High-bandwidth Digital Content Protection (HDCP) is a form of digitalcopy protection developed byIntel Corporation[1] to prevent copying of digital audio and video content as it travels across connections. Types of connections includeDisplayPort (DP),Digital Visual Interface (DVI), andHigh-Definition Multimedia Interface (HDMI), as well as less popular or now deprecated protocols likeGigabit Video Interface (GVIF) andUnified Display Interface (UDI).
The system is meant to stop HDCP-encrypted content from being played on unauthorized devices or devices which have been modified to copy HDCP content.[2][3] Before sending data, a transmitting device checks that the receiver is authorized to receive it. If so, the transmitter encrypts the data to prevent eavesdropping as it flows to the receiver.[4]
In order to make a device that plays HDCP-enabled content, the manufacturer must obtain a license for the patent fromIntel subsidiary Digital Content Protection LLC, pay an annual fee, and submit to various conditions.[5][6][7] For example, the device cannot be designed to copy; it must "frustrate attempts to defeat the content protection requirements";[7] it must not transmit high definition protected video to non-HDCP receivers; and DVD-Audio works can be played only atCD-audio quality[7] by non-HDCP digital audio outputs (analog audio outputs have no quality limits). If the device has a feature likeIntel Management Engine disabled, HDCP will not work.
Cryptanalysis researchers demonstrated flaws in HDCP as early as 2001. In September 2010, an HDCP master key that allows for the generation of valid device keys was released to the public, rendering the key revocation feature of HDCP useless.[8][9] Intel has confirmed that the crack is real,[10] and believes the master key wasreverse engineered rather than leaked.[11] In practical terms, the impact of the crack has been described as "the digital equivalent ofpointing a video camera at the TV", and of limited importance for consumers because the encryption of high-definition discs has beenattacked directly, with the loss of interactive features like menus.[12] Intel threatened to sue anyone producing an unlicensed device.[11]
HDCP uses three systems:[5]
Each HDCP-capable device has a unique set of 40 56-bit keys. Failure to keep them secret violates the license agreement. For each set of values, a special private key called aKSV (Key Selection Vector) is created. Each KSV consists of 40 bits (one bit for each HDCP key), with 20 bits set to 0 and 20 bits set to 1.
During authentication, the parties exchange their KSVs under a procedure calledBlom's scheme. Each device adds its own secret keys together (usingunsigned additionmodulo 256) according to a KSV received from another device. Depending on the order of the bits set to 1 in the KSV, a corresponding secret key is used or ignored in the addition. The generation of keys and KSVs gives both devices the same 56-bit number, which is later used to encrypt data.
Encryption is done by astream cipher. Each decodedpixel is encrypted by applying anXOR operation with a 24-bit number produced by a generator. The HDCP specifications ensure constant updating of keys after each encoded frame.
If a particular set of keys is compromised, their corresponding KSV is added to a revocation list burned onto new discs in the DVD and Blu-ray formats. (The lists are signed with aDSA digital signature, which is meant to keep malicious users from revoking legitimate devices.) During authentication, the transmitting device looks for the receiver's KSV on the list, and if it is there, will not send the decrypted work to the revoked device.
