8 May
2014
8 May
'14
9:48 p.m.
http://www.dcinematoday.com/dc/PR.aspx?newsID=3627
'Qube Cinema to Introduce Cloud-Based KDM Service at NAB
KeySmith.biz Offers Invitation-only Access to Easy Key Management Service for Independent
Filmmakers & Postproduction Facilities'
The interesting part here is that through this service, the user has access to a worldwide
cinema server certificate database to create KDMs. Doing this in DCP-o-matic needs a
specific certificate to be present/provided by the cinema beforehand. For most
cinemas/operators, dealing with their certificate(s) directly is not part of their daily
business.
- Carsten
8 May
8 May
10:04 p.m.
Doremi has started supporting TKR, in theory.
It's certainly not an urgent feature, but support for TKR in dcpomatic
will be interesting, either with this Qube service or any other
similar ones that will certainly appear. Doing an opensource TKR
server is trivial, generating the KDMs is not so easy, but can be
done.
ALAIK the certs are easily accesible for all brands being given the
serial number, at least with Doremi is.
Manuel AC
On Thu, May 8, 2014 at 5:48 PM, Carsten Kurz <audiovisual(a)t-online.de> wrote:
http://www.dcinematoday.com/dc/PR.aspx?newsID=3627
'Qube Cinema to Introduce Cloud-Based KDM Service at NAB
KeySmith.biz Offers Invitation-only Access to Easy Key Management Service for Independent
Filmmakers & Postproduction Facilities'
The interesting part here is that through this service, the user has access to a
worldwide cinema server certificate database to create KDMs. Doing this in DCP-o-matic
needs a specific certificate to be present/provided by the cinema beforehand. For most
cinemas/operators, dealing with their certificate(s) directly is not part of their daily
business.
- Carsten
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
9 May
9 May
2:06 a.m.
Am 09.05.2014 um 00:04 schrieb Manuel AC:
ALAIK the certs are easily accesible for all brands
being given the
serial number, at least with Doremi is.
That is true for Doremi, but not the others. Sony has an easy way to extract the
certificate from the machine, and Christie's IMS just as well.
There's a bit of a problem with TKR on an free/open source program because a URL has
to be specified in the CPL for the KDMs) to be looked up. Makes no sense without a working
TKR server (solution) being available for free.
- Carsten
2:28 a.m.
On Thu, May 8, 2014 at 10:06 PM, Carsten Kurz <audiovisual(a)t-online.de> wrote:
There's a bit of a problem with TKR on an
free/open source program because a URL has to be specified in the CPL for the KDMs) to be
looked up. Makes no sense without a working TKR server (solution) being available for
free.
I meant that creating that server will be easy, receiving the uuid as
part of the url, and the serial in Post, if I remember correctly.
Something like yourwebsite.com/tkr/UUID Any independent
lab/distributor could host it in its own website.
The interface for controlling that, or even creating the KDMs, that's
another history, but I'm only talking about answering the tkr
requests.
Manuel AC
16 May
16 May
12:15 p.m.
Hi all,
This is interesting. It would be good to run an open database of
cinema certificates so that indies etc. can generate keys (or we can
generate keys for them). I guess the hard part is keeping the database
updated...
Carl
On Thu, 8 May 2014 23:48:57 +0200
Carsten Kurz <audiovisual(a)t-online.de> wrote:
http://www.dcinematoday.com/dc/PR.aspx?newsID=3627
'Qube Cinema to Introduce Cloud-Based KDM Service at NAB
KeySmith.biz Offers Invitation-only Access to Easy Key Management
Service for Independent Filmmakers & Postproduction Facilities'
The interesting part here is that through this service, the user has
access to a worldwide cinema server certificate database to create
KDMs. Doing this in DCP-o-matic needs a specific certificate to be
present/provided by the cinema beforehand. For most
cinemas/operators, dealing with their certificate(s) directly is not
part of their daily business.
- Carsten
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
--
12:44 p.m.
Am 16.05.2014 um 14:15 schrieb Carl Hetherington:
Hi all,
This is interesting. It would be good to run an open database of
cinema certificates so that indies etc. can generate keys (or we can
generate keys for them). I guess the hard part is keeping the database
updated...
