DTCP Key Format 小註解

因為 OEM 在問, 所以我上網找了些公開的資料. DTCP (Digital Transmission Content Protection) 的概念類似 HDCP, 由 DTLA (Digital Transmission License Administrator) [1] 所維護. 顧名思義 DTCP 強調傳輸的部分.

版本又分成 DTCP [3] 和 DTCP2, “2″ 和 “1″ 不相容, DTCP2 主要是用來保護 4K, 8K 的 content. 舊版的的 DTCP 主要用來保護 HD 的影像. 再來就講到 key 的內容了, 首先分成 unique key 和 common key.

詳細的說明在 [4] 的 P.6, 本來每個 device 的 key 都要長得不一樣. 但是如果你是大戶買很多把的話, 就可以都用一樣的 key 比較方便, 這個叫做 common key. 當然 common key 被濫用的話, 必須要能夠被註銷. 這些規範寫在 Section 2.2 of the Procedural Appendix. F (p. 60).

2.3 Device Certificate and Device Keys. Device Certificates and Device Keys are necessary to
manufacture Licensed Products. These are generated under the direction of DTLA and, except in the
case that Adopter elects to use a Common Device Certificate and Common Device Key for certain
devices as described in the Procedural Appendix and Compliance Rules, are generated uniquely per
device. Without limiting any other provision of this Agreement, Adopter may not use the same
Device Key or Device Certificate in more than one individual unit or copy of any product or
component except for the use of Common Device Keys and Common Device Certificates in
accordance with Section 2.2 of the Procedural Appendix. F

Unique key 在 DTCP 有三種 certificate format, 在 DTCP2 只有一種. DTCP 的三種 format. 定義在  RFC7562 [2]. Format 0 給計算能力比較有限的 device 用. Format 1 給計算能力強的 device 用, Format 3 就給有額外需求的 device 用 [3]. 看起來 embedded system 比較適合 format 0.

Certificate Format (4 bits). This field specifies the format for a specific type of certificate. Currently three
formats are defined:
o Format 0 = the Restricted Authentication device certificate format (See Chapter 5).
o Format 1 = the Baseline Full Authentication device certificate format.
o Format 2 = the Extended Full Authentication device certificate format (NOT ESTABLISHED2
).
o Other encodings are currently reserved.

DTCP certificates issued by [DTLA] to DTLA-compliant devices come in
   three general variations (see Section 4.2.3.1 of [DTCP]):

   o  Restricted Authentication device certificate format (Format 0):
      Typically issued to devices with limited computation resources.

   o  Baseline Full Authentication device certificate format (Format 1):
      This is the most commonly issued certificate format.  Format 1
      certificates include a unique DeviceID and device EC-DSA public/
      private key pair generated by the DTLA.  (See Section 4.3 of
      [DTCP]).

   o  Extended Full Authentication device certificate format (Format 2):
      This is issued to devices that possess additional functions (e.g.,
      additional channel ciphers, specific device properties).  The
      presence of these additional functions is indicated by the device
      capability mask as specified in Section 4.2.3.2 of [DTCP].  Format
      2 certificates also include a unique DeviceID and device EC-DSA
      public/private key pair generated by the DTLA (see Section 4.3 of
      [DTCP]).

   The mechanism specified in this document allows only Formats 1 and 2
   DTCP certificates to be exchanged in the supplemental data message
   since it requires the use of the EC-DSA private key associated with
   the certificate.

既然 DTCP2 用來保護 4K, 8K 的內容, 當然就不用顧及老弱殘兵的計算能力了. 按照 2018 年的 DTCP2 spec., 就只有 format 1 一種.

[Ref]

1. https://www.dtcp.com/default.aspx

2. https://tools.ietf.org/html/rfc7562#page-6

3. http://www.dtcp.com/documents/dtcp/info-20130605-dtcp-v1-rev-1-7-ed2.pdf

4. http://www.dtcp.com/documents/licensing/dtla-adopter-agreement.pdf