58

Is there some open-sourced, well-documented and used DRM framework/library?

I want to write some framework for buying and selling digital stuff, where I want to implement, somehow, for the seller to have the possibility to lock the files with some sort of DRM, where only authorised computers would be able to open it (something like iTunes FairPlay).

It can, and probably has to, involve contacting my server with some login credentials.

On the other hand, I want the client to be open-sourced, and probably the server too .. is that even possible? Security through obscurity does not work, but DRM is not exactly "security"...

All I was able to find is this discussion on slashdot with the exact same problem, but it ended with "DRM IS BAD", and Sun's DReaM project, but I have no clue how to get to the actual code/usage of the framework on their site.

If you think Open Sourced DRM is not possible, tell me so.

Jim Puls
  • 79,175
  • 10
  • 73
  • 78
Karel Bílek
  • 36,467
  • 31
  • 94
  • 149
  • 24
    As a side note, iTunes has discontinued their DRM. My $0.02 - DRM doesn't work. I will never purchase anything with DRM ever again. I am unable to play thousands of songs I purchased legally with my own money because of DRM and computer upgrades. On the other hand, I can play thousands of others that I downloaded illegally just fine. I will gladly pay for good music, but I would rather hang than have to deal with DRM in anything ever again. – Chris Lutz May 04 '09 at 22:55
  • 9
    not really - their video renting/buying service on iTunes is full of DRM. – Karel Bílek May 04 '09 at 22:56
  • @Karel - really? I lost the password to my iTunes store account (which accounts for me losing all my music) and haven't bothered trying to buy anything for years, so I wouldn't know about their video. Still, I wouldn't buy any videos from them anyway. I can rent a DVD from a local video store for just as cheap (or cheaper). – Chris Lutz May 04 '09 at 22:58
  • 1
    I know it's off topic a little, but don't they have "password reminder" or something like that? – Karel Bílek May 04 '09 at 23:01
  • 1
    @Karel again - I tried it. It asks me for my favorite drink ever (that was my security question). I've tried every variation of "Dr. Pepper" that I can think of. No dice. – Chris Lutz May 06 '09 at 04:40
  • @ChrisLutz Your own fault. But, no, of course not, it's the DRM. Really logical. – jobukkit Feb 17 '14 at 19:54

6 Answers6

27

This claims to be an open source implementation of OMA DRM2. I assume it contains the software components needed to build the server and client, leaving the hardware as an exercise for the reader:

http://sourceforge.net/projects/openipmp

License is MPL, which is a non-GPL-compatible FOSS license.

I have no experience of this implementation, but a little of OMA DRM, and it seemed at the time to be a workable DRM scheme, as much as any DRM scheme is workable. The OMA DRM standard is well-documented, and is (or at least has been) widely-used by the mobile phone industry.

The fundamental problem with open-source DRM is that although all of the algorithms and source code can be published without harming the scheme, client devices have to be "trusted" by the rights issuer to respect the rights, i.e. not do anything forbidden. This is incompatible with FOSS, which says that the user of a device should have full control over what it does.

Security through obscurity does not work, but DRM is not exactly "security"

Security through obscurity of algorithms is usually weak. Security through secrecy of information is the only way to do crypto, signing, etc. DRM does not require obscurity of algorithms (which is why OMA DRM is a published standard, and how come the source for an implementation can be published and freely usable), but it does require that the player device have access to information (some kind of key) which the user of the device does not, and which is not part of the algorithm/source.

Normally, security protects the owner/user of a device from a threat model of external attackers. In the DRM threat model, the owner/user of the device is the attacker, and the rights owner is being defended. If the device's user has full control over it, then clearly in principle this is game over.

In practice it may not be quite that immediate, but in the open source case, allowing people to write their own DRM clients which prevent them from copying your rights-protected data would be asking them to be astonishingly honest.

Users can sometimes be persuaded to be law-abiding, in which case DRM takes on the role of reminding them that if they're jumping through hoops to work around the restrictions, then they may be breaking the law.

Steve Jessop
  • 273,490
  • 39
  • 460
  • 699
  • 1
    openipmp was last updated 2006 - wondering if it actually runs on Android and if somebody has actually already implemented it successfully on it. – Mathias Conradt Oct 28 '10 at 01:32
  • for someone who is looking to get a working solution up and running quickly, with leveraging open source libraries as much as possible but at the same time reduce the time to production, please take a look at this - http://aameer.github.io/articles/digital-rights-management-multi-drm/ – Aameer Nov 16 '17 at 14:38
24

Open-source DRM is virtually impossible.

The point of DRM is to prevent a user from decrypting some data, while at the same time allowing them to do so under some circumstances. The theoretical framework of encryption makes this absurd - how can the user only have the key to decrypt some data if they're using it for approved purposes?

The solution adopted by existing DRM systems is to go to ridiculous lengths to hide the key - a perfect example of security by obscurity - but if the source code is available it is trivial to simply modify the code to hand the key to the user. At this point it doesn't matter how good your encryption is, the user has everything they need to break it.

One solution to all this is using the Trusted Platform Module on some machines to verify the binary image of all software that might be able to access the key, and ensure the key itself is inaccessible (encrypted by a key derived by a secret burned-into-hardware value). However I'm not sure how common TPMs are, and moreover this is very much defeating the point of open-sourcing the software in the first place, as you would be unable to modify it in any way without losing access to the DRM keys.

