bryan feir mailto bryan sgl crestech ca wrote of course once one player key was broken dealing with the rest became a known plaintext attack and the rest of the player keys went down like a row of dominos the actual follow up to the xing player break was more interesting than that the mere knowledge of known plaintext a corresponding input and output does not necessarily make it trivial to break a properly designed systems and or algorithm the primary reason it was easy for css is because the css key was only NUMBER bits and thereby easy to break with exhaustive search attacks it was only NUMBER bits speculated because of a misunderstanding of the government cryptography export rules at the time even more interesting to me at least was that soon after the xing player break people started studying the css algorithm itself they rapidly found serious design flaws which left the NUMBER bit css algorithm with an actual strength of around NUMBER bits from memory and new attacks might have further reduced the strength this is another great example showing why proprietary cryptography algorithms should be viewed with the greatest of suspicion on tue sep NUMBER NUMBER at NUMBER NUMBER NUMBERpm NUMBER yannick gingras wrote this make me wonder about the relative protection of smart cards they have an internal procession unit around NUMBERmhz can we consider them as trusted hardware yes and no you can put a limited amount of trust in a smart card there have been any number of very clever attacks against smartcards ross anderson in the uk has documented quite a few of these and smartcard manufactures are usually one step behind these attacks a well designed system assumes that a system smartcard will be completely compromised at some point giving an adversary all of the secrets contained in the smartcard the cryptography industry has developed a variety of techniques that can reduce the impact of a compromise including unique keys per smartcard and forward security techniques luciano rocha strange nsk yi org wrote the problem is that that piece of hardware is trustworthy but the rest of the pc isn t so a cracker just needs to simulate the lock smart card or peek at the executable after the lock has been deactivated going back to the original question once the encrypted material goes outside the trusted hardware it is impossible to unbreakably protect it there may be some mitigation steps you can take such as the sdmi watermarking but most schemes to date have been easily broken another consideration is the value of what you are trying to protect while there is no such thing as unbreakable adding more cost both in terms of price and hassle factor can greatly improve the protection since you are talking about the use of standard pc workstations i presume what you are trying to protect is not that valuable i m afraid most security measures don t come for free michael mckay director of software development mmckay URL information security systems services inc NUMBER stevens creek blvd cupertino ca NUMBER phone NUMBER NUMBER NUMBER x NUMBER fax NUMBER NUMBER NUMBER URL 