DCI Specs - Digital Cinema Initiatives

Processing Block (SPB) Authentication and Section 9.4.3.5 Functions of the SecurityManager (SM)).9.6.2.4. Revocation and Renewal of TrustThe use of TDLs in the KDM allows a simple and effective way for Distributors tocommunicate trust in exhibition equipment to the responsible Security Managers.However, the source (database) of equipment lists, from which TDL information isderived must be managed with respect to revocation and renewal issues per Table 23:Factors Supporting Trust in a Security Device, above.In routine operation, trusted equipment remains trusted indefinitely. However there maybe situations in which trust in a security device needs to be terminated or restored.Controlling change in trust relationships is an important aspect of trust management.Database references for TDL creation must be managed with respect to trust issues.However, these are outside the scope of this specification.9.7. Essence Encryption and CryptographyThe security system employs widely used and rigorously tested ciphers for use in DigitalCinema. The following are requirements pertaining to Digital Cinema applications for ciphersand associated security parameters.9.7.1. Content TransportContent security is transport agnostic, and can be accomplished by either electronic orphysical means. Other than as authorized and intended by Rights Owners (e.g., to supportDistribution practices or requirements), content shall only be decrypted at playback time atthe exhibition site under the policy of the SM.9.7.2. Image and Sound EncryptionThe AES cipher, operating in CBC mode with a 128 bit key, shall be used for Digital Cinemacontent encryption. See [FIPS-197 “Advanced Encryption Standard (AES)” November 26,2001. FIPS-197] and Section 5.3.2 MXF Track File Encryption, for MXF track file encryptiondetails.The content Rights Owner shall determine which, if any, of the essence types in thecomposition are encrypted for distribution.9.7.3. Subtitle EncryptionThe Subtitle List element shall be encrypted using xmlenc-core. The AES-128 CBCsymmetric cipher shall be used. The cryptographic key shall be identified using a uniqueKeyID value and delivered using the Key Delivery Message (see Section 9.8.).Subtitle encryption is directed primarily against interception during transport, andcryptographic protection within the theater is not required. For example, plaintext subtitlecontent may be transmitted from a server device to a projection unit. It is preferred, but notrequired, that subtitle content be maintained in encrypted form, except during playback.9.7.4. Protection of Content KeysThe RSA Public Key Cipher (with 2048-bit key) shall be used to protect keys for distribution.This is accomplished by the requirements of the Key Delivery Message.DCI Digital Cinema System Specification v.1.2 Page 147