known for i = {1,2,3,4,5,6}. NGuess the initial state of LFSR1, and clock out 4 bytes. O2(1), NO2(2), O2(3), O2(4) can then be uniquely Ldetermined, and from them the state at i=4 is fully known. The guess Lon LFSR1 can then be verified by clocking out 2 or more bytes of the cipher !and comparing the result. L

Another important attack is the case when only O(i) Gfor i = {1,2,3,4,5} is known. Guess the initial state of LFSR1, Iand clock out 3 bytes. Now O2(1), O2(2) and O2(3) Kcan be found as in the above attack. This will reveal all but the most Isignificant bit of LFSR2s state at i=3. If both possible settings Ifor MSB is tried, and LFSR2 is clocked backwards 24 steps, a state where Ibit 4 is set at i=1 can always be found. ( This is stated without Gproof ). Select the setting of the most significant bit for LFSR2 such Kthat LFSR2 is in a legal state at i=1, and clock out two more bytes Gto verify the guess of LFSR1. For some values of O( i = {1,2,3,4,5} I) multiple start states can be found, and for others none. Selecting Othe correct start state is not a problem, as this attack is used in situations Hwhere only the first five output bytes are of significance ( encryption of keys ). 
 

*3 CSS mangling step: G
When the CSS streamcipher is used to encrypt `keys such as in DA(data,key) Uand DB(data,key), Jan additional mangling step is performed on the data. This cipher is best 5illustrated with the following block diagram:  JThe cipher is evaluated top down, with exceptions indicated !by an arrow.

 
8

 
  8
Examples of evaluating cipher:  KF is a function, defined by a byte permutation Gtable. With known cipher and plaintext, the whole cipher unravels with .a minimal amount of work. Here is how:  HThus by trying 256 possibilities, we can recover 5 output Jbytes from the CSS streamcipher, and so recover the key by using the five Kknown output bytes. This attack can be put to immediate use for recovering Iother player keys as in the notes to eqn. 2,3. Even if the player key is Gnot recovered through the reversal of the stream cipher, the output of Jthe streamcipher is known, and will still be usefull for decrypting disks 3that employ other player keys.
;4 Attacking the hash of the disk key. J
Reversing the hash at the start of the disc key Gblock is somewhat more complicated. From (2) we see that only the hash Jvalue is known, the problem is finding a disk key such that the decrypted ]hash equals the disk key itself. An attack of complexity 225 proceeds as follows. I

First some aspects on the value of k2 Hwill have to be considered. A(1) and A(2) is known, and a Otable can be build by running through every possible combination of k2 and B(1) and Ncalculate the resulting C(2). When trying to build a table of possible Lvalues k2 of indexed by C(2) and B(1) there Hwill be many values that map to the same set of indices, so a the table Umust be able to hold several values of k2 in each location. M

Guess the start state of LFSR1, calculate O1( Ji = {1,2,3,4,5} ) . Next guess B(1) and complete the following calculations: 

HThis attack when implemented on a Pentium III running 450 JMHz, will recover a disk key from the hash alone in less than 18 seconds. _This is clearly much less than what is to be expected of a 40 bits cipher.
"5 Conclusion N
The author has through email correspondence learned Gthat attacks as described at (2) have indeed been carried out by brute Gforce prior to this analysis. CSS was designed with a 40 bit keylength Rto comply with US government export regulation, and as such it easily compromised Hthrough brute force attacks ( such are the intentions of export control N). Moreover the 40 bits have not been put to good use, as the ciphers succumb Ito attacks with much lower computational work than which is permitted in Hthe export control rules. Whether CSS is a serious cryptographic cipher Kis debatable. It has been clearly been demonstrated that its strength does Gnot match the keylength. If the cipher was intended to get security by Jremaining secret, this is yet another testament to the fact that security Bthrough obscurity is an unworkable principle.
+6 Further information J
I have collected links Ito posts that were made to the Livid project mailing list. These include Gthe original anonymous posting of the CSS algorithm, as well as full C @source code for the attacks I outline here.