Common Scrambling Algorithm

The Common Scrambling Algorithm (or CSA) is the encryption algorithm used in the DVB digital television broadcasting for encrypting video streams.

CSA was specified by ETSI and adopted by the DVB consortium in May 1994.

History[]

CSA was largely kept secret until 2002. The patent papers gave some hints but important details, like the layout of the so-called S-boxes, remained secret. Without these free implementations of the algorithm were out of question. Initially, CSA was to remain implemented in hardware only, and this would have made it difficult to reverse engineer existing implementations.

In 2002 FreeDec was released, implementing CSA in software. Though released as binary only, disassembly revealed the missing details and allowed reimplementation of the algorithm in higher-level programming languages.

With CSA now publicly known in its entirety, cryptanalysts started looking for weaknesses.

Weaknesses[]

Like other encryption algorithms, a weak spot arises inasmuch that parts of the message are known or at least easily predictable, like MPEG headers. The length of the key is 64 bits, which allows for many different possibilities of encryption. A brute force attack taking 1 μs for each try, through all possible key words, would take around 300,000 years, on average. This can be reduced by using the predictable parts of the encrypted message to rule out potential keys.

While CSA algorithm uses 64-bit keys, in reality only 48 bits of key are unknown, since bytes 3 and 7 are used as checksum bytes, and may be easily recalculated. This fact allows practical space-time tradeoff attack where 32 bits are brute-forced, 16 bits are calculated with memory tables built from ciphertext, and 16 bits calculated as checksum with a running time of O(2¹⁶)+O(2³²), which can be less than a second if implemented in FPGA hardware or on scalable architecture like cell processor.

Theoretical implementation in a FPGA that would consist of 42 hw-threads that each would test 1 key per clock-cycle. At a clock-rate of 50Mhz this would allow the key to be found in ~1 second since we would expect, on average, to find the key after 2³¹ tries for a 2³² key. The problematic part in this would be to determine when a valid key was found since that would involve checking the decrypted data for known things like MPEG-headers which could be hard to implement efficiently enough to fit in a today commercially available FPGA. One possible way to reduce the needed complexity in the FPGA could be to have a multi-layer approach where the first one just discards all keys that are known to be invalid with quite simple checks and one or more that checks for additional information.

Were CSA to be broken, encrypted DVB transmissions would be decipherable, regardless of any proprietary conditional access system used. This could seriously compromise paid digital television services, as DVB has been standardised on for digital terrestrial television in Europe and elsewhere, and is used by many satellite television providers. No attack has yet been published, however.

References[]

• Template:Cite journal

External links[]

• Analysis of the DVB Common Scrambling Algorithm
• libdvbcsa: A free implementation of the DVB Common Scrambling Algorithm
• Improved Cryptanalysis of the Common Scrambling Algorithm Stream Cipher
• ETSI.org DVB CSA systems

Template:Broadcast encryption

de:Common-Scrambling-Algorithmus es:Common Scrambling Algorithm nl:Common Scrambling Algorithm pl:Common Scrambling Algorithm ru:Common Scrambling Algorithm