Implementing a key recovery attack on the High-Bandwidth Digital Content Protection Protocol

We describe our experiences implementing the master-key recovery attack[9] against the High-Bandwidth Digital Content Protection Protocol (HDCP)[10]. We recovered the private keys from 41 HDCP-capable monitors using the key extraction attack of Irwin[12]. We then used the master-key recovery attack of Crosby, et al.[9] to compute the HDCP global secret. The attack used commodity hardware and did not damage the monitors in any observable way. We derive several lessons for DRM producers and consumers from our experience. We propose that DRM systems should have strong renewability in order to manage risks for all parties: content-producers, device manufacturers, and consumers.