Yes. There are quite a few discussions now in various forums about creating encrypted DCPs
for dedicated screens/servers. On some servers, it is quite easy to download a certificate
and email it to anyone in need. On some systems, it is complicated. Not every cinema has
skilled stuff, most would probably not even know what a 'certificate' is and how
to obtain it. Some only know about equipment serial numbers.
In germany we have received more and more inquiries from new DCP and KDM issuing companies
during the last year.
It becomes obvious that a properly maintained certificate database is a trade secret and
an instrument to keep competition at distance, as all these companies are fighting for
business with the distributors while prices for DCP and KDM generation are decreasing.
A public database or automated system would change that completely. It is not clear,
however, how things like FLMx or TKR will evolve in short term. I have been to the
Motionpicturesolutions-Site recently and it seems they are also working on tools to change
booking and key retrieval. What they are trying to do is offering a content catalog where
cinemas can book content and retrieve keys automatically, upon confirmation through the
license holder. While that will probably mean some manual intervention by the studios
booking department in the beginning, it can easily be seen that at least for classic
titles this will become a fully automated video-rental-shop-type system rather sooner than
later. Other companies like Sony are working on similiar systems.
The best thing of course would be if every cinema/equipment operator would have a
certificate stored for easy access. You could even put it up on a website and simply mail
the link to any interested party.
But for now, the major issue is, if someone want's to issue an encrypted DCP, how does
he actually get the certificate for the equipment intended for screening.
Maybe this could also be something we could put up on the DCP-o-matic site as a help, like
the list of tested equipment.
E.G. the GUI of our Sony 515 allows to download the certificate to a connected computer
through the web interface. I know it's the same for Christies IMB and Doremis IMS.
Doremi has an online service and FTP site to retrieve certificates by serial number. I
know Dolby has an FTP site as well, but I think it is not open.
- Carsten
17 May
17 May
11:09 a.m.
Hi all,
This is quite interesting!
Founded at
http://www.reduser.net/forum/showthread.php?33118-Digital-Cinema-Package/pa…
You can obtain doremi certificates with an ftp access:
ftp://doremilabs.com/dcp2000/Certificates/
user: service,
pass: t3chn1c1an
sorted by serial numbers
and dolby:
ftp.dolby.co.uk
user: dolbyrootcertificates
pass: houro61l
sorted by countries/cities/cinemas
I asked the same thing to Christie but they only opened me a personal
access.
GDC does not give any access. They answered me you have to ask each
certificate one by one, by mail...
Charbon Studio in Belgium already has a huge data base with an online
generating tool:
https://www.charbon-studio.com/DCP_mastering_portal/kdm?login=demo
It contains some few errors for French servers.
For French certificates, the CNC
(https://www.cnc-arcene.fr/index;jsessionid=13AFF5A28606CA0CEE2293889BED8F6B…)
references almost all cinemas with their certificates. Their are some
errors (the same than charbon as they got them on this web site) and
certificates have a bad coding but this is a good way to get
certificates city by city. Some certificates are missing as they are
only referencing specific cinemas.
Lilian
Le 16/05/2014 14:44, Carsten Kurz a écrit :
Am 16.05.2014 um 14:15 schrieb Carl Hetherington:
Hi all,
This is interesting. It would be good to run an open database of
cinema certificates so that indies etc. can generate keys (or we can
generate keys for them). I guess the hard part is keeping the database
updated...
Yes. There are quite a few discussions now in various forums about creating encrypted
DCPs for dedicated screens/servers. On some servers, it is quite easy to download a
certificate and email it to anyone in need. On some systems, it is complicated. Not every
cinema has skilled stuff, most would probably not even know what a 'certificate'
is and how to obtain it. Some only know about equipment serial numbers.
In germany we have received more and more inquiries from new DCP and KDM issuing
companies during the last year.
It becomes obvious that a properly maintained certificate database is a trade secret and
an instrument to keep competition at distance, as all these companies are fighting for
business with the distributors while prices for DCP and KDM generation are decreasing.
