Tuesday, December 22, 2009

B&N EPUB key derivation algorithm

I’ve managed to figure out the Barnes & Noble user EPUB AES key derivation algorithm. Rather than fragment things too much, I’ve just edited my previous post on B&N EPUBs and added the (for any platform) key-derivation script.

The algorithm is interesting mostly in that it isn’t very good. I mentioned in my post analyzing Adobe’s ADEPT system that ADEPT is a fairly well-designed cryptographic system, even if not a very effective DRM system. Adobe used all standard algorithms applied in standards ways and glued together with standard plumbing. Barnes and Noble’s key derivation algorithm in contrast is neither effective at increasing obfuscation nor shows much awareness of cryptographic standards.

Cryptography is hard. Do you know how different configurations of your chosen algorithms can make them more or less resistant to side-channel attacks? Do you understand why RSA Laboratories switched the recommended RSA padding scheme in PKCS#1 to OAEP? Do you know the implications of different block cipher modes of operation and why or why not you should choose a mode which includes integrity protection? These questions represent a random sampler platter of things you should just know in your bones before you do anything close to designing a cryptosystem. For everyone else – a category in which I include myself – there are well-reviewed, well-tested algorithms presented in standards documents published by such organizations as RSA Laboratories and the IETF.

For key derivation from non-random source data, there is in particular the PBKDF2 (Password-Based Key Derivation Function) published in PKCS#5. My point is not that the key-derivation algorithm used by B&N necessarily has cryptographically undesirable properties (although its computation speed makes brute-force attacks more plausible), but that the fact that they rolled their own instead of reaching for PBKDF2 shows a marked lack of cryptographic savvy.

On the DRM-as-obfuscation end this algorithm similarly come up short. The multiple steps involved demonstrate some level of attempt to introduce complexity, but in the resulting binary all those steps are in one place. The entire algorithm boils down to one function calling a handful of easily-labeled subroutines (sha1_wrapper, normalize_name, aes_encrypt, etc).

I really am starting to think that e-book format providers actively want their DRM schemes to be broken.

96 comments:

  1. How's that "other experiment" going? You know, the one about "gems"?

    ReplyDelete
  2. Hi,

    I'm having issues with this. I have Vista 64 bit. Here is what I did, step by step:
    1. Downloaded PyThon 2.6.4, and installed it to it's default install location.
    2. Downloaded PyCrypto v2.1.0, and installed to it's default location.
    3. Installed the BN Reader Software to a default location.
    4. Downloaded the three scripts, and renamed them as suggested.

    Now, I'm having a few issues.
    1. Running ignoblekey.pyw, I get this error: "Problem locating B&N Reader DB"
    2. If I do the ignoblekeygen.pyw script, I enter my user ID and CC#, and it creates a new file successfully. Then, when I run the ignobleepub.pyw script, choose my book, and select output (ex: book.epub), I get the error "Key cannot be the null string".

    Please help!

    ReplyDelete
  3. 友情像一棵樹木,要慢慢的栽培,才能成長真的友誼,要經過困難考驗,才可友誼永固..............................

    ReplyDelete
  4. I think that the people at BN that write the key-generation schemes feel the same as one of the people that commented on your previous post. (DRM != good && Copyright == good)

    ReplyDelete
  5. Any Chance you've got a decryption script for Sony Reader EPUB formats? Or is it the same as any of the others you've released thus far?

    ReplyDelete
  6. I am having trouble loading pccrypto, keeps locking up. I have python 2.6. Any sugestions?

    ReplyDelete
  7. I think that this hack doesn't work any more - there is no *.db file in the B&N folder that I can find, even after the app has been installed, a book opened, and the app closed. Shame.

    ReplyDelete
  8. Adam, the .db file is under the Users\username\AppData\Roaming\Barnes & Noble\DesktopReader directory. The ignoblekey file is looking for ClientAPI_*.db, but there is no underscore or anything following any longer. You can edit the ignoblekey file so that it does not reference the underscore, but I still haven't gotten past the "key cannot be null string" that John mentioned earlier.

    ReplyDelete
  9. 在莫非定律中有項笨蛋定律:「一個組織中的笨蛋,恆大於等於三分之二。」.........................

    ReplyDelete
  10. 愛情是一種發明,需要不斷改良。只是,這種發明和其他發明不一樣,它沒有專利權,隨時會被人搶走。..................................................

    ReplyDelete
  11. Cabbages,
    I am a newbie at this and dont know where to start in terms of understanding and implementing what your saying step by step on OSX.

    do you have a simple newbie tutorial?

    appreciate it

    ReplyDelete
  12. 思想與理論,貴呼先於行動,但行動較思想或理論更高貴......................................................................

