Feeds

CPRM creator blasts The Register

Wotta lotta double-spiech

  • alert
  • submit to reddit

Security for virtualized datacentres

The scientist behind the CPRM copy control caper took a swipe at The Register in a lecture at Stanford University yesterday.

Unfortunately Jeff Lotspiech, manager Content Protection Technology Group at IBM's Almaden, marred an otherwise excellent talk on the subject with a display of selective amnesia.

The billing promised to debunk the CPRM 'myths': "an object lesson for the media naïve researcher."

But how well the debunking stands up to debunking itself, you can judge for yourself.

"A lot of press reports came out and said this evil thing is going to be put on everybody's hard drive," said Jeff. Which might well happen, of course. Informed soundings we've taken suggest that the initial outcry may have won only a temporary reprieve.

Although Lotspiech has been quiet since the CPRM story broke, he hasn't been idle. In fact, he's assembled an entire man, made out of straw.

"The first article that appeared implied that the way this thing worked was an IBM server somewhere [sic], that your hard drive connected to, and this server judged whether or not the file you were going to record on your HD was worthy of being recorded," he said.

Of course the first article that appeared didn't suggest anything of the sort. It's here , as way of reference. The rights management in a CPRM system is in a wrapper around the content. It looks for local keys, not over the Internet, and that's very much the point. We did describe how business users might benefit from implementing a centralized key infrastructure, but that isn't the same thing at all. And that idea was commended to us by ... IBM.

"That got people upset, but of course it was nonsense."

Compounding the felony, Jeff suggests that the intention was never to 'standardize' CPRM. Which, even allowing for some double-jointed semantic gymnastics, doesn't accurately describe the sequence of events last Autumn. The first submission to the ATA T.13 standards group specifically described CPRM as the content mechanism. The um, clue's in the name: "Content Protection for Recordable Media (CPRM) Proposal" After the October T.13 meeting, the proposal was made more generic, but the name remained the same. And T.13 is a standardization committee.

We thought we'd well and truly debunked Lotspiech's point that the proposal was only ever optional. It was, notionally. But the certainty that optional commands would remaining optional in a command spec that only covers a tiny subset of commands, and the lowest common denominator at that, has been rejected by Bruce Schneier, amongst others.

The audience was more concerned with finding out the cryptography worked, rather than apologias. Which Lotspiech explains admirably: it's recommended viewing if you're puzzled about the issue. Or even if you aren't. For CPRM is in its own twisted way, jolly clever.

One attendee at least found Lotspiech's stab for martyrdom "quitely convincing" ... although whether he means it was "quite convincing" or "quietly convincing" we're not sure. But the author, QuantumG, tells us he thinks "zdnet started all this crap about harddrives, slashdot propogated it". Which we suspect is a rapid way of losing your /. link, we guess.

Your correspondent wasn't able to make the talk, catching the video playback instead. Passing our regards to Jeff via proxy, the good man described The Register as "my biggest problem".

Which is the most flattering thing anyone's said about us for ages. And mirrors our concerns about CPRM exactly... ®

Related Links

Almost Full CPRM on ATA coverage

Security and trust: The backbone of doing business over the internet

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Special pleading against mass surveillance won't help anyone
Protecting journalists alone won't protect their sources
Big Content Australia just blew a big hole in its credibility
AHEDA's research on average content prices did not expose methodology, so appears less than rigourous
Bono: Apple will sort out monetising music where the labels failed
Remastered so hard it would be difficult or impossible to master it again
Vodafone to buy 140 Phones 4u stores from stricken retailer
887 jobs 'preserved' in the process, says administrator PwC
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.