Lawyers acting for Apple last week
caused the shutdown of an open-source project called iPodhash that was
dedicated to decoupling iPods from iTunes software in order to enable content
services for iPods on Linux platforms. The letter sent to the
administrator of Bluwiki, the site on which iPodhash operated, claimed that the
developers were in violation of the provision of US copyright law that outlaws
hacking DRM systems (DMCA).
The iPodhash developers were not trying to circumvent Apple's FairPlay DRM
per se -- they were not trying to decrypt FairPlay-packaged content.
Instead, they had been trying to reverse engineer a cryptographic hash value
that Apple uses to verify that iPods are talking to iTunes software on Macs or
PCs instead of other software. In other words, the iPodhashers were trying to
break the ties between iTunes and iPods -- ties that Apple has been
strengthening lately since previous versions of the hash were successfully
hacked.
A hash value is a mathematical function; it works like a shorthand for data.
A hash function takes a large amount of data as input and outputs a small amount
of data (say 256 bytes). This small bit of data, the hash value, has some
very interesting properties: different data inputs are extremely likely to lead
to different hash values; even the smallest change in the input data will
produce a different hash value; and it should be very difficult to reconstruct
the data inputs if only the hash value is known. A cryptographic hash is
simply a hash function that uses techniques related to cryptography that make it
more difficult to reconstruct the original data.
For example, imagine a hash function applied to text. Let's say that a
hash value for a mystery novel is "ABCDEFG0123456789". It's impossible to
reconstruct the entire 300-page novel from this value. Then let's say
someone changes the ending of the novel from "The butler did it" to "The cook
did it," and re-calculates the hash. The resulting hash value would be
something completely different, even though only one word was changed.
Hash values are not DRM per se, but they are used in related applications.
For example: Microsoft has a technology called Product Activation that it uses
to protect its software products, such as Windows and Office, from piracy.
In Product Activation, Microsoft computes a hash value that stands for the
user's PC hardware, using values corresponding to the PC's RAM, hard drive, I/O
devices, and so on. Microsoft stores this value and associates it with a
piece of software that the user has activated. It's not possible to
reconstruct the actual PC configuration with any certainty, thereby protecting
users' privacy.
In this case, Apple is using a hash scheme to tie iPods to iTunes
installations, not to protect content. The latest hash value apparently
uses more sophisticated cryptographic hash techniques to make reverse
engineering more difficult.
The primary purpose of Apple's hashing scheme is to make sure that iPod users
use iTunes instead of other PC/Mac software. Calling the reverse
engineering of the iPod hash a violation of DMCA is therefore a bit of a
stretch, to put it mildly. In other words, this is another example of how
DMCA is being abused in order to protect the interests of device makers -- just
as it was in the
Skylink case involving garage door openers.
Of course, it's possible that Apple's attorneys are well aware of DMCA's
dubious applicability to iPodhash and simply figured that an ominously-worded
nastygram would be sufficient to put the iPodhashers out of business. The
tactic seems to have worked. It also worked as yet more evidence of how
content owners are not the only ones trying to use DRM-related technologies to
their advantage; consumer electronics makers do it too.