Hacker News Reader

Comment by tptacek | Hacker News Reader

Is this something scarier than simply a video decode IP block that's TrustZone aware, or is Torrentfreak hyperventilating?

View on HN

The source blog post suggests it's exactly that. Whether that's scary or not depends on your perspective - I doubt it will prevent any material from leaking out, but it certainly could encourage companies to restrict video playback to devices that support the feature, which would be rather annoying for users of other devices. That is, if manufacturers bother to actually use it...

At this point in the development of ARM, an argument against TZ-aware video blocks is basically an argument that ARMH should deliberately hamstring its IP blocks to prevent them from being used to implement content protection, right? TZ isn't spooky DRM technology.

TZ in video decoders has little use other than content protection, and ARM is explicitly positioning it for use as such. While the article is certainly very hyperbolic, and many more steps will need to be taken before an annoying scenario of the type I described is likely to come to pass, I think it is a valid concern.

Any security feature in a video decoder is going to be designed for rightsholders. :)

If you're concerned about content protection, the inevitability of hardware-assisted content protection as hardware security improves is a valid concern.

But since TZ is (a) a technology with more non-DRM uses than DRM uses and (b) a fundamental part of the overall ARM architecture, not extending it to other ARM IP blocks would have been an odd choice. That's all I'm saying.

It's not necessarily true that TZ in video = DRM. It could also be used in secure UI scenarios.

A video decoder block? What's an example scenario there?

Secure videoconferencing? But yes, a stretch use case, I know!

> it certainly could encourage companies to restrict video playback to devices that support the feature

So if I want to buy a legal download, I'll have all sorts of hassle along the lines of "will it work on my hardware?", but if I get a pirate Torrent, then I know it'll work? If that's the scenario, I won't even consider going the legal route.

Even when they're right about how heinous the latest legal and/or technical stunt the Copyrights Über Alles crowd has gotten up to is, when is Torrentfreak not hyperventilating?

Maybe they have good reason to hyperventilate?

The notion of hardware DRM -- the movie industry controlling your device at a hardware level is frustrating enough to me.

Their reason for hyperventilating is ad impressions. Their business model is telling (former) digg users how awesome they are and how evil the xxAA's are.

it sounds like the gpu basically has some keys and does the decryption before sending the stream to the screen.

ie you'd need to dump the keys from the hardware or find a flaw in the implementation or dump what the screen gets, basically. the last one always works, although its not very neat.

The best way to understand TZ is to understand how virtualization works (that's not what TZ is, but still); think of it like a hardware chroot(2) jail.

So we can expect a break (possibly via PubKey replacement) for it by some hacker adept at machine code in 10... 9... 8...

Meanwhile, what would really determine whether or not this is scary is adoption. Until a fair number of TVs, set top boxes, smartphones or what have you, actually start to carry the thing, there's nothing to worry about yet.

As long as the device is properly integrated, TZ provides protection against software attacks - the hardware prevent accesses to sensitive areas by the regular OS. Machine code skills won't help unless the implementation is flawed.

It doesn't sound like anything new. The current SoC specific solutions typically have dynamic firewalls configured on a per IP block basis interacting with some crap in trustzone.

I suppose the thing that is new is ARM offering this kind of IP off the shelf (maybe).

Not as scary as the thought in my mind that this is just Intel astroturfing

Reply on news.ycombinator.com