DVD encryption, explained_

The layers on a typical movie disc

How CSS works

CSS is licensed by the DVD Copy Control Association. A manufacturer signs the license, receives keys and the algorithm under confidentiality terms, and in return agrees to enforce region codes and the other rules. The cryptography was never meant to be strong on its own; its job was to make sure nobody could build a player without signing the contract.

The key hierarchy

Scrambling the sectors

DVD data is laid out in sectors of 2,048 bytes. Only the video, audio and subtitle packs are scrambled, and only from byte 128 onward; the headers stay readable so a player can navigate. Each scrambled sector carries five bytes in its header that are mixed with the title key to make a fresh key for that sector, so no two sectors use the same keystream.

# What a licensed player does, step by step
bus_key   = authenticate(drive, player)             # challenge-response
disc_key  = unlock(disc_key_block, player_key)      # one of 409 slots matches
check(disc_key)                                     # against the self-encrypted copy
title_key = unlock(encrypted_title_key, disc_key)

for sector in title:                                # 2,048 bytes each
    if sector.is_scrambled:
        sector_key = mix(title_key, sector.header_seed)   # 5 bytes per sector
        keystream  = css_cipher(sector_key)
        sector.payload ^= keystream                 # bytes 128 to 2,047

The cipher itself

CSS is a stream cipher built from two linear feedback shift registers (LFSRs), simple circuits that step through a long sequence of bits and were cheap to put in 1990s hardware.

• LFSR-17 is 17 bits long and is loaded from two bytes of the 40-bit key.
• LFSR-25 is 25 bits long and is loaded from the other three bytes.
• A fixed 1 bit is inserted into each register when it is loaded, so neither can start in the all-zero state, where it would stay forever.
• Each register produces a byte at a time. The two bytes are added together with carry to make one byte of keystream. Depending on the mode, one or both outputs are inverted first.
• The keystream is combined with the data by XOR, after the data passes through a fixed substitution table.

The same machinery is run in slightly different modes for authentication, for unlocking the disc key, for unlocking title keys and for the video data. Each mode differs only in which of the two register outputs is inverted before the carry is added.

The mangling step

Keys are not simply run through the cipher. When CSS unlocks one key with another, it first passes the bytes through a fixed substitution table of 256 values and reorders them, a step usually called mangling. The table is the one piece that the designers kept secret rather than clever: it is not derived from anything, so to implement CSS you had to be given the table under licence. Once the table leaked, that secrecy was worth nothing. Descrambling a key is therefore three things in sequence: run the cipher to make a keystream, XOR it against the stored key bytes, and undo the table substitution.

Descrambling a sector, in outline

This is the shape of the process, not an implementation. It leaves out the register tap positions and the table values, which are what a working descrambler needs.

1.  load  LFSR-17 from key bytes 0-1, LFSR-25 from key bytes 2-4
2.  force a 1 bit into each register so it cannot sit at all-zero
3.  for each output byte:
        a.  clock each register 8 times to get one byte from each
        b.  invert one or both outputs, depending on the mode
        c.  keystream_byte = lfsr17_byte + lfsr25_byte + carry   # 8-bit add
4.  XOR the keystream against the scrambled bytes (128..2047)
5.  for key data only: also undo the fixed table substitution

Because step 3c just adds the two outputs, the keystream carries the structure of both registers straight through. That is the opening the 1999 attacks walked through, described below.

Why CSS broke

CSS failed in three separate ways, and any one of them would have been enough.

1. The keys were too short. Forty bits was chosen in part to stay inside the US export limits on cryptography at the time. That is about a trillion possible keys, which a single desktop computer could search by the late 1990s.
2. The cipher leaks. Because the two registers are simply added together, an attacker who knows a few bytes of keystream can guess the state of the short register, compute what the long one must have been, and check the guess. Analyses published in late 1999 put the work at around 2¹⁶ steps to recover a key from known keystream and around 2²⁵ to recover a disc key from the disc alone. Both run in seconds.
3. Every player holds a master key. Software players had to carry their player key inside a program running on the customer's own computer. In 1999 one software player was found to store its key without protection. With one player key and the weaknesses above, the others could be derived.

The program built on that discovery, DeCSS, appeared in October 1999. Discs already sold could not be changed, and once every player key could be worked out, leaving one of them off future discs achieved nothing. The lawsuits that followed went after the people who posted the program, including the operator of this site.

Region codes

Region coding has nothing to do with encryption. It is a one-byte flag on the disc that says where the disc may be played, used so that studios could stagger release dates and set different prices around the world.

The mask has one bit per region, and a bit set to 1 means that region is locked out. A disc for regions 2 and 4 clears bits 1 and 3, giving 0xF5. A player checks its own region against the mask:

playable = (disc_mask & (1 << (player_region - 1))) == 0

RPC-1 and RPC-2 drives

Early computer DVD drives were RPC-1: the drive ignored regions and left enforcement to the player software. Drives made since 2000 are RPC-2: the region is stored in the drive's own firmware and can be changed five times, after which it locks on the last setting. Some later discs add Regional Coding Enhancement, a program on the disc that asks the player its region and refuses to continue if the answer is "all".

Other protections found on DVDs

None of these change how to make a copy of a disc you recorded yourself. The practical side is covered in how to copy a DVD.

What came next: AACS, BD+ and Cinavia

The legal layer

Once CSS was broken, what remained was the law. Most countries that signed the 1996 WIPO Copyright Treaty passed rules making it unlawful to circumvent a technical protection measure, or to distribute tools for doing so, whether or not any copyright is infringed afterward.

The cases that defined it

• Universal City Studios v. Reimerdes (S.D.N.Y. 2000), affirmed as Universal v. Corley (2d Cir. 2001). Posting DeCSS, or knowingly linking to it, violated the DMCA. The history is on the home page.
• DVD CCA v. Bunner (California, 2003 to 2004). A trade-secret claim over DeCSS; the injunction was eventually lifted because CSS was no longer secret.
• The Johansen prosecution (Norway, 2003). Jon Lech Johansen was acquitted twice of charges over his part in DeCSS.
• 321 Studios v. MGM (N.D. Cal. 2004) and RealNetworks v. DVD CCA (N.D. Cal. 2009). Commercial DVD-copying products were enjoined under the DMCA.

This page is a technical and historical summary, not legal advice.

Frequently asked questions

References and further reading

• Content Scramble System, Wikipedia
• DVD region code, Wikipedia
• Advanced Access Content System and BD+, Wikipedia
• Section 1201 rulemaking, US Copyright Office
• DVD Copy Control Association, the CSS licensor