A public database or automated system would change that completely. It is not clear,
however, how things like FLMx or TKR will evolve in short term. I have been to the
Motionpicturesolutions-Site recently and it seems they are also working on tools to change
booking and key retrieval. What they are trying to do is offering a content catalog where
cinemas can book content and retrieve keys automatically, upon confirmation through the
license holder. While that will probably mean some manual intervention by the studios
booking department in the beginning, it can easily be seen that at least for classic
titles this will become a fully automated video-rental-shop-type system rather sooner than
later. Other companies like Sony are working on similiar systems.
The best thing of course would be if every cinema/equipment operator would have a
certificate stored for easy access. You could even put it up on a website and simply mail
the link to any interested party.
But for now, the major issue is, if someone want's to issue an encrypted DCP, how
does he actually get the certificate for the equipment intended for screening.
Maybe this could also be something we could put up on the DCP-o-matic site as a help,
like the list of tested equipment.
E.G. the GUI of our Sony 515 allows to download the certificate to a connected computer
through the web interface. I know it's the same for Christies IMB and Doremis IMS.
Doremi has an online service and FTP site to retrieve certificates by serial number. I
know Dolby has an FTP site as well, but I think it is not open.
- Carsten
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
19 May
19 May
10:28 a.m.
On Sat, 17 May 2014, lilian lefranc wrote:
[snip certificate download sites]
Those are useful, I think... I've looked through the Dolby data
a bit and I'm not 100% convinced of its accuracy.
Charbon Studio in Belgium already has a huge data base
with an online
generating tool:
https://www.charbon-studio.com/DCP_mastering_portal/kdm?login=demo
It contains some few errors for French servers.
That looks nice. Still, it seems to be intended only for DCPs
that Charbon Studio have mastered. In an ideal world I think
there would be a database with completely unfettered access;
i.e. search for a cinema and get its certificate on a web page,
and also some API for programs such as DCP-o-matic to find
certificates.
For French certificates, the CNC
(https://www.cnc-arcene.fr/index;jsessionid=13AFF5A28606CA0CEE2293889BED8F6B…)
references almost all cinemas with their certificates. Their are some errors
(the same than charbon as they got them on this web site) and certificates
have a bad coding but this is a good way to get certificates city by city.
Some certificates are missing as they are only referencing specific cinemas.
Also interesting. Thanks for the links!
Best regards
Carl
Lilian
Le 16/05/2014 14:44, Carsten Kurz a écrit :
Am 16.05.2014 um 14:15 schrieb Carl Hetherington:
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
Hi all,
This is interesting. It would be good to run an open database of
cinema certificates so that indies etc. can generate keys (or we can
generate keys for them). I guess the hard part is keeping the database
updated...
Yes. There are quite a few discussions now in various forums about creating
encrypted DCPs for dedicated screens/servers. On some servers, it is quite
easy to download a certificate and email it to anyone in need. On some
systems, it is complicated. Not every cinema has skilled stuff, most would
probably not even know what a 'certificate' is and how to obtain it. Some
only know about equipment serial numbers.
In germany we have received more and more inquiries from new DCP and KDM
issuing companies during the last year.
It becomes obvious that a properly maintained certificate database is a
trade secret and an instrument to keep competition at distance, as all
these companies are fighting for business with the distributors while
prices for DCP and KDM generation are decreasing.
A public database or automated system would change that completely. It is
not clear, however, how things like FLMx or TKR will evolve in short term.
I have been to the Motionpicturesolutions-Site recently and it seems they
are also working on tools to change booking and key retrieval. What they
are trying to do is offering a content catalog where cinemas can book
content and retrieve keys automatically, upon confirmation through the
license holder. While that will probably mean some manual intervention by
the studios booking department in the beginning, it can easily be seen that
at least for classic titles this will become a fully automated
video-rental-shop-type system rather sooner than later. Other companies
like Sony are working on similiar systems.
The best thing of course would be if every cinema/equipment operator would
have a certificate stored for easy access. You could even put it up on a
website and simply mail the link to any interested party.
But for now, the major issue is, if someone want's to issue an encrypted
DCP, how does he actually get the certificate for the equipment intended
for screening.
Maybe this could also be something we could put up on the DCP-o-matic site
as a help, like the list of tested equipment.
