DMCA Crypto Software

[Nomen Nescio]

Ian Clelland writes:

> Anyway, I'm very curious to know where the original numbers (4*10^-10
> and 10^20) came from. Or perhaps my reasoning is just way off on this.

You're forgetting that different subsets of users could share the same
polymorph bits.  From the Cryptography Research report:

   If k out of N decoders collude to try to remove a forensic mark,
   there are C(N,k) possible sets of colluders.  A set of colluders can
   be excluded if no set of members could decode the observed version of
   a polymorph.  If each version of each poymorph can be decrypted by
   an independent random 50% of decoders, each polymorph in the output
   excludes (1/2)^k = 2^(-k) of the collusion sets.  If a total of p
   polymorphs are present, the expected number of non-excluded collusion
   sets is (1 - 2^(-k))^p * C(N,k).

(Here I wrote C(N,k) for the choice function, the number of ways of
choosing k objects from a set of N.)

If you substitute in N = 1 billion, p = 1620 and k=4 or 5, you get the
results presented earlier.  As a trivial case, if you set k=1 you get
N / 2^p, i.e. if you have more than 2^p users, some of them will have
exactly the same set of polymorphs and you can't tell them apart.

One additional point: aside from the earlier difficulties mentioned in
creating these marks, there is also the possibility that they can be
located just by comparing the analog output from two different decoders.
This would allow identification of which are the polymarked frames
without breaking any of the security.  Then it might be possible with
a single broken system to corrupt the marks in those frames (say,
by replacing those frames by an interpolation of surrounding frames)
without significantly degrading the overall quality of the movie if only
1% of frames are marked.

If marking is so subtle that it is not visible in an analog recording,
then an alternative strategy of randomizing the watermark channel may
work.  For example if marks affected only the LSBs of a small portion of
the polymorph frames, then all frames could have their LSBs randomized,
eliminating all the marks with perhaps not much effect on the quality.

It doesn't sound easy to choose marks which can't be eliminated blindly
but also can't be identified by inspecting unbroken versions from
multiple players.  They'll have to walk a fine line to avoid either of
these errors.

By the way, could the moderator arrange for the list archive at
www.mail-archive.com to be updated for the new address?

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com