Film-Tech Forum ARCHIVE: Make KDM for encrypted DCP

This is topic Make KDM for encrypted DCP in forum Digital Cinema Forum at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=16;t=002120

Posted by Michael Qu (Member # 6702) on 12-02-2014, 08:36 PM:

[Big Grin]

I am coming again.
My question this time is about KDM.
I have made an encrypted DCP and an KDM made from the CPL file.
But when i deliver the DCP,it will contain the CPL file.Does this mean anyone who get the CPL file can make KDM for their server?Or how the produser protect themselves? [Confused]

Posted by Dave Macaulay (Member # 813) on 12-02-2014, 09:21 PM:

To make a KDM you need the server certificate for the server you want to allow the encrypted CPL to play on.
The KDM is a very small file, it is not the movie data which must be delivered separately. A KDM is an encrypted key to allow only the server it was made for play the encrypted CPL for the time period you specify when you generate the KDM.

Posted by James Westbrook (Member # 3690) on 12-02-2014, 10:34 PM:

I am supposed to be more "professional" than this but I am still giggling at "I am coming again."

Posted by Michael Qu (Member # 6702) on 12-03-2014, 04:15 AM:

[Big Grin]

Pause giggling,James please. My English isn't well.Please help me.I am very confused.
During the process of make the kdm,the software ask me to choose the CPL file. Dose this mean anyone who got the encrypted DCP's CPL can make KDM for their server with the server's certification file?

Posted by Carl Hetherington (Member # 7107) on 12-03-2014, 04:45 AM:

quote: Michael Qu
Dose this mean anyone who got the encrypted DCP's CPL can make KDM for their server with the server's certification file?

No. They would also need to know the key that was used to encrypt the picture and sound assets.

Posted by Marcel Birgelen (Member # 6801) on 12-03-2014, 05:25 AM:

I guess you need to dive into how this whole DCI and PKI encryption scheme works.

The simplified version:

- You encrypt your content with your own encryption key. Essentially, you encrypt all content related assets in the DCP, both audio and video.
- Your customer's server also has an encryption key stored in the media block, actually a private and a public key. The public key can be exported, the private key in the server remains private, even for the customer. It's protected by all kinds of security measures, so you cannot easily retrieve it from the media block.
- Your customer sends you their public key.
- Now you send them your key to the content via a KDM. But you do not send this key plain text, otherwise your customer could just get the key from the KDM and essentially do whatever they want with it. The key in your KDM is encrypted, using the public key from the server of your customer. This way, it can only be decrypted with the private key inside the media block in the server.

The media block, the protected part in the server, serves as content police and secure key vault. It's responsible for securely storing the server's private key, securely decrypting the content and also enforcing time limitations on the validity of the KDM.

A secure media block must be designed in such a way, that any tampering will essentially destroy the sensitive parts of the memory. It also keeps its own clock, which can only be adjusted within very limited time frames, this is to avoid somebody using the age old trick of resetting the clock to extend content/license validity.

Posted by Michael Qu (Member # 6702) on 12-03-2014, 05:35 AM:

quote: Carl Hetherington
No. They would also need to know the key that was used to encrypt the picture and sound assets.

Oh, so where is the key stored?

Posted by Marcel Birgelen (Member # 6801) on 12-03-2014, 05:48 AM:

The key is inside your KDM, but encrypted with the public key of the customer server. The KDM will only be decrypted by the secure media block, if the content is needed and your unencrypted key should only reside inside the protected memory of the media block, while the content is being used.

Posted by Carsten Kurz (Member # 5396) on 12-03-2014, 05:50 AM:

On the machine that you used to create the DCP and KDM.

The KDM then will also store this key, naturally, but encrypted with the target servers certificate. So as long as you don't expose the key from your local machine, your DCP is safe.

Which software are you using?

- Carsten

Posted by Michael Qu (Member # 6702) on 12-03-2014, 08:49 AM:

quote: Carsten Kurz
On the machine that you used to create the DCP and KDM.

The KDM then will also store this key, naturally, but encrypted with the target servers certificate. So as long as you don't expose the key from your local machine, your DCP is safe.

Which software are you using?

Hi Carsten,I use DCP-o-matic,which is a free sofetware.I package the DCP with my PC,so the key is in my PC?But I didn't find any other files except the DCP fiLes.

Posted by Annli Com (Member # 8266) on 12-03-2014, 09:01 AM:

DCP O MATIC Automatic Download some Model Severs Certificates.
Any Doubts for dcp O matic Related please contact carl@dcpomatic.com

Posted by Marcel Birgelen (Member # 6801) on 12-03-2014, 09:31 AM:

Michael, did you check the On-line documentation of DCP-o-matic?

quote:
The first part is simple: ticking the Encrypted box in the DCP tab of DCP-o-matic will encrypt the DCP using a random key that DCP-o-matic generates. The key will be written to the film's metadata file, which should be kept secure.