E.G. the GUI of our Sony 515 allows to download the certificate to a
connected computer through the web interface. I know it's the same for
Christies IMB and Doremis IMS. Doremi has an online service and FTP site to
retrieve certificates by serial number. I know Dolby has an FTP site as
well, but I think it is not open.
- Carsten
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
1:28 p.m.
Not sure if it has been referred this proposition from 2012, that
looks kind of dead.
http://movielabs.com/tdl/
I have no real interest in KDMs, maybe when TKR is widely deployed I
will consider them a real option.
But, such a worldwide theater list will be nice to know other things
like preferred and accepted distribution methods (DX115, usb2, usb3,
esata, internet,... other experiments coming), sound installed to send
a 7.1 or any new fancy format when available, etc.
For this, I think a completely open and shared will be ideal and the
most up-to-date, but not sure it can happen in the near future. Major
laboratories monopoly, addiction to secrecy of distributors,
exhibitors not wanting to expose their real installations...
Good luck whoever want to try, it will happen, somehow at some point.
Manuel AC
On Mon, May 19, 2014 at 6:28 AM, Carl Hetherington <cth(a)carlh.net> wrote:
On Sat, 17 May 2014, lilian lefranc wrote:
[snip certificate download sites]
Those are useful, I think... I've looked through the Dolby data
a bit and I'm not 100% convinced of its accuracy.
Charbon Studio in Belgium already has a huge data
base with an online
generating tool:
https://www.charbon-studio.com/DCP_mastering_portal/kdm?login=demo
It contains some few errors for French servers.
That looks nice. Still, it seems to be intended only for DCPs
that Charbon Studio have mastered. In an ideal world I think
there would be a database with completely unfettered access;
i.e. search for a cinema and get its certificate on a web page,
and also some API for programs such as DCP-o-matic to find
certificates.
For French certificates, the CNC
(https://www.cnc-arcene.fr/index;jsessionid=13AFF5A28606CA0CEE2293889BED8F6B…)
references almost all cinemas with their certificates. Their are some errors
(the same than charbon as they got them on this web site) and certificates
have a bad coding but this is a good way to get certificates city by city.
Some certificates are missing as they are only referencing specific cinemas.
Also interesting. Thanks for the links!
Best regards
Carl
Lilian
Le 16/05/2014 14:44, Carsten Kurz a écrit :
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
Am 16.05.2014 um 14:15 schrieb Carl Hetherington:
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
Hi all,
This is interesting. It would be good to run an open database of
cinema certificates so that indies etc. can generate keys (or we can
generate keys for them). I guess the hard part is keeping the database
updated...
Yes. There are quite a few discussions now in various forums about
creating encrypted DCPs for dedicated screens/servers. On some servers, it
is quite easy to download a certificate and email it to anyone in need. On
some systems, it is complicated. Not every cinema has skilled stuff, most
would probably not even know what a 'certificate' is and how to obtain it.
Some only know about equipment serial numbers.
In germany we have received more and more inquiries from new DCP and KDM
issuing companies during the last year.
It becomes obvious that a properly maintained certificate database is a
trade secret and an instrument to keep competition at distance, as all these
companies are fighting for business with the distributors while prices for
DCP and KDM generation are decreasing.
A public database or automated system would change that completely. It is
not clear, however, how things like FLMx or TKR will evolve in short term. I
have been to the Motionpicturesolutions-Site recently and it seems they are
also working on tools to change booking and key retrieval. What they are
trying to do is offering a content catalog where cinemas can book content
and retrieve keys automatically, upon confirmation through the license
holder. While that will probably mean some manual intervention by the
studios booking department in the beginning, it can easily be seen that at
least for classic titles this will become a fully automated
video-rental-shop-type system rather sooner than later. Other companies like
Sony are working on similiar systems.
The best thing of course would be if every cinema/equipment operator
would have a certificate stored for easy access. You could even put it up on
a website and simply mail the link to any interested party.
But for now, the major issue is, if someone want's to issue an encrypted
DCP, how does he actually get the certificate for the equipment intended for
screening.
Maybe this could also be something we could put up on the DCP-o-matic
site as a help, like the list of tested equipment.
