LABERTHREAD zum Thema: Umstellung der SAT-Verschlüsselung bei Sky (Geschlossen)

CA Key Ladder

1. Each compliant chipset shall have a unique pair: a. A unique 64-bit CPU readable identification number (Public-ID). b. A unique secret 128-bit key (SCK).

2. Each compliant chipset shall have a mechanism for securely deriving an operator-specific 16-byte K3 to serve as the root key of the key ladder. See clause Root Key Derivations below for further details. The format and values for the Public ID as well as for the SCK will be dictated by a Trusted Authority. The establishment of this administrative function is beyond the scope of the present document.

3. Each compliant chipset shall use the following sequence for decrypting video content:
a. It shall receive the Vendor ID value and use this to derive a root key K3 from the SCK.
b. It shall receive Ek3(K2), decrypt this value using K3 resulting in K2 (128 bits).
c. It shall receive Ek2(K1), decrypt this value using K2 resulting in K1 (128 bits).
d. It shall receive EK1(CW), decrypt this value using K1 resulting in CW (64 bits for DVB CSA2; 128 bits for AES).

4. The compliant chipset shall be configurable as to whether or not the software may use clear control words. If clear control words are allowed, the compliant chipset shall allow the software to switch back and forth freely, without reset between clear control words and control words from the key ladder. If the compliant chipset supports descrambling of multiple streams simultaneously, then it shall be possible to use clear and encrypted control words simultaneously. Forbidding the use of clear control words will be configurable, one-time, in the form of on-chip OTP both by the chipset vendor as well as software programmable at the time of device (e.g. STB) manufacturing.