Orchid XP v7 <voi### [at] devnull> wrote:
> If you can play it, you must have the decryption key. Encrypted data 
> with the key right next to it might as well not be encrypted at all...

  In some situations it's not that simple.

  For example the PlayStation Portable supports running programs from
the flash memory card directly (instead of the optical disc), but only
ones approved by Sony. It will refuse to run anything else.

  How does it achieve this? Why can't people just write programs for the
PSP, load them into the memory card and run them? Because the PSP only
runs properly encrypted binaries.

  Of course in order to run them it needs to decrypt them, and to decrypt
them it needs a decryption key. Couldn't this key just be read from the
PSP's memory and use to encrypt third-party programs? The answer is: No.
The decryption key can be read, but it cannot be used to encrypt the
programs.

  Thus encryption in this case works, even though the decryption key is
right there in the ROM of the device.

  (Yes, third-party programs can be run on PSP, at least ones with older
firmwares, but that's achieved by exploiting some bugs, ie. programming
errors in these older firmwares. For my point it's irrelevant.)

  Of course in the case of music you don't need any encryption key, as
the decryption key is enough to do what you want. The only way to protect
that is to protect the decryption key and the decryption process in such
way that you can't get hold of it. Basically you would need a black box,
which is the music player, which cannot be looked inside. That's, in fact,
what the music industry is aiming towards, even if this "black box" is
inside the user's PC or handheld device.

  Of course encryption doesn't patch the analog hole.

-- 
                                                          - Warp

Post a reply to this message