RICHARD ALLAN HORNING - SB #45349
THOMAS E. MOORE III- SB #115107
MICHAEL W. STEBBINS - SB #138326
TOMLINSON ZISKO MOROSOLI & MASER LLP
200 Page Mill Road, Second Floor
Palo Alto, California 94306
Telephone: (650) 325-8666
Facsimile: (650) 324-1808
ALLONN E. LEVY - SB#187251
HUBER & SAMUELSON, P.C.
210 N. Fourth Street, Suite 400
San Jose, CA 95112
Telephone: (408) 295-7034
Facsimile: (408) 295-5799
ROBIN D. GROSS - SB#200701
ELECTRONIC FRONTIER FOUNDATION
1550 Bryant Street, Suite 725
San Francisco, CA 95103
Telephone: (415) 436-9333
Facsimile: (415) 436-9993
Attorneys for Defendant,
SUPERIOR COURT OF THE STATE OF CALIFORNIA COUNTY OF SANTA
DVD COPY CONTROL ASSOCIATION, INC., a not-for-profit
ANDREW THOMAS MCLAUGHLIN, et al.,
DECLARATION OF FRANK A. STEVENSON IN OPPOSITION TO ORDER TO SHOW CAUSE RE: PRELIMINARY INJUNCTION AGAINST ALL DEFENDANTS
Date: January 14, 2000
Time: 1:30 p.m.
Honorable William J. Elfving
1. My name is FRANK A. STEVENSON and I live in Oslo, Norway. If called upon to do so, I would competently testify to the following facts:
2. I am a computer research programmer employed by Funcom Oslo AS. I have 18 years experience in programming, and more than 6 years experience with cryptography. I have been practicing research and development in DVD encryption in particular for 4 months. My main interest in this endeavor is purely cryptographical.
3. I have given cryptographical services to RF-Rogaland Research ( http://www.rf.no ). To the best of my knowledge I am the first that publicly disclosed cryptonalysis on the CSS ciphers.
4. The Livid project mailing list is a forum dedicated to providing Video and DVD playback capabilities to the Linux computing platform. They have cooperatively written 2 CSS related programs, css-auth and css-cat.
5. There are 4 programs in wide circulation that uses CSS ciphers. These are the "DeCSS" program, css-auth, css-cat, and the "anonymous source".
6. "DeCSS" is a Microsft Windows program written outside the Livid team,
it's origin is frequently asserted to be Norwegian
7. The "anonymous source" is a short section of source code that describes all the css cipher modes of operation required to decrypt a DVD movie. It cannot be executed as a program, and does not contain any player keys. To the best of my knowledge, the origin of the "anonymous source" is completely unknown. There exists no effective means for establishing who the author is.
8. Css-auth is a program written by the Livid group. When running it will perform the authorization to the DVD drive, enabling the reading of a hidden block of data. This hidden block of data contains a) a list of title keys encrypted under various disk keys. b) a hash (checksum) used to verify the title key.
9. Css-cat is a program developed by the Livid group. It is capable of decrypting the bulk of movie data using the CSS cipher. Css-cat has in part been based on the "anonymous source".
10. Css-auth and css-cat together are functionally equivalent to DeCSS. DeCSS requires Microsoft Windows to run, while css-auth / css-cat runs under Linux.
11. I regularly post my crypto-analysis results on the net to share with other researchers and aid in the development of encryption education, computer security, and platform interoperability.
12. The Web site I maintain for such a purpose regarding the DVD CSS
system is: http://crypto.gq.nu/ where I posted a description of the activities surrounding the development of the css-cat computer program. Attached hereto is a documentary representation, which is a true and correct copy of the relevant web page on my web site.
SEE ATTACHED EXHIBIT A
13. My above-mentioned Web site includes a page of links to posts that
were made to the Livid project mailing list and posted then on my Web site.
These include the original anonymous posting of the CSS algorithm and the
source code. Attached hereto is a documentary representation,
which is a true and correct copy of the relevant web page on my web
site at http://crypto.gq.nu/livid.html
SEE ATTACHED EXHIBIT B
14. On or about October 25, 1999 an anonymous post of CSS C source code
was made to the Livid project mailing list and I later posted a copy of
it on my Web site at: http://crypto.gq.nu/CSSscramble.txt
Attached hereto is a documentary representation, which is a true and correct copy of the relevant web page on my web site.
SEE ATTACHED EXHIBIT C
15. On or about October 27, 1999 I published a break on the CSS cipher
used for encrypting the movie files. This attack reduced the workload for
finding a CSS key used to encrypt an individual block of movie data by
a factor of 16.777.216. Such an attack is a clear demonstration that
the CSS cipher was seriously flawed. I made this post to the Livid project
mailing list and I later posted a copy of this message on my Web site at:
Attached hereto is a documentary representation, which is a true and
correct copy of the relevant web page on my web site.
SEE ATTACHED EXHIBIT D
16. On or about October 28, 1999 I made a post describing a break on
the player keys to the Livid project mailing list. This attack will
enable a competent programmer to derive all 400 or so player keys from
a single known player key in 5 to 10 minutes on an ordinary PC. I
later posted a copy of this message on my Web site at: http://crypto.gq.nu/mail2.txt
Attached hereto is a documentary representation, which is a true and correct
copy of the relevant web page on my web site.
SEE ATTACHED EXHIBIT E
17. On or about October 30, 1999 I made a post describing an attack
on the disk hash to the Livid project mailing list. The bulk of the
data on a DVD is decrypted using a title key. To ensure that the
DVD is decrypted with the correct title key, a checksum (hash) of the correct
title key is provided on the DVD disk. This attack described a method for
extracting the title key directly from this hash, thus negating the need
for any player keys when viewing a DVD movie. I later posted a copy of
this message on my Web site at http://crypto.gq.nu/mail3.txt Attached
hereto is a documentary representation, which is a true and correct copy
of the relevant web page on my web site.
SEE ATTACHED EXHIBIT F
18. The methods described in the post from October 28 and 30 1999 combined, provides means for deriving a set of 400 player keys using only a purchased DVD movie as source. By virtue of this fact, the mere publication of a valid player key cannot be taken as proof that misappropriation of trade secrets must have occurred.
19. There are a variety of methods that can achieve the cracking of this encryption scheme without ever seeing or agreeing to a Xing license agreement.
20. I have no information suggesting that the anonymous source program contained any trade secrets or in way involved the misappropriation of trade secrets.
21. I have no information suggesting that the "deCSS" program nor the anonymous source were either improperly reverse engineered or were not independently created without the misappropriation of any trade secrets.
22. I believe my actions and any others involved in the research and
development of the DeCSS and css-cat programs were within complete accord
with Norwegian law that expressly permits reverse engineering of computer
software. Attached hereto is a true and correct copy of the relevant
SEE ATTACHED EXHIBIT G
I certify and declare under penalty of perjury under the laws of the State of California, U.S.A. that the foregoing is true and correct.
Frank Andrew Stevenson
Date: January 7, 2000
Please send any questions or comments to firstname.lastname@example.org