> What do you mean by "CD-Key or the like" (I presume that "of" was a
> typo)? And what do you mean by "unbreakable"?
Unbreakable would mean here that no one, even previously authorised entity,
could use the system without paying the periodic subscription fee.
> You need to be far more explicit about the problem which you wish to
> solve, and about the constraints involved.
It could be an online system that work 95% offline but poll frequently an
offsite server.  No mass production CDs, maybe mass personalised d/l like Sun
Nothing is fixed yet, we are looking at the way a software can be protected
Is the use of "trusted hardware" really worth it ?  Does it really make it
Coder for OBB : Obdurately Buteonine Bellwether

from localhost (jalapeno [127.0.0.1])
	by jmason.org (Postfix) with ESMTP id BC18716F21
	for <jm@localhost>; Wed,  4 Sep 2002 18:58:47 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Wed, 04 Sep 2002 18:58:47 +0100 (IST)
from outgoing.securityfocus.com (outgoing2.securityfocus.com
    [66.38.151.26]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id
    g84HEjZ12085 for <jm@jmason.org>; Wed, 4 Sep 2002 18:14:46 +0100
from lists.securityfocus.com (lists.securityfocus.com
    [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id
    5AE888F334; Wed,  4 Sep 2002 10:00:16 -0600 (MDT)
(qmail 11511 invoked from network); 4 Sep 2002 00:48:18 -0000
From ygingras@ygingras.net  Wed Sep  4 18:58:57 2002

> > Is the use of "trusted hardware" really worth it ?
>
> Answering that requires fairly complete knowledge of the business
> model. But, in all probability: no, it isn't usually worth it. So, it
> comes down to how difficult you want to make the cracker's job.
>
> > Look at the DVDs.
>
> IIRC, CSS was cracked by reverse-engineering a software player; and
> one where the developers forgot to encrypt the decryption key at that.
This make me wonder about the relative protection of smart cards.  They have
an internal procession unit around 4MHz.  Can we consider them as trusted
hardware ?  The ability to ship smart cards periodicaly uppon cashing of a
monthly subscription fee would not raise too much the cost of "renting" the
system.  Smart card do their own self encryption.  Can they be used to
decrypt data needed by the system ?  The input of the system could me mangled
and the would keep a reference of how long it was in service.
This sounds really feasible but I may be totaly wrong.  I may also be wrong
about the safety of a smart card.
What do you think ?
--
Yannick Gingras
Coder for OBB : Oceangoing Bared Bonanza
http://OpenBeatBox.org