Is it possible to derive AACS host certificates from the USB data stream?

[maetel99]

I was curious if anyone had considered using a USB packet sniffer (software or hardware) to try to obtain new valid host certificates and private keys. If you look at the AACS drive authentication procedure in section 4.3 of the AACS common spec, the host sends the host certificate in plain text to the drive. Later, the host sends a data block signed with its host private key comprising a session key point (not sent by USB) and the drive nonce (sent earlier over USB).

The question is whether it is possible to derive the corresponding host private key for the host certificate given these values pulled from the USB stream.

[LoRd_MuldeR]

A certificate contains the public key, it does not contain the corresponding private key. In fact, a certificate is "public" information and does not contain any "secret" information at all.

Also, it is essential to any asymmetric cryptosystem that the private key can not be derived from the public key*. Otherwise public-key cryptography (asymmetric cryptography) would be rather pointless ;)

BTW: Creating a valid digital signature requires to have the private key, but for validation of the signature the public key suffices. You never expose your private key to the "outside world".


* and here I mean: The private key can not be derived from the public key in reasonable time. It is not entirely impossible, but even the most performant "supercomputers" available today would require decades. So, it is practically impossible.

[maetel99]

A certificate contains the public key, it does not contain the corresponding private key. In fact, a certificate is "public" information and does not contain any "secret" information at all.

Also, it is essential to any asymmetric cryptosystem that the private key can not be derived from the public key*. Otherwise public-key cryptography (asymmetric cryptography) would be rather pointless ;)

BTW: Creating a valid digital signature requires to have the private key, but for validation of the signature the public key suffices. You never expose your private key to the "outside world".

* and here I mean: The private key can not be derived from the public key in reasonable time. It is not entirely impossible, but even the most performant "supercomputers" available today would require decades. So, it is practically impossible.

All of this is quite correct. However, we have more information than just the host certificate with the public key. For example, we have potentially the following additional information:

1. The plain text of a block of data encrypted with the host private key
2. Encrypted versions of the host certificate and private key from the player firmware or executable binary

[dizzier]

1. The plain text of a block of data encrypted with the host private key

https://en.wikipedia.org/wiki/Known-plaintext_attack
https://crypto.stackexchange.com/questions/5890/do-known-plaintext-attacks-exist-for-public-key-encryption


2. Encrypted versions of the host certificate and private key from the player firmware or executable binary

https://en.wikipedia.org/wiki/Differential_cryptanalysis