DCI Specs - Digital Cinema Initiatives

The above RSA asymmetric protection, AES (with 128-bit keys) or TDES (with 112-bit key)symmetric ciphers, may be used to protect the storage of keys once decrypted from theKDM within a Media Block (e.g., where off-secure-chip memory is used for key cachingwithin a Media Decryptor, for example).9.7.5. Integrity Check CodesData integrity signatures (hash values) shall be generated/calculated according to thePKCS-1 Digital Signature Standard, as specified in [IETF RFC 3447 (RSA and SHA-256)].All signatures shall use SHA-256. Digital Certificates in X.509v3 format as constrainedaccording to Section 9.8., shall be used to authenticate signatures. Signature elementdefinitions and other signature details are available in the specification for each signed datastructure.Cryptographic data integrity checksums shall be ensured according to the HMAC-SHA-1algorithm, as specified in [FIPS PUB 198a “The Keyed-Hash Message AuthenticationCode.”]9.7.6. Key Generation and DerivationAsymmetric keys (RSA keys) shall be generated as specified in [IETF RFC 3447].Symmetric key generation shall be per ANSI X9.31.A vendor that pre-loads an RSA private key into a device (e.g., secure silicon per Section9.5.2.2 Physical Security of Sensitive Data) shall ensure that these pre-loaded keys areunique to each device made by that vendor. The vendor shall not keep any record of thepreloaded private keys, though they can keep records of the matching public keys. RSAkeys shall be 2048 bits in length, and may be generated from two or three prime numbers,each of which must be at least 680 bits long. The mechanism used to generate RSA keypairs must have at least 128-bits of entropy (unpredictability).A vendor that pre-loads an AES or TDES symmetric key into a device shall generate eachkey with a high quality random number generator with at least 128 bits of entropy (112 bitsfor TDES). The vendor may not keep any records of these symmetric keys.9.7.7. Numbers of KeysNo more than 256 keys should be used to encrypt the essence of a single composition (i.e.,Composition Playlist). To support multiple shows, Media Decryptors should be capable ofsecurely caching at least 512 keys. The Show Playlists may be comprised of multiplecompositions.9.8. Digital Certificate, Extra-Theater Messages (ETM), and KeyDelivery Messages (KDM) RequirementsThe following Society of Motion Picture and Television Engineers (SMPTE) published standardsshall be utilized:1. SMPTE430-1: D-Cinema Operations- Key Delivery Message (SMPTE3383B),2. SMPTE430-2: D-Cinema Operation- Digital Certificate (SMPTE3384B), and3. SMPTE430-3: D-Cinema Operations- Generic Extra-Theater Message Format(SMPTE3385B).Note: Portions of the SMPTE standards are incomplete with respect to many behaviorrequirements, the subjects of which are typically addressed by SMPTE as "Informative notes."DCI Digital Cinema System Specification v.1.2 Page 148