HDCP devices are generally divided into three categories:
Each device may contain one or more HDCP transmitters and/or receivers. (A single transmitter or receiver chip may combine HDCP and HDMI functionality.)[4]
In theUnited States, the Federal Communications Commission (FCC) approved HDCP as a "Digital Output Protection Technology" on 4 August 2004.[13] The FCC'sBroadcast flag regulations, which were struck down by theUnited States Court of Appeals for the District of Columbia Circuit, would have requiredDRM technologies on all digital outputs from HDTV signal demodulators.Congress is still considering[when?] legislation that would implement something similar to the Broadcast Flag.[citation needed] The HDCP standard is more restrictive than the FCC's Digital Output Protection Technology requirement. HDCP bans compliant products from converting HDCP-restricted content to full-resolution analog form, presumably in an attempt to reduce the size of theanalog hole.[weasel words]
On 19 January 2005, the European Information, Communications, and Consumer Electronics Technology Industry Associations (EICTA) announced that HDCP is a required component of the European "HD ready" label.[14]
MicrosoftWindows Vista andWindows 7 both use HDCP in computer graphics cards and monitors.[15][16]
HDCP strippers decrypt the HDCP stream and transmit an unencrypted HDMI video signal so it will work in a non-HDCP display. It is currently[when?] unclear whether such devices would remain working if the HDCP licensing body issued key-revocation lists, which may be installed via new media (e.g. newerBlu-ray Discs) played-back by another device (e.g. a Blu-ray Disc player) connected to it.[17]
In 2001, Scott Crosby ofCarnegie Mellon University wrote a paper withIan Goldberg, Robert Johnson, Dawn Song, andDavid Wagner called "A Cryptanalysis of the High-bandwidth Digital Content Protection System", and presented it at ACM-CCS8 DRM Workshop on 5 November.[18]
The authors concluded that HDCP's linear key exchange is a fundamental weakness, and discussed ways to:
They also said the Blom's scheme key swap could be broken by a so-calledconspiracy attack: obtaining the keys of at least 40 devices and reconstructing the secret symmetrical master matrix that was used to compute them.
Around the same time,Niels Ferguson independently claimed to have broken the HDCP scheme, but he did not publish his research, citing legal concerns arising from the controversialDigital Millennium Copyright Act.[19]
In November 2011 Professor Tim Güneysu ofRuhr-Universität Bochum revealed he had broken the HDCP 1.3 encryption standard.
On 14 September 2010,Engadget reported the release of a possible genuine HDCP master key which can create device keys that can authenticate with other HDCP compliant devices without obtaining valid keys from The Digital Content Protection LLC. This master key would neutralize the key revocation feature of HDCP, because new keys can be created when old ones are revoked.[8] Since the master key is known, it follows that an unlicensed HDCP decoding device could simply use the master key to dynamically generate new keys on the fly, making revocation impossible. It was not immediately clear who discovered the key or how they discovered it, though the discovery was announced via aTwitter update which linked to aPastebin snippet containing the key and instructions on how to use it. Engadget said the attacker may have used the method proposed by Crosby in 2001 to retrieve the master key, although they cited a different researcher. On 16 September, Intel confirmed that the code had been cracked.[20][21] Intel has threatened legal action against anyone producing hardware to circumvent the HDCP, possibly under theDigital Millennium Copyright Act.[11]
In August 2012 version 2.1 was proved to be broken.[22] The attack used the fact that the pairing process sends theKm key obfuscated with anXOR. That makes the encryptor (receiver) unaware of whether it encrypts or decrypts the key. Further, the input parameters for the XOR and the AES above it are fixed from the receiver side, meaning the transmitter can enforce repeating the same operation. Such a setting allows an attacker to monitor the pairing protocol, repeat it with a small change and extract theKm key. The small change is to pick the "random" key to be the encrypted key from the previous flow. Now, the attacker runs the protocol and in its pairing message it getsE(E(Km)). SinceE() is based on XOR it undoes itself, thus exposing theKm of the legitimate device.
