Hackers recently posted claims to have broken the Advanced Access Content System (AACS) copy protection on HD DVD. But another programmer is saying not so fast.

The initial claim was posted on Doom9, a site dedicated to DVD copying. A user named 'muslix64' posted some Java code that he claimed would decrypt the AACS (define) protection and allow for video playback.

Not so fast, said Chris Lanier, a Microsoft (Quote) MVP for Digital Media products. In a blog entry dated the same day as muslix64's posting (December 27), Lanier made two points.

The first is that the software will decrypt a specific DVD only if it has the title key, and title keys are encrypted. Muslix64's software didn't have a way to get the title keys. To get the title key, you need to run PowerDVD video playback software from Cyberlink and do a memory dump, as PowerDVD leaves the title key unencrypted while in memory.

This is rather laborious and requires a fair amount of technical skill. Lanier figured Cyberlink would patch its software so the title key would not remain unencrypted in memory. And unlike when DVD Jon and his crew broke the CSS encryption on DVD, this AACS crack only applies to a single, specific movie title.

Wolfgang Schlichting, optical media analyst for IDC, isn't surprised someone was determined to break the encryption. "This has been another prize to win. We all know what happened to the first one to break CSS. He gained quite a bit of fame in the hacker community, so I'm sure there are a number of people working very hard on this and it wouldn't surprise me at all if they succeed," he told internetnews.com.

But at the same time, he expects the revocation system in AACS to do what it was designed for and protect the overall system. "The damage won't be universal like it was with DeCSS, where the studios threw their hands in the air and said 'oh well, we tried,' " he said.

Bill Hunt, who runs the popular DVD site The Digital Bits, added "It only puts holes in specific discs, not the system. But I'm surprised at how easy it was."

Lanier's second point was that AACS has the ability to revoke compromised keys, unlike CSS. So once CSS was broken in 1999, that was it, all titles were compromised. AACS can revoke a compromised key with future HD DVD releases.

The way keys are revoked is by putting the revocation information on future releases. For instance, if a title key is revoked, the revocation information is stamped onto all future HD DVD releases, every title. When the disc is inserted in a player for the first time, the player's memory is updated with the revocation information. At that point, the compromised title will no longer play.

That's the bigger point, said Schlichting. The problem, if the claims can be borne out, will be contained. "The idea of AACS from the beginning is to have ways to contain the damage. They can revoke the key at any time they want. It should be very straightforward for future devices and titles to revoke the key," he said.