Source

Posted by Michael Qu (Member # 6702) on 12-03-2014, 10:11 AM:

quote: Marcel Birgelen
Michael, did you check the On-line documentation of DCP-o-matic?

More information in the documentation?Several mouths ago,I read the whole document, but this time,only the "KDM" part. I will check it for more.

quote: Marcel Birgelen
The simplified version:

- You encrypt your content with your own encryption key. Essentially, you encrypt all content related assets in the DCP, both audio and video.
- Your customer's server also has an encryption key stored in the media block, actually a private and a public key. The public key can be exported, the private key in the server remains private, even for the customer. It's protected by all kinds of security measures, so you cannot easily retrieve it from the media block.
- Your customer sends you their public key.
- Now you send them your key to the content via a KDM. But you do not send this key plain text, otherwise your customer could just get the key from the KDM and essentially do whatever they want with it. The key in your KDM is encrypted, using the public key from the server of your customer. This way, it can only be decrypted with the private key inside the media block in the server.

The media block, the protected part in the server, serves as content police and secure key vault. It's responsible for securely storing the server's private key, securely decrypting the content and also enforcing time limitations on the validity of the KDM.

A secure media block must be designed in such a way, that any tampering will essentially destroy the sensitive parts of the memory. It also keeps its own clock, which can only be adjusted within very limited time frames, this is to avoid somebody using the age old trick of resetting the clock to extend content/license validity.

Oh,this make me clear.I misunderstand the privite key as the key of the DCP Maker
[Frown]

Posted by Steve Guttag (Member # 268) on 12-03-2014, 10:37 AM:

The person that is to run your encrypted content will need to send YOU their "Certificate" and in particular the "PEM" file. You can then make a KDM for them using that PEM file and DCP O Matic. In this way, the content is always encrypted and will only run on the server(s) you authorize for the time periods you authorize. Follow the link to see the instructions. But your client must send you their Certificate/PEM file.

http://www.dcpomatic.com/manual/html/ch07s02.html#fig-kdm

Posted by Carsten Kurz (Member # 5396) on 12-03-2014, 03:54 PM:

quote: Michael Qu
I package the DCP with my PC,so the key is in my PC?But I didn't find any other files except the DCP fiLes.

Michael - the 'raw' key that is used to encrypt the DCP, and which is used to create the KDM afterwards, is stored with the other project definition in the metadata.xml file. You can look it up there if you want.

So this stays safe on your computer, if you don't accidentally copy it with the DCP to a distribution drive. If you lose it, delete the project file/folder, etc., you will not be able to create another KDM for this particular DCP/CPL.
You would have to create the full DCP from scratch incl. encryption with a new key.

To create KDMs, you will first need to create a database of certificates/screen/theater references within DCP-o-matic. When creating a KDM for a specific screen, you will link this screens/servers certificate with the CPL you created, then either store the KDM file locally or set up an email chain to send it directly to the theater/projectionist.
This KDM is then only valid for that particular screen, and within the given time frame you set. DCP-o-matic will create this time frame based on your local machine timezone settings. So if you let the window start at 9am, this will be YOUR 9am. As long as your DCP doesn't cross timezones, you can ignore this.

- Carsten

Posted by Michael Qu (Member # 6702) on 12-03-2014, 09:14 PM:

quote: Carsten Kurz
Michael - the 'raw' key that is used to encrypt the DCP, and which is used to create the KDM afterwards, is stored with the other project definition in the metadata.xml file. You can look it up there if you want.

So this stays safe on your computer, if you don't accidentally copy it with the DCP to a distribution drive. If you lose it, delete the project file/folder, etc., you will not be able to create another KDM for this particular DCP/CPL.
You would have to create the full DCP from scratch incl. encryption with a new key.

To create KDMs, you will first need to create a database of certificates/screen/theater references within DCP-o-matic. When creating a KDM for a specific screen, you will link this screens/servers certificate with the CPL you created, then either store the KDM file locally or set up an email chain to send it directly to the theater/projectionist.
This KDM is then only valid for that particular screen, and within the given time frame you set. DCP-o-matic will create this time frame based on your local machine timezone settings. So if you let the window start at 9am, this will be YOUR 9am. As long as your DCP doesn't cross timezones, you can ignore this.

Thanks Carsten,I understand it now. [beer]

Posted by System Notices (Member # 2357) on 08-28-2018, 05:08 PM:

It has been 1363 days since the last post.