V2.2 was released to fix that weakness by adding randomness provided by the receiver side. However the transmitter in V2.2 must not support receivers of V2.1 or V2.0 in order to avoid this attack. Hence a new erratum was released to redefine the field called "Type" to prevent backward compatibility with versions below 2.2. The "Type" flag should be requested by the content's usage rules (i.e. via the DRM or CAS that opened the content).[23]
In August 2015, version 2.2 was rumored to be broken. An episode of AMC's seriesBreaking Bad was leaked to the Internet in UHD format; its metadata indicated it was anHDMI cap, meaning it was captured through HDMI interface that removed HDCP 2.2 protection.[24][25]
On 4 November 2015, Chinese company LegendSky Tech Co., already known for their other HDCP rippers/splitters under the HDFury brand, released the HDFury Integral, a device that can remove HDCP 2.2 from HDCP-enabled UHD works.[26] On 31 December 2015,Warner Bros and Digital Content Protection, LLC (DCP, the owners of HDCP) filed a lawsuit against LegendSky.[27][28] Nevertheless, the lawsuit was ultimately dropped after LegendSky argued that the device did not "strip" HDCP content protection but rather downgraded it to an older version, a measure which is explicitly permitted in DCP's licensing manual.[29]
HDCP can cause problems for users who want to connect multiple screens to a device; for example, a bar with several televisions connected to one satellite receiver or when a user has a closed laptop and uses an external display as the only monitor. HDCP devices can create multiple keys, allowing each screen to operate, but the number varies from device to device; e.g., a Dish or Sky satellite receiver can generate 16 keys.[30] The technology sometimes causeshandshaking problems where devices cannot establish a connection, especially with older high-definition displays.[31][32][33]
Edward Felten wrote "the main practical effect of HDCP has been to create one more way in which your electronics could fail to work properly with your TV," and concluded in the aftermath of the master key fiasco that HDCP has been "less a security system than a tool for shaping the consumer electronics market."[34]
Additional issues arise when interactive media (i.e. video games) suffer fromcontrol latency, because it requires additional processing for encoding/decoding. Various everyday usage situations, such as live streaming or capture of game play, are also adversely affected.[35]
There is also the problem that all Apple laptop products, presumably in order to reduce switching time, when confronted with an HDCP-compliant sink device, automatically enable HDCP encryption from the HDMI / Mini DisplayPort / USB-C connector port. This is a problem if the user wishes to use recording or videoconferencing facilities further down the chain, because these devices most often do not decrypt HDCP-enabled content (since HDCP is meant to avoid direct copying of content, and such devices could conceivably do exactly that). This applies even if the output is not HDCP-requiring content, like aPowerPoint presentation or merely the device's UI.[36] Some sink devices have the ability to disable their HDCP reporting entirely, however, preventing this issue from blocking content to videoconferencing or recording. However, HDCP content will then refuse to play on many source devices if this is disabled while the sink device is connected.[37]
When connecting a HDCP 2.2 source device through compatible distribution to a video wall made of multiple legacy displays the ability to display an image cannot be guaranteed.[38]
| HDCP revision | Release Date | Notes |
|---|---|---|
| 1.0 | 17 February 2000 | Supports DVI only |
| 1.1 | 9 June 2003 | Supports DVI, HDMI |
| 1.2 | 13 June 2006 | Supports DVI, HDMI |
| 1.3 | 21 Dec 2006 | Supports DVI, HDMI,DP,GVIF,UDI |
| 1.4 | 8 July 2009 | |
| 2.0 IIA | 23 Oct 2008 |
|
| 2.1 IIA | 18 July 2011 |
|
| 2.2 IIA | 16 October 2012 |
|
| 2.2 for HDMI | 13 February 2013 |
|
| 2.2 forMHL | 11 September 2013 | |
| 2.3 for HDMI | 28 February 2018 |
The 2.x version of HDCP is not a continuation of HDCPv1, and is rather a completely different link protection. Version 2.x employs industry-standard encryption algorithms, such as 128-bitAES with 3072 or 1024-bitRSA public key and 256-bitHMAC-SHA256 hash function.[23] While all of the HDCP v1.x specifications support backward compatibility to previous versions of the specification, HDCPv2 devices may interface with HDCPv1 hardware only by natively supporting HDCPv1, or by using a dedicated converter device. This means that HDCPv2 is only applicable to new technologies. It has been selected for theWirelessHD andMiracast (formerly WiFi Display) standards.[39][40]
HDCP 2.x features a new authentication protocol, and a locality check to ensure the receiver is relatively close (it must respond to the locality check within 7 ms on a normal DVI/HDMI link).[23] Version 2.1 of the specification was cryptanalyzed and found to have several flaws, including the ability to recover the session key.[22]
There are still a few commonalities between HDCP v2 and v1.