E.G. the GUI of our Sony 515 allows to download the certificate to a
connected computer through the web interface. I know it's the same for
Christies IMB and Doremis IMS. Doremi has an online service and FTP site to
retrieve certificates by serial number. I know Dolby has an FTP site as
well, but I think it is not open.
- Carsten
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
3:53 p.m.
Hi,
That TDL looks interesting, but it's more "authorized
subscribers" and "cost recovery" ...
Imagining an open database for a moment, I suppose theatre
operators would need an incentive to keep their entries up to
date. That incentive would exist if the database was popular as
they would want to ensure that they got the right KDMs and so
did not lose shows. There might be a catch 22 there.
There's nothing to be lost by exposing your certificates to the
world: it just means that anybody can make a KDM for their film
for you.
I imagine the major problem might be trust in tieing
certificates to particular cinemas and screens. If Alice said
"Here is the certificate for Screen 1 in `My Great Cinema' in York, England"
(and she was telling the truth) but then Mallory said "Here is
the certificate for Screen 1 in `My Great Cinema' in York,
England" (and he was lying): who do you believe? If you believe
Mallory, he could use that trust to obtain KDMs for his
equipment that were not due to him.
Plus there is the standard industry paranoia, I suppose,
although major studios are never going to use an open system and
the indies might be more trusting.
Did I miss any other potential problems?
Cheers
Carl
On Mon, 19 May 2014, Manuel AC wrote:
Not sure if it has been referred this proposition from
2012, that
looks kind of dead.
http://movielabs.com/tdl/
I have no real interest in KDMs, maybe when TKR is widely deployed I
will consider them a real option.
But, such a worldwide theater list will be nice to know other things
like preferred and accepted distribution methods (DX115, usb2, usb3,
esata, internet,... other experiments coming), sound installed to send
a 7.1 or any new fancy format when available, etc.
For this, I think a completely open and shared will be ideal and the
most up-to-date, but not sure it can happen in the near future. Major
laboratories monopoly, addiction to secrecy of distributors,
exhibitors not wanting to expose their real installations...
Good luck whoever want to try, it will happen, somehow at some point.
Manuel AC
On Mon, May 19, 2014 at 6:28 AM, Carl Hetherington <cth(a)carlh.net> wrote:
On Sat, 17 May 2014, lilian lefranc wrote:
[snip certificate download sites]
Those are useful, I think... I've looked through the Dolby data
a bit and I'm not 100% convinced of its accuracy.
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic Charbon Studio in Belgium already has a huge data
base with an online
generating tool:
https://www.charbon-studio.com/DCP_mastering_portal/kdm?login=demo
It contains some few errors for French servers.
That looks nice. Still, it seems to be intended only for DCPs
that Charbon Studio have mastered. In an ideal world I think
there would be a database with completely unfettered access;
i.e. search for a cinema and get its certificate on a web page,
and also some API for programs such as DCP-o-matic to find
certificates.
For French certificates, the CNC
(https://www.cnc-arcene.fr/index;jsessionid=13AFF5A28606CA0CEE2293889BED8F6B…)
references almost all cinemas with their certificates. Their are some errors
(the same than charbon as they got them on this web site) and certificates
have a bad coding but this is a good way to get certificates city by city.
Some certificates are missing as they are only referencing specific cinemas.
Also interesting. Thanks for the links!
Best regards
Carl
Lilian
Le 16/05/2014 14:44, Carsten Kurz a écrit :
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
Am 16.05.2014 um 14:15 schrieb Carl Hetherington:
> Hi all,
>
> This is interesting. It would be good to run an open database of
> cinema certificates so that indies etc. can generate keys (or we can
> generate keys for them). I guess the hard part is keeping the database
> updated...
Yes. There are quite a few discussions now in various forums about
creating encrypted DCPs for dedicated screens/servers. On some servers, it
is quite easy to download a certificate and email it to anyone in need. On
some systems, it is complicated. Not every cinema has skilled stuff, most
would probably not even know what a 'certificate' is and how to obtain it.
Some only know about equipment serial numbers.
In germany we have received more and more inquiries from new DCP and KDM
issuing companies during the last year.