Posted by Cameron Glendinning (Member # 3516) on 08-28-2018, 05:08 PM:

Can you generate KDM's for DCP's authored and encrypted on other software like Clipster, through Dcp O Matic?

Posted by Carl Hetherington (Member # 7107) on 08-28-2018, 05:54 PM:

quote: Cameron Glendinning
Can you generate KDM's for DCP's authored and encrypted on other software like Clipster, through Dcp O Matic?

Yes, so long as you have a DKDM for the encrypted DCP.

Posted by Cameron Glendinning (Member # 3516) on 08-28-2018, 08:09 PM:

Thank you Carl.

Posted by Frank Angel (Member # 248) on 08-29-2018, 02:58 PM:

Is there a chart showing the specific abbreviations used in the DCP name that identifies the movie title, picture and sound formats etc., and the order they are supposed to be listed when giving the DCP name? Is the DCP name with those specific abbreviations, generated by the DCP authoring software or does it the name need to be created manually?

Secondly, can a KDM be authored so it will have a start and stop dates and times, but not necessarily required to have the private key of the projector, in other words, it can be played anywhere on any projector but restricted to within that specified time frame?

If a DCP has multiple items in the playlist, say a film festival with a program of multiple shorts, is it possible for the projectionist (or rather I should say the "server operator") to manually pause between items on the playlist as the show is running and how easy or difficult is it?

Posted by Carl Hetherington (Member # 7107) on 08-29-2018, 03:49 PM:

quote: Frank Angel
Is there a chart showing the specific abbreviations used in the DCP name that identifies the movie title, picture and sound formats etc., and the order they are supposed to be listed when giving the DCP name? Is the DCP name with those specific abbreviations, generated by the DCP authoring software or does it the name need to be created manually?

DCP-o-matic does it for you, or you can consult The ISDCF's page

quote: Frank Angel
Secondly, can a KDM be authored so it will have a start and stop dates and times, but not necessarily required to have the private key of the projector, in other words, it can be played anywhere on any projector but restricted to within that specified time frame?

Not so far as I am aware. If a KDM could be decrypted by anybody then anybody could make new KDMs with different start/stop times.

quote: Frank Angel
If a DCP has multiple items in the playlist, say a film festival with a program of multiple shorts, is it possible for the projectionist (or rather I should say the "server operator") to manually pause between items on the playlist as the show is running and how easy or difficult is it?

I've only used Doremi servers, and you can on those (just hit pause on the control panel).

Posted by Carsten Kurz (Member # 5396) on 08-29-2018, 04:05 PM:

The operator may use the pause button on the server screen, or, most servers also support remote control options for transport, such as, a button, or network/serial command. Often also an interface on a wireless connected phone/tablet/notebook is possible.

- Carsten

Posted by Jim Cassedy (Member # 4115) on 08-29-2018, 04:55 PM:

quote: Frank Angel
is it possible for the projectionist (or rather I should say the "server operator") to manually pause between items on the playlist

On some equipment (such as Doremi & Christie) it's also possible to build an
"automatic" pause into a playlist, so that it will pause without operator
intervention. I am right now working at a large film festival and am in
the process of creating a number of such playlists with auto-pauses.

Posted by Carsten Kurz (Member # 5396) on 08-30-2018, 06:40 AM:

...and of cause the difference between pause and stop on these systems is that the current image is freezed on screen in pause mode. This may be desirable (black, or a festival logo), or not.

- Carsten

Posted by Frank Angel (Member # 248) on 08-30-2018, 10:01 AM:

Many thanks, guys. The film school rents a local theatre to show their end-of-year "film" festival of a few dozen Film Major student and Masters theses films, and this year I will be trying to convince them to author DCPs to hand to the projectionist rather than a stack of BluRays (knowing what showing non-standard formats entail for the projectionist). I just want to bone up on the DCP authoring process.

Is there a "standard" hard drive that the distributors send to the theatres? We want to give the projectionist what he normally sees rather than something unusual.

Posted by Carl Hetherington (Member # 7107) on 08-30-2018, 01:26 PM:

Commercial operations (in the UK at least) usually use some variation on this.

They're quite expensive though. A USB hard drive (ideally with a power supply) would be fine.

Posted by Carsten Kurz (Member # 5396) on 08-30-2018, 02:26 PM:

Frank, I'd simply create two or three short test DCPs - one flat, one scope, one 16:9, copy them to an NTFS formatted USB drive, and give them to that theatre for a test beforehand. Most operators prefer CRU drives, but there now many servers that have no direct CRU/SATA ingest option at all, and so they do everything through USB2/USB3.
While ext2/3 is the official format, no current server has issues with NTFS.

- Carsten