Finally, on a more practical note, DRM seems to be on its way out anyway - eg, iTunes has gotten rid of DRM entirely, and the movie industry seems to be moving in that direction as well...

bdonlan
  • 224,562
  • 31
  • 268
  • 324
  • 1
    "if the source code is available it is trivial to simply modify the code to hand the key to the user" -- assuming you can load code on the device, which is why DRM tends to work better on mobile phones than on PCs, and why GPL3 includes that anti-tivo clause. – Steve Jessop May 05 '09 at 00:47
  • Yes, the TPM would serve to prevent loading code in the PC case. However if one can't load any code at all, then making DRM is fairly trivial, since you don't have to hide the key very well. – bdonlan May 05 '09 at 00:55
  • "if one can't load any code at all, then making DRM is fairly trivial". In practice, the approach on e.g. Symbian is that the user can load code, but such code is prevented by the kernel from accessing the DRM APIs. So it's not that you "can't load code at all", just that you can't load DRM-related code at all. Whether this is "trivial" probably depends whether you're the one who has to implement the Symbian kernel. – Steve Jessop May 05 '09 at 01:03
  • Oh, and the key is hidden by process boundaries. So a little bit like a TPM in some ways, but different approach in others. – Steve Jessop May 05 '09 at 01:04
  • @Steve: The Symbian DRM approach (as you described it) boils down to "you can write and run FOSS, just not to work with content under DRM". Effectively, that still means that DRM is a no fly zone for FOSS: you can only use proprietary software (probably owned by the copyright owner or an intermediary) to get at the content. It's a powerful hint about DRM in general that when you start from a rather pure philosophical position, one that puts freedom in first place (as is the case with FOSS), the fundamental, unavoidable conclusion is "no DRM". – Tomislav Nakic-Alfirevic Mar 25 '13 at 12:35
  • 5
    2009 years ago - "the movie industry seems to be moving in that direction as well". 2015 - movie industry pushed proprietary DRM modules, DRM is firmly on youtube/netflix/..., it's pre-installed on Chrome and probably Firefox and all the modern mobile devices, etc etc. Things never change. – Karel Bílek May 26 '15 at 21:21
12

For an open-source DRM solution there will likely be an open-source crack.

Many of DRM solutions actually work based on the "security-by-obscurity" principle. Meaning some of them not broken yet because their models are kept secret. Even that does not prevent major DRM system from getting broken.

User
  • 30,403
  • 22
  • 79
  • 107
  • 3
    Agreed. Proprietary DRM is broken very, very quickly. I wouldn't be optimistic about the strength of an open source solution. Of course, DRM is significantly flawed to begin with. It doesn't matter if your DRM is good enough to stop 99.999% of users from making a copy or using a program. One person figures out how to break it and your DRM is worthless. The file is shared, the program has a crack available, etc. You really need a hardware solution to 'succeed' and even then it's not a sure thing. – Steven Richards May 04 '09 at 23:02
  • well ... I thought, there are really strong and virtually un-breakable crypting algorithms, both symetrical and asymetrical ... so, there can be some DRM system, that works (maybe built in a way I haven't thought about) and is unbreakable by nature. But, probably not – Karel Bílek May 04 '09 at 23:07
  • 1
    Well, the thing is... your player will need the original content to be able to play it. So at some stage of the game the file gets decrypted. Then writing the crack would actually mean updating the algorithm to decrypt the content offine rather than in live streaming mode. – User May 04 '09 at 23:12
  • This is just the thought... The Generic full proof DRM as it stands may not be possible... But, it is possible to device a scheme in which the content is created on one side with embedded program which itself keeps changing the encryption of the the content before reproducing it on dimension of time... The player or viewer of this content can only run this algorithm which is inside the content itself... – Atul Dravid - White Pvt. Ltd. Aug 13 '14 at 07:25
6

I am generally anti-DRM. However, I have seen one implementation of DRM that I could support, and it used the user's credit card info as the decryption key. While not foolproof, it at least has the advantage of using information the user WANTS to keep private. (At least in theory.) It was still portable between my own devices. However, with such a visible key, plus a open source reader, the possibility exists that a user could store and copy the decrypted data, rendering the DRM moot.

Brianorca
  • 216
  • 2
  • 3
6

DRM is broken because it relies on "security-by-obscurity" principle.

There are other solutions like watermarking.
When you sell something to a client, you watermark it with the name of the client. If you find this watermarking on sharing network, you will know where is the leak. If the client knowns there is watermarking (I think it is more honest to warn him), he will probably not share.

webreac
  • 1
  • 1
  • 1
  • 3
    "he will probably not share" - or will remove the watermark before doing so. What's necessary is not to recover the original file, but to damage the watermark to the point where it's no longer distinguishable from any other watermark placed by the same scheme. – Steve Jessop Feb 28 '11 at 10:44
0

Its worth to mention it depends on what content you want to protect. If you want to protect content that you yourself own, and the damages if content leaks is not devastating, then you could for example look in the previously mentioned Open IPMP. Suns DReaM project is still availible online, it is however worth to notice that the project is closed due to inactivity. A problem arises when you want to protect content that you dont own. It is very possible that the content owners will not allow their content to be protected by an open source drm solution. Content owners tend to go with proprietary solutions like Microsoft WMDRM/PlayReady, Marlin or Helix. So if your framework will be used to sell for example Hollywood content, I would not recommend putting time in an open source drm solution.

Tomas Vinter
  • 2,690
  • 8
  • 36
  • 45