It becomes obvious that a properly maintained certificate database is a
trade secret and an instrument to keep competition at distance, as all these
companies are fighting for business with the distributors while prices for
DCP and KDM generation are decreasing.
A public database or automated system would change that completely. It is
not clear, however, how things like FLMx or TKR will evolve in short term. I
have been to the Motionpicturesolutions-Site recently and it seems they are
also working on tools to change booking and key retrieval. What they are
trying to do is offering a content catalog where cinemas can book content
and retrieve keys automatically, upon confirmation through the license
holder. While that will probably mean some manual intervention by the
studios booking department in the beginning, it can easily be seen that at
least for classic titles this will become a fully automated
video-rental-shop-type system rather sooner than later. Other companies like
Sony are working on similiar systems.
The best thing of course would be if every cinema/equipment operator
would have a certificate stored for easy access. You could even put it up on
a website and simply mail the link to any interested party.
But for now, the major issue is, if someone want's to issue an encrypted
DCP, how does he actually get the certificate for the equipment intended for
screening.
Maybe this could also be something we could put up on the DCP-o-matic
site as a help, like the list of tested equipment.
E.G. the GUI of our Sony 515 allows to download the certificate to a
connected computer through the web interface. I know it's the same for
Christies IMB and Doremis IMS. Doremi has an online service and FTP site to
retrieve certificates by serial number. I know Dolby has an FTP site as
well, but I think it is not open.
- Carsten
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
_______________________________________________
DCPomatic mailing list
DCPomatic(a)carlh.net
http://carlh.dyndns.org/cgi-bin/mailman/listinfo/dcpomatic
4:10 p.m.
Am 19.05.2014 um 17:53 schrieb Carl Hetherington:
I imagine the major problem might be trust in tieing
certificates to particular cinemas and screens. If Alice said
"Here is the certificate for Screen 1 in `My Great Cinema' in York,
England"
(and she was telling the truth) but then Mallory said "Here is
the certificate for Screen 1 in `My Great Cinema' in York,
England" (and he was lying): who do you believe? If you believe
Mallory, he could use that trust to obtain KDMs for his
equipment that were not due to him.
That's why TKR looks so simple (and seems to be favoured by now): The Equipment can
obtain KDMs for it's own certificate all on itself, automatically or manually
triggered, with the 'coresponding lookup address' comunicated in the CPL, so you
don't need to trust anyone, you do not even need to know where the cinema is. It
creates more lookup traffic, but no properly maintained database is needed. The KDMs are
created or stored at the site who owns the right for the content. That could be content
owners, indies themselves, or service companies.
I think, for now it would be sufficient to put up a help page on the dcp-o-matic site
depicting how certificates can be retrieved for various type of equipment, what the
difference is between serial number and certificate, etc. That would also be compatible
with DCP-o-matics current way to create KDMs from locally stored certificates.
- Carsten
9:13 p.m.
On Mon, 19 May 2014, Carsten Kurz wrote:
That's why TKR looks so simple (and seems to be
favoured by
now): The Equipment can obtain KDMs for it's own certificate
all on itself, automatically or manually triggered, with the
'coresponding lookup address' comunicated in the CPL, so you
don't need to trust anyone, you do not even need to know where
the cinema is. It creates more lookup traffic, but no properly
maintained database is needed. The KDMs are created or stored
at the site who owns the right for the content. That could be
content owners, indies themselves, or service companies.
What identifier does the TKR system offer when asking for a KDM?
How does the content owner know that the requesting system is
cinema A, which has booked the film, not cinema B which hasn't?
I think, for now it would be sufficient to put up a
help page
on the dcp-o-matic site depicting how certificates can be
retrieved for various type of equipment, what the difference
is between serial number and certificate, etc. That would also
be compatible with DCP-o-matics current way to create KDMs
from locally stored certificates.
That would be a good idea.
Best regards
Carl
4:30 p.m.
