How AACS works:

AACS uses a popular algorithm called Subset Difference Revocation (SDR) for key

assignment and revocation. SDR has led to many papers in the Crypto conference.

Many of them are variants or enhancements over the basic SDR algorithm.

In the SDR algorithm, cryptographic keys (used for encryption) are represented as a complete(full) binary tree. For AACS, a tree with 32 levels is used. That means 2³² unique keys are generated.

The leaf nodes of this tree represent both hardware and software devices. The keys assigned to the leaf nodes are called device keys. Each device stores a subset of keys from the binary tree. The subset of keys is formed in such a way that only devices whose keys are not revoked are able to decrypt the content. In other words, the revoked devices, even if they all collude won't be able to decrypt the content using their keys. This is the core of Subset Difference Revocation method.

In Figure 1, a simple binary tree is shown. The leaf nodes n8 – n15 represent the devices. Ki,j means the key associated with node nj assigned with subtree rooted at ni.

For example, the device n8 stores the keys: k1,3 k2,5 and k4,9. Here, k4,9 is the keys associated with node n9, assigned with subtree rooted at n4. Note that the keys stored in device n8 are associated with its ancestor's siblings all the way up the root of the tree- n9, n5 and n3.

Figure 1

Diving one more step into the details of how this works, the subset of keys on a device (referred to as device keys) are not directly used in encrypting the media content. They are used in deriving a key called "Media Key" which is used in content encryption. The media key is encrypted using a carefully formed subset of device keys. A new media key is generated for each title just like a new secret key generated in each SSL session.

The content on the disk is encrypted as below:

[n₁, n₂, …,n_m], E_k1 (K), E_k2 (K), … , E_km(K) | E_K(M)

Where, n₁, …,n_m are subset of nodes of the binary tree, whose keys k₁, …,k_m are

used for encrypting the media key K. The content M is encrypted using the media

key K.

Note, the subset of nodes is formed in such a way that the non-revoked leaf nodes can derive one of the keys k_i from the set: k₁,.. ,k_m using node information n_i from the set: n₁,..,n_m.

In Figure 1, the media key is encrypted using the set: {k1,3 k1,2}