[sdiy] Lockout / DRM chips?

[David Huss]

The technology is not the issue, it is organizing and maintaining the chain of trust. In the online world this is done by CAs (Certificate Authorities) and even they routinely fuck it up. Who has rhe boss key? Whst if they lose it?

The technical issues are all more or less solved, and boil down to the proper application of cryptography and storing the secrets in a way that extraction is hard. Since we live in a physical word there is always a way to read out charges, see the holes in a punch card or whatever. IC manufacturers can try their best to make this as hard as possible, but that is an arms race with the people who break it. But the really complicated issue is how to organize the whole thing and how to even agree on a standard, when it is not something consumers would ever profit from.  

What you propose would require an entirely new interconnection standard, potentially something digital where each message between two systems is cryptographically verified. If that fails for whatever reason your users can't k ow whether it is a broken ca le or a broken signature. This has been attempted in the world of consumer video with HDCP for HDMI and it is an utter nightmare from a user perspective. Their goal is of course to "protect" users from being able to simply connect a HDMI-grabber to a Bluray player and rip the film. In reality it can lead to all kinds of legitimate use-cases failing since most manufacturers suck at implementing that standard. I sometimes joke if I could travel back in time, I would like to prevent the HDMI standard from existing. DRM is a big part of that.  
  
To address your root cause here, I doubt the solution to that problem is technological. Maybe it is legal or social.

Cheers,
atoav/David

On September 9, 2026 8:59:41 PM UTC, Rainer Buchty <rainer at buchty.net> wrote:
>On Wed, 9 Sep 2026, cheater cheater via Synth-diy wrote:
>
>> Has anyone ever worked with such things as lockout or DRM chips?
>
>Yes. We actually design such. But they don't work the way you like them to work -- it's more about putting individual, non-forgeable fingerprints into the chip (aka "physical uncloneable functions", PUFs) so that the vendor then knows which are their chips -- and, by exclusion, knows which ones are illegitimate overproduction hitting the market. The official driver / firmware will then check whether it runs on "true" hardware and refuse to work otherwise. Or using such devices as the root of trust for any subsequent secure-booting / trusted execution environment.
>
>We also do the other way round, i.e., applying methods (both in HW and SW) to check against chips that have been meddled with during fabrication ("hardware trojans") or already during design time (hardware trojans in netlists), essentially by comparing run-time measurements against a known gold master or detecting suspicious "typical" networks of known trojan approaches.
>
>The latter approach could theoretically be applied here, but only if said company would do things so against all standards that you can get a safe identification. After all, you don't want to accidentally shut out one of the others. (In your case, a false positive is way worse than a false negative.)
>
>But what can they do so wrong without breaking their very own function? After all, such detection then can only be done on the level of interfacing -- but, there, line signals are line signals, modulation voltages are modulation voltages, MIDI is MIDI, either classic or USB.
>
>Sure, you could then just bluntly refuse to work with any USB device showing a certain vendor / device ID, but that would be easily enough defeated.
>
>So as much as you dislike said company, there's neither a proper technical way to achieve what you want, nor would I expect that any major player would join such an alliance.
>
>Rainer
>________________________________________________________
>This is the Synth-diy mailing list
>Submit email to: Synth-diy at synth-diy.org
>View archive at: https://synth-diy.org/pipermail/synth-diy/
>Check your settings at: https://synth-diy.org/mailman/listinfo/synth-diy
>Selling or trading? Use marketplace at synth-diy.org