Intel HDCP Authentication Linear Relation Between Keys Vulnerability
BID:3558
Info
Intel HDCP Authentication Linear Relation Between Keys Vulnerability
| Bugtraq ID: | 3558 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 05 2001 12:00AM |
| Updated: | Nov 05 2001 12:00AM |
| Credit: | Discovered independantly by Scott Crosby, Ian Goldberg, Robert Johnson, Dawn Song and David Wagner and presented at the ACM-CCS8 DRM workshop on November 5, 2001. |
| Vulnerable: |
Intel Corporation High-bandwidth Digital Content Protection 1.0 |
| Not Vulnerable: | |
Discussion
Intel HDCP Authentication Linear Relation Between Keys Vulnerability
Intel's High-bandwidth Digital Content Protection (HDCP) is a specification for authentication and encryption of multimedia streams. Content encryption and authentication of a playback device are based on a public/private key pair.
Authentication is accomplished by a linear combination of private key values, based on the public key. As a direct result, being able to express an arbitrary public key as a linear combination of known public/private key pairs allows an attacker to authenticate as the arbitrary device.
This results in a large number of possible exploits, with varying degrees of computation required. As an example, an attacker able to eavesdrop on an encrypted stream may compute the shared secret, and view the decrypted content.
Although a computationally efficient algorithm has not yet been published, it may also be possible to create new, valid keys that are a linear combination of known values. Currently this may be done by enumerating all possible well formed public keys, and testing for validity.
Intel's High-bandwidth Digital Content Protection (HDCP) is a specification for authentication and encryption of multimedia streams. Content encryption and authentication of a playback device are based on a public/private key pair.
Authentication is accomplished by a linear combination of private key values, based on the public key. As a direct result, being able to express an arbitrary public key as a linear combination of known public/private key pairs allows an attacker to authenticate as the arbitrary device.
This results in a large number of possible exploits, with varying degrees of computation required. As an example, an attacker able to eavesdrop on an encrypted stream may compute the shared secret, and view the decrypted content.
Although a computationally efficient algorithm has not yet been published, it may also be possible to create new, valid keys that are a linear combination of known values. Currently this may be done by enumerating all possible well formed public keys, and testing for validity.
Solution / Fix
Intel HDCP Authentication Linear Relation Between Keys Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Intel HDCP Authentication Linear Relation Between Keys Vulnerability
References:
References:
- A Cryptanalysis of the High-bandwidth Digital Content Protection System (Scott Crosby, Ian Goldberg, Robert Johnson, Dawn Song, David Wagner)
- Apparent HDCP authentication protocol weaknesses (Scott A. Crosby
- Digital Content Protection, LLC (Intel Corporation)