Film-Tech Forum ARCHIVE: How to request certs for KDM generation

This is topic How to request certs for KDM generation in forum Digital Cinema Forum at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=16;t=002944

Posted by Jonathan Seaman (Member # 6150) on 02-13-2017, 11:14 AM:

Hi all,

Firstly apologies if this is not the place to post it or if this has already been answered. I did a search and couldn't find what I was looking for.

Myself and a friend are starting up a business where we generate DCPs and we are offering the option of Encrypted DCPs and KDMs. I work in a cinema and know how the system works but I am not sure of where we can obtain the certs for KDM generation.

I know here in the UK the DCP/KDM generators such as Deluxe request the serial number of the server/IMB along with the make and model of the server/projector from the cinema however I do not know where they go with this information to obtain our KDM certs as I, as the chief technician/projectionist at a cinema, have never had to provide them with a copy of the cert from the Sony 4Ks we have installed.

Does anyone know if there is a central database for this information or know how to go about contacting the relevant people to obtain this information as it will so greatly help us with our new business.

Many thanks in advance.
Jonny

Posted by Carsten Kurz (Member # 5396) on 02-13-2017, 11:36 AM:

All the Mastering/KDM service companies consider their cert/site databases as business secrets. There is no general database available. Keeping this information up-to-date, even for a specific geographic region only, means quite some work.

Some manufacturers supply a serial-number/certificate reference upon request, some offer a web or FTP interface. The Dolby/Doremi cert download site covers many servers of the Dolby and Doremi brands:

http://www.dolbycustomer.com/cinema/Certificates

Some servers allow to download the certificate from the unit itself to a USB stick or connected PC. But that means you need to contact every individual cinema for a request and hope they get it right for all their screens.

http://www.film-tech.com/ubb/f16/t002905.html

- Carsten

Posted by Dave Macaulay (Member # 813) on 02-13-2017, 09:52 PM:

The distributors send out a data request form when a cinema is built or converted and needs a feature kdm.
They request a lot of information but the basic info required is the site's email address and their server brand/model plus media block serial number. Some other info is needed to get the right kdm generated - the cpl and thus its kdm will be different for things like 5.1 vs 71, dbox, atmos, different language audio or subtitles, etc.
With that they get the certificates from the server manufacturer as they need them, and keep them on file.
Doremi and Barco have the server certificate files online: probably Dolby, NEC, GDC, Christie, Sony etc also do. That saves having to pay someone to handle cert requests.
I suggest asking for your client cinemas server brand, model, and SM serial #. Contact the manufacturers tech support and ask how to get the certificates to make a kdm. I expect they will give you a login for their cert ftp or web repository. There aren't that many server manufacturers so pretty soon you should have access to all the certs you may need.

Posted by Leo Enticknap (Member # 534) on 02-13-2017, 11:10 PM:

You will need the media block certs provided for every screening venue. You could keep them on your system, but given that venues can and do change media blocks, I would at least ask for confirmation that there hasn't been any change before every KDM issue.

As someone who also does a little bit of DCP making for third party venues, be prepared for a world of pain when it comes to encryption. Problems you may well encounter are:

"Media block cert? What's that?" from multiplex staff who have never had to provide one, or even know what it is, because all the DCPs they get come from Deluxe, who have had their .PEMs in their database since the beginning of (digital cinema) time.

Because the theater staff don't know what they're doing, they give you the wrong cert. For example, they're using a DSS200 with a cat745 IMB, but accidentally give you the serial number for the built-in cat862, which is not in use, because that's the easiest to find serial # sticker, in the most obvious place. They may also give you the server's chassis serial number rather than the media block or IMB serial.

If you will be doing jobs for customers in different time zones, be very careful of open/close times for KDMs.

Be prepared for panic calls and emails 24/7, expecting a response within minutes, if a KDM doesn't work, and/or they decide they want it open earlier or later for some last minute reason. If you can't provide that sort of response, agree with the customer in advance when you will be available to respond to queries and in what turnaround time and how much you will charge for this ongoing service.

Whenever anyone asks me to make a DCP for them, whether it's for screening in one of our venues or some place else, I always advise against encryption unless they have a very good reason for encrypting. Remember, that when you make an unencrypted DCP, as soon as you've handed over the drive(s), the job is done and you walk away (unless you have agreed to store the DCP and keep it available to make further copies for a set period, which, if it were me, I'd charge extra for). If you've encrypted it, however, you're going to have to be available to make and troubleshoot KDMs for it, as long as it's in circulation.

Posted by Jonathan Seaman (Member # 6150) on 02-16-2017, 11:28 AM:

Thanks for your replies guys they have been very useful to read.

I think my business partner and I will offer the Encrypted DCP and KDM service but be very specific about our hours of operation with regard to support. We will be looking into an emergency auto generation system or something along those lines as well to see if it is viable.

