Kudelski and Echostar have recently updated their smart cards in order to thwart piracy. Here is what they did:
1. They introduced two new methods of decrypting the video keys, namely,the $40 MECM method and the $60 MECM method. They now have the ability to use either or both methods. Both of these methods use onboard MAP functions to properly decrypt the video keys. 2. They introduced code that prevents glitching into their cards. Rev109 and Rev245 cards can no longer be unlocked. 3. The latest revisions also have new code that will disable the use of the MAP functions if smart card tampering is detected. This feature is not being used yet, but probably will be very soon.
In order to really appreciate what is going on, you need to understand what a MAP function is. MAP stands for "Modular Arithmetic Processor".The smart card consists of one main CPU and several additional onboard processors that assist the CPU with certain tasks. One of these tasks is cryptography and the MAP processor implements all the encryption routines like DES, RSA, IDEA, SHA, AES, etc. When the main CPU wants to perform a math function like those listed before, it calls the MAP processor, gives it some input and expects some output in return. Without the actual circuit design and source code for the MAP processor,it is impossible to know exactly how each function works. We can't dump the MAP functions because of hardware firwewalls. The best we can do is guess how each function works! Don't laugh! So far, guessing has worked well for us. For example, we dicovered the IDEA and RSA MAP functions which enabled us to decrypt the video keys up until a few weeks ago. How did we do that? Well, we guessed and got lucky! No, seriously, Nagra has a bad habit of implementing well known mathematical functions without making any changes. So we just guess and get lucky. The guesses are based on key lengths, message lengths, etc. But now Nagra has started using MAP functions that aren't so easy to guess. Even if these MAP functions are discovered by luck, they will just introduce new ones. They are doing all this to stop the proliferation of FTA boxes. Make no mistake about it, the proliferation of FTA boxes posed a SERIOUS threat to their business. They had to stop this and they did it by introducing some new MAP functions. In the process they not only took out the FTA boxes but everything else too. Only ROM102/103 cards are working at the moment. But those hacks won't last very long either. Nagra intends to permanently disable those cards not by looping them, but rather, by disabling the fuse bits that allow the MAP functions to work properly. The code to do this is already in place. Things are not looking so good for testers, but they have never looked better for Nagra. Looks like the only thing that will work in the future will be card sharing over the internet or AUX-ed card and emulation. If you don't believe it, well, the Europeans have been down for several months now because of the use of new MAP calls and many have turned to card sharing. Now, I wonder how Kudelski and gang will handle card sharing???
PS. Just for the record, the only reason we ever figured out the MAP calls for the ROM2,3,10,11 cards wasn't because we figured it out at all, it was because Echostar sued NDS for compromising their cards and the court required this information to make a decision. A lot of that information was then leaked to the public.
France is a lead pipe cinch to win the world cup. I'll make them a 4 to 1 favorite over italy. Portugal isn't worthy enough to play france. Take france 5 nothing over portugal and 3 one over italy.