Cinavia DRM: How I Learned to Stop Worrying and Love Blu-ray’s Self-Destruction

We briefly discussed watermarking schemes in the previous section. Cinavia, from Verance, is an audio watermarking scheme which has ended up inconveniencing a number of consumers. In particular, owners of the PS3 have been vocal enough to warrant the appearance of sites dedicated to bypassing the Cinavia triggers on the PS3. What exactly is the Cinavia watermark? How is it embedded in a soundtrack? When does a consumer encounter the watermark? What is the result when the encounter happens? These are some of the questions we will try to answer in this section.

Verance's DVD-A Watermark

Verance is no newcomer to the audio watermarking market. DVD-Audio adopted their technology in the late 90s. Audio watermarks can be robust or fragile, and Verance's DVD-A watermarking scheme as well as Cinavia belong to the former category. Robust watermarks can't be destroyed by digital-to-analog conversion, re-encoding or addition of small amounts of noise to the track.

In fact, Verance was one of the companies involved in the infamous Felten-SDMI Challenge case, where Prof. Edward Felten was threatened with legal action if he wanted to discuss how Verance's DVD-A watermark scheme (along with a host of other audio protection schemes) was deciphered and overcome. Readers interested in the full technical details of Felten's attack in the SDMI challenge can peruse this paper [PDF] presented at the 10th USENIX Security Symposium. In short, Verance's watermarking scheme involved frequency domain modifications, hiding multiple time-varying echoes. Note that the human ear is not sensitive to echoes involving speech and music where the delay is less than 50 ms. In fact, only echoes with a time difference of 100 ms or more become annoying. Verance's scheme involved echoes with delays varying between 0.5 ms and 1.75 ms, rendering them indecipherable to the human ear. By placing these echoes regularly in an audio track, it is possible to detect the watermark in any clipped segment.

Cinavia

In the DVD-A watermark discussed in the previous subsection, Verance could have different echo patterns to indicate different watermarks. Though we don't have the exact details, it is widely believed that Cinavia could be something similar. The fundamental requirement for Cinavia is the presence of a watermark detector in the playback device, i.e, when a Cinavia-infected audio track is being processed, the system must be able to identify the presence of the watermark pattern.

There are at least four different Cinavia watermarks to identify the following situations:

1. Professional content (say, copies of movies made in a theater) being played on an unlicensed device (say, a Blu-ray player at home)
2. Professional content being copied using an unlicensed device
3. Content being played back on an unlicensed device
4. Content being copied from an unlicensed device

Scenarios (2) and (4) result in copying being stopped. They are comparatively rare (not many users use devices with the watermark detector to copy content). However, scenarios (1) and (3) are more common. Currently, Cinavia audio watermarks are embedded in the audio track(s) of some Blu-ray movies and a number of theatrical releases. The type of watermark in each of these cases is different. While the watermark in the first case may lead to Scenario (1), the second case may lead to Scenario (3).

We set out to observe Cinavia in action. Our first two test cases involved Blu-ray backups of the movies 'The Losers' and 'Battlefield LA' with re-encoded audio and video tracks. The files were played back on a PS3. The third scenario was triggered in both cases. In the former case, the triggering was within a minute, but took more than 20 minutes in the latter case.

The current PS3 firmware has the Cinavia watermark detection routines. When the audio track of a file being played back has the Cinavia watermark for Scenario (3), the PS3 usually waits for 20 odd minutes before muting the audio. This scenario is also triggered when lossless backups of Blu-rays are played back. For example, some Blu-ray players have the ability to play back unprotected ISOs (created with AnyDVD HD or DVDFab) or MKVs (created with MakeMKV) which don't even have re-encoded audio / video tracks. These are the most common form of backups used by legitimate Blu-ray consumers. I will touch upon the need for such backups in a later section, but suffice to say that any discs with Cinavia backed up in such a manner (i.e, with the AACS protection removed) will trigger the muting of the audio on Cinavia-enabled Blu-ray players.

Our third test case involved a 5 minute sample clip from a CAM print of the movie 'The Wolfman'. For those not familiar with scene releases, the Wikipedia article explains about the scene and the various qualities in which scene releases are available. A CAM print is made using a camcorder in a theater. The audio can be either recorded using a microphone or explicit line input. In the latter case, the audio track doesn't have a lot of noise. However, our sample clip had very noisy audio, and in all probability, the audio was recorded using a microphone. Within a few seconds of starting playback of the file on a PS3, Scenario (1) was triggered. Playback automatically stopped with the appropriate error message.

Cinavia and Blu-ray Players

One of the common aspects in the above three videos is the fact that both of them involved the use of a PS3 as the media player. Currently, Cinavia watermark detection is mandated only in the AACS licensing agreement. This means that only players which are licensed by the AACS are required to have this detection routine. An update to the AACS licensing agreement indicated that all players sent to the BDA (Blu-ray Disc Association) for licensing after February 1st, 2012 should have the Cinavia detection routine embedded in the firmware. There is no legal licensing requirement for previously certified players to include Cinavia in firmware updates, but, if the manufacturer wishes to do so, there is nothing to prevent them from doing so.

Note that the licensing requirement doesn't state that all players sold after February 1st, 2012 need to be Cinavia-enabled; it is only those sent for certification after that date. This means that a number of Blu-ray players (older models) will continue to be sold in the market without Cinavia for some months to come. The BDA certification process involves putting each applicant through a rigorous test suite to ensure that all Blu-ray features are properly supported. Since Cinavia is a recently introduced licensing requirement, it is not clear when the Cinavia tests will become part of the BDA certification test suite. We spoke to some industry insiders who stated (on the conditions of anonymity) that it will be at least another 8 - 12 months before the BDA certification test suite starts testing for Cinavia compliance. They also indicated that they fully expect players to be certified in the meanwhile without Cinavia in the firmware.

Cinavia is particularly worrisome for DMAs (Digital Media Adapters) that have also licensed Blu-ray capabilities. Examples of such units include the Popcorn Hour C300 from Syabas, the Dune Smart series from HDI, and players such as the Kaiboer K860i / Asus O!Play BDS-700. Fortunately, all of these units have already obtained BDA certification. However, it will be interesting to see how they tackle the Cinavia issue in the next generation units. DMAs are quite popular because of their ability to play networked media of all types (be it Blu-ray backups in ISO / MKV format or downloaded content). Cinavia throws a spanner in the works for such units. As we demonstrated earlier in this section, audio either gets muted or playback stops completely, depending on the media source.

In the next section, we will present some comments (in the hope that people in the AACS LA and BDA are paying attention), and leave it to them / readers to decide whether Cinavia really helps as an effective DRM measure.