With regard to the obtaining of the certs, I think we are likely to go down the route that if a KDM is required then we will ask for exhibitor details when taking the job on so that we can contact the cinemas directly to be able to obtain their certs direct from manufacturer

Many Thanks
J

Posted by Lars Goldschlager (Member # 8716) on 02-16-2017, 02:06 PM:

Two pieces of advice from someone in the third world who deals with encrypted DCPs and unkownleable people,

1) Be ready to be called at night, 15 minutes before a very important show they forgot to warn you about because "They forgot the DCP was encrypted" to quickly make a key, whatever the stipulations for working hours you add.

2) Don't try to make (and convince the client that it's useless to make) "perfect fit" showing windows. Exhibitions sometimes start late, or get derailed, and projectionists or producers sometimes need or want to test the DCP before the exhibition. Making the KDM open the DCP 10 minutes before the show, and close on the exact same moment the showing ends can lead to disaster. At the least work in 24 hour increments (full days) and it's normally good to have a one or better two day window before the showing for testing purposes.

Posted by Paul H. Rayton (Member # 1817) on 02-16-2017, 02:23 PM:

I'll expand on Lars' message, which came in while I was writing essentially similar advice. Specifically:

If I may humbly offer a slightly contrarian direction ... I'd like to suggest that you, in your business, strongly suggest to your clients that they NOT bother with encryption at all. Firstly, encrypting shows doesn't really save any money, because in these days of the internet, any significant "unlicensed" shows are fairly simple to track down. Secondly, having to deal with KDMs becomes a lifelong job (at least as long as the show is in any circulation). While you plan to proactively ask your clients to obtain the necessary certs for you before you really get started in the full details of rendering their DCP, that's easier said than done. What about the second-run cinemas, who they never thought about as potential location(s) for a screening? What about that obscure film festival in some distant land that suddenly wants to program the show, and no one knows how to contact the organizers to get the appropriate tech information in a hurry? And finally, it just results in so much extra hassle for you, esp. since you don't plan to be a 24-hour source of such info.

Having been involved with numerous film festivals involving DCPs, I think there is almost nothing in exhibition these days that is more vexing and more troublesome than the issue of incorrect KDMs. There seem to be dozens of ways they can go wrong: 1) Time zone differences between the mastering location and the exhibition location. 1a) Daylight (Summer) time clock changes. 2) Clock of playback server drifting a few minutes, just enough so that -- oops! -- the show now becomes "illegal" and won't start. 3) Extremely minor changes (such as a change in a subtitle word spelling) that result in a new "version", but the KDM makers are unaware of it in time, so the show won't play because the version CPL(s) don't match. 4) Festival installs different (better) equipment than is normally on duty in the venue, so all existing venue certificate information is useless. 5) 3D vs. 2D version(s). 6) Various audio configurations.

The list could go on and on. There have been some very high profile shows that failed to play due to issues with "keys", and I know of at least one that then had to be played via a Blu-ray, as an emergency backup mode. All because of troubles with KDMs. At our venues in L.A., I can't even begin to count the number of times we've had frantic, last-minute experiences with incorrect KDMs (and attempting to obtain new ones) due to errors of one sort or another. In particular, certain distributors who are not 24-hour operations cause huge difficulties. More than once we've woken people up in the middle of the night (possibly accidentally, but that phone number was provided to us by someone!), an unintended consequence of such KDM follies.

So, you'll be doing yourself and your clients a favor if you strongly recommend that they not bother with encrypted modes for 99% of your content. Unless they're doing the newest "Star Wars" show, or something that truly needs restricting such as documentation of new patent mechanisms or medical processes, etc., it's a pointless exercise.

That's my takeaway after years at the receiving end of dealing with these issues. Just make 'em unencrypted [open] DCPs, and be done with it! Projectionists around the world will be thanking you for years!

Posted by Frank Cox (Member # 6258) on 02-16-2017, 03:46 PM:

My GDC server has been running 40 minutes fast for a few years. A key that's programmed to open at 1pm will allow me to start playing it at 1:40pm.

Though I've asked the techs to have this fixed a few times, nobody seems to see this as being much of a problem so I suppose it will continue this way "forever". But know that you can't count on anything close to accurate when it comes to cinema server times.

Posted by Stephan Shelley (Member # 8587) on 02-16-2017, 04:29 PM:

Frank, call GDC tech support and have a way for them to remote into the server online. Teanviewer works. They can login and correct the time.

Posted by Jonathan Seaman (Member # 6150) on 02-16-2017, 04:58 PM:

Thanks for your advise guys.

I know of the frustrations you are talking about as I am the chief projectionist/technician for a cinema here in the UK. We know of the problems and frustrations KDMs and encrypted DCPs can cause. We have faced problems where a distributor had out dated information about our projection equipment so had generated KDMs that did not match our current Sony 4Ks. We have also had to wait to get emergency keys generated for us due to distributors not sending out the requests for new KDMs.