    ReplyDelete
  13. Cheap Generic Medication
    I would like to appreciate the great work done by you
    Generic Viagra
    Generic Cialis
    シアリス

    ReplyDelete
  14. The keygen and decrypt worked like a charm under Ubuntu Linux 64-bit with python, python-tk and python-crypto installed.

    Thank you!

    ReplyDelete
  15. Thank you very much guy, it help me a lot !

    ReplyDelete
  16. Generous, I Can’t seem to be able to see anything similar on Yahoo – Guess I will have to keep it bookmarked!

    3D ultrasounds | 4d Ultrasounds

    ReplyDelete
  17. Thanks for sharing, much appreciated and useful post, congrat and keep on track!
    Cialis Online

    ReplyDelete
  18. That is a communal habit just before abuse Finpecia online headed for treat a range of class maladies.

    ReplyDelete
  19. I deliberate generic Periactin be able to make this doable to accomplish it.

    ReplyDelete
  20. This very boundary marker ended me hark back of buy Propecia, with the aim of's very fine!

    ReplyDelete
  21. Thi is a careful idea, a short time ago be keen on valtrex online, thanks for the column!

    ReplyDelete
  22. I carry out believe it is feasible in the direction of achieve this, thanks very a good deal en route for generic Zithromax.

    ReplyDelete
  23. Amazing!I also wish him good luck to defend his gold medal. I like to share it with all my friends and hope they will also encourage him.buy xanax online

    ReplyDelete
  24. Please one more post about that. I wonder how you got so good. This is really a fascinating blog, lots of stuff that I can get into. One thing I just want to say is that your Blog is so perfect...

    3d ultrasounds

    ReplyDelete
  25. This comment has been removed by the author.

    ReplyDelete
  26. This comment has been removed by the author.

    ReplyDelete
  27. I impressed greatly that the way you have written such great article. I got many reference about this topic but your one is online bookmakers Excellent tips, and the performance is looking much improved. bet365, bwin, uk betting tips, online betting, free bets, betting odds, horse racing, ladbrokes, free betting tips and bookmakers reviews , online bookmakers and promotional bonus codes

    ReplyDelete
  28. These collections are works of art in digital perspective. Thumbs up.
    Best Graphic Design Site

    ReplyDelete
  29. awesome I put-off buying this for months, despite positive reviews. I tried every free weather app going and eventually decided to take the plunge. Glad I did - easily the most customisable weather widget and clock on caftan and the skins are awesome!

    http://android-fore.blogspot.com/

    ReplyDelete
  30. With many skills you can be good at at many more jobs and make less mistakes while doing it….
    web hosting pakistan

    ReplyDelete
  31. Your findinds about the different areas in the book worlds are really insightful, giving the fact that cryptography is one of my favourite sciences!
    Movers

    ReplyDelete
  32. weight loss programs mn

    Wow,great content and your blog template is so beautiful. Is this template free or not. If so, would you please share this template? if not, how much does it cost? Thanks a lot!

    ReplyDelete
  33. Interactive Presentation

    I like it very much because it has very helpful articles of various topics like different culture and the latest news. I am a

    ReplyDelete
  34. Adobe used all standard algorithms applied in standards ways and glued together with standard plumbing.

    writing dissertation papers

    ReplyDelete
  35. The entire algorithm boils down to one function calling a handful of easily-labeled subroutines.
    dissertation proposal title

    ReplyDelete
  36. website hosting australia

    This great blog is very interesting and enjoyable to read. I am a big fan of the subjects discussed. I also enjoy reading the comments, but notice that alot of people should stay on topic to try and add value to the original blog post. I would also encourage everyone to bookmark this page to your favourite service to help spread the word.

    ReplyDelete
  37. thank you guy .. can u share more like that documents ?
    uçak bileti

    ReplyDelete
  38. Great post,It gave me a lot of inspiration to make changes in my blog and make it way better than before.
    Law Essay Writing Service

    ReplyDelete
  39. Επιλέξτε όλες τις εικόνες με βιτρίνα καταστήματος.
    Όταν δεν υπάρχουν άλλες, κάντε κλικ στην επιλογή "Επαλήθευση".

