<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>"Auracast" is a new *broadcast* service of Bluetooth LE which
allows for low-latency audio to be broadcast to
phones/earbuds/speakers/hearing aids in "public" places.</p>
<p><a class="moz-txt-link-freetext" href="https://www.bluetooth.com/auracast/">https://www.bluetooth.com/auracast/</a></p>
<p><br>
</p>
<p>Auracast supports encryption via passwords; I don't know anything
about the details of how it works, but it doesn't matter, since
I'm more interested in the general problem of encrypting
broadcasts rather than the specific choices/recommendations of
Auracast.</p>
<p><br>
</p>
<p>A traditional method of controlling access has been the *physical
ticket*: you get access to the performance if you have an
authentic physical ticket.</p>
<p>Today's physical tickets each have unique ID's, so there has to
be a non-broadcast 1-1 synchronization mechanism in order to
mediate access to the broadcast, and receive some sort of access
token.<br>
</p>
<p>But how do you keep someone who's already gotten an access token
from re-distributing his token ("replay attack"), or
re-broadcasting the material on another channel
("man-in-the-middle" attack) ?<br>
</p>
<p>Re-broadcasting should be noticeable due to the longer latency,
but if he/she re-encrypts it with another key, how will anyone
know that there's an illegal copy of the first broadcast ?</p>
<p>This problem is somewhat analogous to the music CD/video DVD
problem, since the CD's/DVD's are all identical (aren't they?).<br>
</p>
<p>I assume that this digital broadcast problem has already been
worked on, so I'm asking for references/links.</p>
<p><br>
</p>
<p>TIA</p>
<p><br>
</p>
</body>
</html>