We plan on taking all of my experiences as working in a cinema and use it to our advantage to enable us to provide a better service to our customers as we will very clear and detailed knowledge from within the industry itself.

We are going to offer it as a service but not actively encourage customers/clients to get their DCPs encrypted. We are looking down this route though to ensure we are able to offer this service for customers should they wish to purchase it.

Posted by Leslie Hartmier (Member # 7053) on 02-21-2017, 09:47 PM:

Hmm... well, if your content server is running 40 minutes fast, that would mean that you do not use NTP to control the time.

If it was an hour, than it could be a time zone issue, but 40 minutes could also mean you're actually in the wrong timezone and not using NTP (meaning you're possibly only 20 minutes out)

Nevertheless, you can:
1) have GDC log in to fix it,
2) you can activate the NTP, or,
3) if your content server is at 7.83 firmware, you can arrange (or if you have the skills, do it yourself) to update the server to 8.00 build 256, (as long as your IMB is not one of the ones with the faulty ADSP), as going from 7.83 to 8.xx allows you to set the time ONCE to just about anything - I assume you're already on 8.x, for DCI compliance though, so that might not be an option.

Me, I'd use the NTP thing, since you can just set it and forget it, but you might have your own preference.

Leslie

Posted by Frank Cox (Member # 6258) on 02-21-2017, 09:50 PM:

My projector and server are not on the Internet; they are networked to nothing other than themselves.

Posted by Steve Guttag (Member # 268) on 02-22-2017, 06:34 AM:

Do you have a computer that is on the internet? Is it also on the same network as the server (or can you add a NIC to put it on the same network)? If so, you can set a local computer to act as an NTP source.

Posted by Leslie Hartmier (Member # 7053) on 02-22-2017, 11:03 AM:

GDC supplies a document on how to use a Windows machine as an NTP server. We use the manager's computer as an NTP server at one of our locations.

Leslie

Posted by Frank Cox (Member # 6258) on 02-22-2017, 03:15 PM:

My projector and cinema server have never been connected to the Internet-at-large. There is a router in the base of the unit that connects the server and the projector together, and that's it.

Nobody has ever suggested putting it on the Internet prior to right now, but I've actually always thought that keeping it isolated was a reasonably good idea anyway since the server runs on Fedora Core 5 which has been EOL with no security updates from Red Hat for the past ten years. I don't think there ever was an actual decision made about putting it on the Internet -- it was just hooked up this way when it was first installed and never changed since.

I have an Internet service in the theatre and could get a network connection to it without too much difficulty by purchasing a 40-foot or so ethernet cable. There is apparently a second unused network card in the GDC server since it complains about that every time that it boots up. As far as I know the cinema stuff is networked as 192.168.1.XXX. My theatre network that I use for everything else (including the Internet) is set up as 192.168.0.XXX.

Posted by Scott Norwood (Member # 30) on 02-22-2017, 03:23 PM:

They aren't cheap, but NTP appliances do exist that use GPS as a time source. That would be an option for you if you want to keep your cinema server on its own isolated network and still have accurate time on the server and projector.

Posted by Harold Hallikainen (Member # 5405) on 02-22-2017, 10:28 PM:

The $429 GPS-based NTP server at http://broadcasttools.com/product/ntp-server-sentinel/ looks pretty good. However, I do not believe DCI compliant systems are allowed to use NTP to adjust the secure clock since anyone could generate a fake NTP to get access to content outside the licensed time window.

Harold

Posted by Steve Guttag (Member # 268) on 02-23-2017, 06:26 AM:

Even faked...the most they could move the secure clock is 6 minutes a year. It'd take 10 years to shift a secure clock 1 time zone.

So there should be no reason to not have the secure clock referenced to NTP.

Posted by Scott Norwood (Member # 30) on 02-23-2017, 09:00 AM:

GDC does not (or at least did not, as of a year or two ago) obey the +/- 6-minute rule with respect to an NTP source. Unless Frank's server has a more recent software release, an NTP appliance like the one referenced above should work fine.

Posted by Carsten Kurz (Member # 5396) on 02-23-2017, 09:34 AM:

All server manufacturers had software versions that did not obey DCI time setting restrictions for a while. They need to obey now. If GDCs running current software allow to shift more than +/-6min per year by connecting to faked NTP sources, they are not DCI compliant.

In general, secure clock deviations are not critical, but, I would always make an entry in my calender to check and correct for a deviation around the end of december to keep it as close as possible to e.g. your cell-phone clock. At one day you may want to play a midnight preview or the like and then your out of luck.

If at all, I would prefer to have a secure clock running ahead of actual time. The run-out-time of KDMs are usually not that critical, as the studios usually give you more time there than at the start. Plus, all servers will continue to play a started show up to 6hrs after the allowed time window.

- Carsten