    ReplyDelete
  40. شركة البيوت للخدمات المنزلية


    هي شركة البيوت سعودية ذات خبرة 25 عاما في مجالات الخدمات العامه واعمال اليرها وشركمقاولات والصيانة العامة مثل كشف التسربات واعمال تخزين عفش و نقل اثاث وتنظيف بالرياض ترميم منازل بالرياض و نقل اثاث وحل ارتفاع فاتوره المياه ومكافحة الحشرات رش مبيدات بالرياض وتخزين اثاث غ وة البيوت تمتلك اقوي فريق عمل قادر علي التواصل مع العملاء بشكل محترف ومرونة تامة . شركة البيوت قائمة علي المصداقية والثقة والضمان فيما تقدمه للعميل من خدمات المنزلية وكذلك سهولة التعاقد والاتفقات معنا ولا نختلف تماما عن الاسعار المطلوبة فالأهم لدينا كسب ثقة العميل وارضاؤه علي اي حال .

    شركة تخزين اثاث

    رش مبيدات

    شركة نقل اثاث بالرياض

    شركة ترميم منازل

    شركة تنظيف بالرياض

    شركة رش مبيدات

    كشف تسربات المياه

    تخزين عفش

    نقل اثاث بالرياض

    مكافحة الحشرات

    شركة كشف تسربات المياه بالرياض

    شركة تخزين اثاث بالرياض

     

     

     

     

     

     

     

    ReplyDelete
  41. افضل شركة غسيل وتعقيم خزانات غسيل الكنب والسجاد ومكافحة الحشرات وتسليك المجارى بالمدينة المنورة المثالية 0552692371
    شركة تنظيف بالمدينة المنورة تنظيف الفلل والشقق بالمدينة المنورة متخصصون شراء الاثاث المستعمل بالمدينه المنوره

    شركة شراء اثاث مستعمل بالمدينه المنوره

    شركة شراء الاثاث المستعمل بالمدينة المنورة

    شراء الاثاث المستعمل بالمدينة المنورة

    شراء الاثاث المستعمل بالمدينة المنورة

    شراء الاثاث المستعمل بالمدينة المنورة

    شراء الاثاث المستعمل بالمدينة المنورة


    شركة غسيل كنب بالمدينة المنورة


    شركة غسيل خزانات بالمدينة المنورة


    شركة تنظيف خزانات بالمدينة المنورة


    شركة مكافحة حشرات بالمدينة المنورة


    شركة تنظيف خزانات بالمدينة المنورة

    شركة غسيل كنب بالمدينة المنورة


    شركة غسيل شقق بالمدينة المنورة


    شركة مكافحة حشرات بالمدينة المنورة


    شركة غسيل خزانات بالمدينة المنورة


    شركة غسيل كنب بالمدينة المنورة



    شركة غسيل شقق بالمدينة المنورة


    شركة غسيل كنب بالمدينة المنورة



    شركة مكافحة حشرات بالمدينة المنورة  




    شركة تسليك مجارى بالمدينة المنورة


    شركة مكافحة حشرات بالمدينة المنورة


    شركة كشف تسربات المياة بالمدينة المنورة




    شركة نقل عفش بالمدينة المنورة    


    شركة نقل الاثاث بالمدينة المنورة

    شركة نقل عفش بالمدينة المنورة



    شركة تركيب غرف نوم بالمدينة المنورة

    ReplyDelete
  42. its very Nice شركات الماسة تقدم لكم شركة جلى رخام جدة فنحن نساعدك على عمل جلى رخام جدة حيث أن شركتنا شركة جلى بلاط جدة لديها أفضل ماكينات جلى بلاط جدة كما اننا فى شركة شركة جلى سيراميك جدة لدينا احدث أدوات جلى سيراميك جدة كما ان شركتنا تعتبر افضل شركة جلى رخام جدة وبشهادة العملاء نعتبر افضل شركة جلى بلاط جدة ونعتبر أيضا افضل شركة جلى سيراميك جدة كما أن لدينا افضل اسعار جلي بلاط جدة

    ReplyDelete
  43. شركة الحرمين تقدم لكم افضل مواد العزل التي تستخدم من قبل الفنيين شركة كشف تسربات المياه بالاحساء
    و الخبراء لديها فهي شركة عزل خزانات بالاحساء والقطيف علي اعلي مستوي
    من الجودة و افضل العروض و الخدمات كشف تسربات المياه
    شركة الحرمين شركة عزل خزانات تتبع احدث الوسائل و التقنيات العلمية لتحصلوا
    علي افضل مياة صحية و خزان مثالي خالي من العيوب
    شركة كشف تسربات المياه بالدمام
    بادروا بالحصول علي عروض و خدمات شركة الحرمين بالاحساء


    شركة كشف تسربات المياه بالقطيف

    اتصلو بنا


    شركة عزل اسطح بالاحساء

    ReplyDelete