Looking for an AACS expert to clarify something

[Sayaka]

I decided to experiment a bit with AACS v82 Blu-ray decryption (D.E.B.S. Blu-ray disc - AACS host certificate revoked by the drive), and here were the results :

Non-LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.17.6 : failure (VUK unknown)

Non-LibreDrive-enabled BP55EB40 with KEYDB.cfg without D.E.B.S. inside KEYDB.cfg, MakeMKV 1.17.6 : failure (VUK unknown) (duh !)

Non-LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.18.4 (AACS v82 support) : success

Non-LibreDrive-enabled BP55EB40 with KEYDB.cfg with D.E.B.S. inside KEYDB.cfg, MakeMKV 1.17.6 : MakeMKV struggled but was able to decrypt the disc.

LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.17.6 : failure (VUK unknown)

LibreDrive-enabled BP55EB40 with KEYDB.cfg with D.E.B.S. inside KEYDB.cfg, MakeMKV 1.17.6 : MakeMKV struggled but was able to decrypt the disc.

LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.18.4 (AACS v82 support) : success

I sent my dump file to mike admin just in case, but I would like to be sure as to the explanation for this. The way I see it, there are two possibilities.

1) I was wrong to submit my dump file, MakeMKV already has the hashed key for this disc, I just need to use a version of MakeMKV that supports AACS v82 to be able to use this Hashed Key (unlikely since the Hashed Keys likely contain VUKs, which are famously known as the "Game Over, AACS" decryption keys.)

2) I was right to submit my dump file, MakeMKV does not have the hashed key for this disc, and if MakeMKV "supports" a given AACS version, people will always be able to decrypt a regular Blu-ray disc even with a non-LibreDrive-enabled drive. In that case, I would really like to know more.

Also, since the results were pretty much the same with the "not LibreDrive-enabled" drive and the "LibreDrive-enabled" drive, apparently LibreDrive alone isn't enough to be able to get what's needed to decrypt the disc if MakeMKV doesn't support the AACS version. This, combined with the fact that MakeMKV may be able to decrypt a disc without a Hashed Key as long as the AACS version is supported (even with a "not Libredrive-enabled" drive !), makes me question the usefulness of LibreDrive for regular Blu-rays !

If knowing more is impossible because it's classified information, I still would very much like to know whether I was right to submit my dump file, pretty please. I believe this information could be useful to other Linux users as well.

EDIT : Also, in case anyone cares, the LibreDrive-enabled BP55EB40 is using the Omnidrive 1.02 BU40N 1.00 firmware, I believe.

EDIT 2 : Fixed typo.

[MartyMcNuts]

I decided to experiment a bit with AACS v82 Blu-ray decryption (D.E.B.S. Blu-ray disc - AACS host certificate revoked by the drive), and here were the results :

Non-LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.17.6 : failure (VUK unknown)

Non-LibreDrive-enabled BP55EB40 with KEYDB.cfg without D.E.B.S. inside KEYDB.cfg, MakeMKV 1.17.6 : failure (VUK unknown) (duh !)

Non-LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.18.4 (AACS v82 support) : success

Non-LibreDrive-enabled BP55EB40 with KEYDB.cfg with D.E.B.S. inside KEYDB.cfg, MakeMKV 1.17.6 : MakeMKV struggled but was able to decrypt the disc.

LibreDrive-enabled BP55EB40 with without KEYDB.cfg, MakeMKV 1.17.6 : failure (VUK unknown)

LibreDrive-enabled BP55EB40 with KEYDB.cfg with D.E.B.S. inside KEYDB.cfg, MakeMKV 1.17.6 : MakeMKV struggled but was able to decrypt the disc.

LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.18.4 (AACS v82 support) : success

I sent my dump file to mike admin just in case, but I would like to be sure as to the explanation for this. The way I see it, there are two possibilities.

1) I was wrong to submit my dump file, MakeMKV already has the hashed key for this disc, I just need to use a version of MakeMKV that supports AACS v82 to be able to use this Hashed Key (unlikely since the Hashed Keys likely contain VUKs, which are famously known as the "Game Over, AACS" decryption keys.)

2) I was right to submit my dump file, MakeMKV does not have the hashed key for this disc, and if MakeMKV "supports" a given AACS version, people will always be able to decrypt a regular Blu-ray disc even with a non-LibreDrive-enabled drive. In that case, I would really like to know more.

Also, since the results were pretty much the same with the "not LibreDrive-enabled" drive and the "LibreDrive-enabled" drive, apparently LibreDrive alone isn't enough to be able to get what's needed to decrypt the disc if MakeMKV doesn't support the AACS version. This, combined with the fact that MakeMKV may be able to decrypt a disc without a Hashed Key as long as the AACS version is supported (even with a "not Libredrive-enabled" drive !), makes me question the usefulness of LibreDrive for regular Blu-rays !

If knowing more is impossible because it's classified information, I still would very much like to know whether I was right to submit my dump file, pretty please. I believe this information could be useful to other Linux users as well.

EDIT : Also, in case anyone cares, the LibreDrive-enabled BP55EB40 is using the Omnidrive 1.02 BU40N 1.00 firmware, I believe.