Am 19.05.2014 um 17:53 schrieb Carl Hetherington:
I imagine the major problem might be trust in tieing
certificates to particular cinemas and screens. If Alice said
"Here is the certificate for Screen 1 in `My Great Cinema' in York,
England"
(and she was telling the truth) but then Mallory said "Here is
the certificate for Screen 1 in `My Great Cinema' in York,
England" (and he was lying): who do you believe? If you believe
Mallory, he could use that trust to obtain KDMs for his
equipment that were not due to him.
As Malcolm then would not have access to that equipment, he could not do anything bad with
the KDM. Of course, it could be used to some sort of 'denial-of-service' abuse,
KDM/certificate highjacking, etc.
We had a similar incident when our Sony was installed last year. We had been communicated
serial numbers before we actually received our equipment, so that we could prepare for KDM
delivery as fast as possible. We communicated the serial numbers to a few service
companies and were then notified that these numbers had been 'registered' the same
day by another cinema nearby, receiving the same machine type the same day. It turned out,
that our integrator received the wrong serial numbers from Sony, and forwarded them to us,
so that particular serial number and certificate was to be registered twice. As a matter
of fact it seems that most if not all service companies have databases or software
mechanisms that are able to detect doubles. Since currently for germany there are only a
handful of KDM issuing companies, it is usually not a big problem to sort things out on
the telefone. Usually registration is on a 'first come, first served' basis, so
anyone trying to highjack a serial number or certificate later will face an inquiry or be
notified that this certificate has been registered before.
Anyone buying used gear should therefore prepare a paper to be signed from the seller,
acknowledging the sale and the transfer of the specific serial number/certificate to the
new owner to speed up things.
Currently this only involves server-side media blocks or IMBs, but later will include
projector heads and sound processors (ATMOS) as well.
A few years ago we had only three or four service companies dealing with DCPs and KDMs for
germany. Usually after installation, the cinema integrator served as an authority to
confirm the installation of the specific gear and communicated the serials/certificates to
these. Today it's a bit more complicated.
- Carsten
9:16 p.m.
On Mon, 19 May 2014, Carsten Kurz wrote:
Am 19.05.2014 um 17:53 schrieb Carl Hetherington:
That's what I was getting at: the possibility that Mallory can
decode content that he does't have the rights to. He could make
up a private key and certificate, claim that it belonged to Big
Cinema, and hence get sent keys to decrypt DCPs.
I imagine the major problem might be trust in
tieing
certificates to particular cinemas and screens. If Alice said
"Here is the certificate for Screen 1 in `My Great Cinema' in York,
England"
(and she was telling the truth) but then Mallory said "Here is
the certificate for Screen 1 in `My Great Cinema' in York,
England" (and he was lying): who do you believe? If you believe
Mallory, he could use that trust to obtain KDMs for his
equipment that were not due to him.
As Malcolm then would not have access to that equipment, he
could not do anything bad with the KDM. Of course, it could be
used to some sort of 'denial-of-service' abuse,
KDM/certificate highjacking, etc. A few years ago we had only three or four service
companies
dealing with DCPs and KDMs for germany. Usually after
installation, the cinema integrator served as an authority to
confirm the installation of the specific gear and communicated
the serials/certificates to these. Today it's a bit more
complicated.
So it seems!
Best regards,
Carl
20 May
20 May
12:37 a.m.
>What identifier does the TKR system offer when
asking for a KDM?
How does the content owner know that the requesting system is
cinema A, which has booked the film, not cinema B which hasn't?
>
Projection rights are issued to a cinema, KDMs are issued for a
server. TKR makes no change in this situation. You can trick the
distributors now, and you can do so when TKR arrives.
Manuel AC
7:05 a.m.
Carl Hetherington:
I imagine the major problem might be trust in tieing
certificates to particular cinemas and screens.
A crucial part of issuing KDMs for any given target is
to make sure the target certificate has the correct
"ancestry". Verified vendor CA certificates are required
for that. Once you have known-to-be-correct CA certs you
can mathematically verify a given leaf certs ancestry.
Mallory's scheme would only work if the KDM issuer had not
built in this vital verification in their cert management.
Wolfgang
3996
days inactive
4008
days old
15 comments
5 participants
participants (5)
-
Carl Hetherington -
Carsten Kurz -
lilian lefranc -
Manuel AC -
Wolfgang Woehl