Шифр Cryptomeria: Анализ и уязвимости

Block cipher used by the 4C Entity

The Cryptomeria cipher, also called C2, is a proprietary block cipher defined and licensed by the 4C Entity. It is the successor to CSS algorithm (used for DVD Video) and was designed for the CPRM/CPPM digital rights management scheme which are used by DRM restricted Secure Digital cards and DVD Audio discs.

The C2 symmetric key algorithm is a 10 round Feistel cipher. Like DES, it has a key size of 56 bits and a block size of 64 bits. The encryption and decryption algorithms are available for peer review, but implementations require the so called "secret constant", the values of the substitution box (S box), which are only available under a license from the 4C Entity. The 4C Entity licenses a different set of S boxes for each application (such as DVD Audio, DVD Video and CPRM).

In 2008, an attack was published against a reduced 8 round version of Cryptomeria to discover the S box in a chosen key scenario. In a practical experiment, the attack succeeded in recovering parts of the S box in 15 hours of CPU time, using 2 plaintext ciphertext pairs. Because the attack was based on S box values from DVD Audio, it was suggested that CPRM may use different S boxes. Another brute force attack to recover DVD Audio CPPM device keys was mounted on 2009 05 06. The attack was intended to find any of 24570 secret device keys by testing MKB file from Queen "The Game" DVD Audio disc. On 2009 10 20 such key for column 0 and row 24408 was discovered. The similar brute force attack to recover DVD VR CPRM device keys was mounted on 2009 10 20. The attack was intended to find any of 3066 secret device keys by testing MKB from Panasonic LM AF120LE DVD RAM disc. On 2009 11 27 such key for column 0 and row 2630 was discovered. By now the CPPM/CPRM protection scheme is deemed unreliable.