The latest version of MakeMKV supports AACS v82 and can derive the VUK for all standard blu-ray discs and does not create a HK. A HK is only for UHD discs but a HK was previously created for standard blu-ray as a temporary measure before Mike added native support for AACS v82. For MakeMKV purposes, there was no need for your dump file.

All libredrive does is to allow you to continue to use the drive even if the certificate is revoked. It has nothing to do with AACS decryption. If libredrive is not enabled and your certificate is revoked, you won't be able to use the drive to rip discs until you get the next MakeMKV version update. Libredrive is not required (but is very useful) for standard blu-ray but is required for ripping UHD discs.

[Sayaka]

Thank you for your reply, Marty. Much appreciated.

If libredrive is not enabled and your certificate is revoked, you won't be able to use the drive to rip discs until you get the next MakeMKV version update. Libredrive is not required (but is very useful) for standard blu-ray but is required for ripping UHD discs.

I was already aware of the fact that LibreDrive is required to rip UHD discs, but one mystery does remain :

LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.17.6 : failure (VUK unknown)

If LibreDrive does allow me to keep using my drive with a revoked certificate, even without "the next MakeMKV version update", why did 1.17.6 fail with a LibreDrive-enabled drive, if I may ask ? Is that the expected behavior ? Am I supposed to understand instead that if "AACS v83" (or some other version) comes out and I don't have "the next MakeMKV version update", LibreDrive will still allow me to read those v83 discs ?

[MartyMcNuts]

Thank you for your reply, Marty. Much appreciated.

If libredrive is not enabled and your certificate is revoked, you won't be able to use the drive to rip discs until you get the next MakeMKV version update. Libredrive is not required (but is very useful) for standard blu-ray but is required for ripping UHD discs.

I was already aware of the fact that LibreDrive is required to rip UHD discs, but one mystery does remain :

LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.17.6 : failure (VUK unknown)

If LibreDrive does allow me to keep using my drive with a revoked certificate, even without "the next MakeMKV version update", why did 1.17.6 fail with a LibreDrive-enabled drive, if I may ask ? Is that the expected behavior ? Am I supposed to understand instead that if "AACS v83" (or some other version) comes out and I don't have "the next MakeMKV version update", LibreDrive will still allow me to read those v83 discs ?

You are confusing yourself. Libredrive has nothing to do with AACS decryption. The drive certificate has nothing to do with AACS decryption.

"LibreDrive-enabled BP55EB40 without KEYDB.cfg, MakeMKV 1.17.6 : failure (VUK unknown)" This is not a mystery at all. This is the exact expected behaviour because:

1. MakeMKV v1.17.6 cannot natively decrypt AACS v82 discs. You need the latest version for that.
2. You tested a v82 disc on an old version of MakeMKV (without AACS v82 native support) without using the public KeyDB.cfg file.
3. Libredrive is unrelated to #1 and #2.

Therefore, v1.17.6 failed because you tried a v82 disc when that version of MakeMKV does't natively decrypt AACS v82 and you also didn't use the public KeyDB.cfg file. If you had of used the KeyDB.cfg file (and it contains a VUK for your disc), then the disc would have decrypted successfully.

When the next version of AACS (v83 or whatever) comes out, nobody will be able to decrypt them unless the current v82 device key still works. If that device key get's revoked, those new AACS v83 discs won't be decryptable until a new v83 device key is found. Again, Libredrive has absolutely nothing to do with this.

[Sayaka]

I think I got the main idea, so thank you.

(I did read "that one post" on doom9, but I ended up misunderstanding some things, it would seem, so I will probably spend some time studying those AACS specs further before I say anything silly again.)

If you had of used the KeyDB.cfg file (and it contains a VUK for your disc), then the disc would have decrypted successfully.

Which is also what I did (see above), and I can confirm this.

[MartyMcNuts]

I think I got the main idea, so thank you.

(I did read "that one post" on doom9, but I ended up misunderstanding some things, it would seem, so I will probably spend some time studying those AACS specs further before I say anything silly again.)

If you had of used the KeyDB.cfg file (and it contains a VUK for your disc), then the disc would have decrypted successfully.

Which is also what I did (see above), and I can confirm this.

Yes, I read that you also did that.

The point is, if you are using an older version of MakeMKV, for AACS v82 non-UHD discs, you MUST use the public KeyDB.cfg file otherwise you won't be able to decrypt them.

If the KeyDB doesn't contain a VUK for your v82 non-UHD disc, a dump file will be created but don't email it to MakeMKV as it is not needed since the newer version can decrypt the disc natively. You can, however use that dump for the purposes of getting a record added to the Public KeyDB database by making a post in the Public KeyDB Disc Submissions thread.

You could also use SamuraiHL's KeyDB helper tool (on windows) to generate the record for your non-UHD disc and update the KeyDB yourself.

[Sayaka]

Thank you again for your reply, I am currently studying the full AACS specs while taking the time to read everything this time, and I am beginning to realize I really should have done so much earlier.

You could also use SamuraiHL's KeyDB helper tool (on windows) to generate the record for your non-UHD disc and update the KeyDB yourself.

I do this fairly often (or sometimes I also just use FindVUK).

My apologies to mike for submitting a useless dump, but at least I am unlikely to make the same mistake again.