AACS errors on Fedora FC 19 X64

[heretic]

Having the exact same problems here as well. The CFLAGS option isn't causing a segfault for me but it's not working around the problem either. I'd be interested in exactly how it was spear installed the F19 version of openssl and then configured makemkv to use those libs instead. Using --prefix either isn't the right way to do it or that workaround isn't working for me either.

Code: Select all

MakeMKV v1.8.7 linux(x64-release) started
Using direct disc access mode
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED' occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'
Can't read AACS VID from disc - most likely current AACS host certificate is revoked by your drive
Highest AACS version is v1 , MKB saved as /home/<munge>/.MakeMKV/MKB_v1_LOGICAL_VOLUME_ID.tgz
The volume key is unknown for this disc - video can't be decrypted
Failed to open disc

This was while trying to rip The Corpse Bride.

Code: Select all

[root@localhost .MakeMKV]# uname -a
Linux localhost.localdomain 3.12.5-302.fc20.x86_64 #1 SMP Tue Dec 17 20:42:32 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
[root@localhost .MakeMKV]# rpm -q openssl-devel
openssl-devel-1.0.1e-30.fc20.x86_64

[spear]

This is quick-and-dirty, but it worked for me. I pointed to the older version of openssl-libs but I don't think it was needed, just the older include files:

Code: Select all

# extract older openssl files
mkdir -p /path/to/private/openssl
cd /path/to/private/openssl
rpm2cpio /path/to/openssl-devel-1.0.1e-4.fc19.x86_64.rpm | cpio -dumiv
rpm2cpio /path/to/openssl-libs-1.0.1e-4.fc19.x86_64.rpm | cpio -dumiv

# unpack makemkv-oss-1.8.7
cd /path/to
tar xzf /path/to/makemkv-oss-1.8.7.tar.gz
cd /path/to/makemkv-oss-1.8.7
./configure   # I prefer to add --prefix=/usr/local

# edit Makefile
vi Makefile
# append this to CFLAGS:
# -L/path/to/private/openssl/usr/lib64 -I/path/to/private/openssl/usr/include
#
# I also prefer to change LIBDIR to lib64:
# LIBDIR=$(PREFIX)/lib64

make
make install

[nevergonnahappen4me]

I upgraded to F20 just to test this, and can confirm, my earlier suggestion does result in a segmentation fault in F20 (it worked just fine in F19, I promise).

In F20, you can run './configure' as usual, then edit the Makefile, adding ' -DOPENSSL_NO_EC' to the line that starts with 'CFLAGS='. Build and install normally after that.

[tctc1]

Yahoo! That hack works for me with F20 x86_64 and MakeMKV 1.8.7. Thanks!

[miracoolix]

Yes, can also confirm it's working on fc20.

Thanks!

[MartinKG]

now I was also able to create a rpm package that successfully works.

part in the rpm spec file:

Code: Select all

CFLAGS="$RPM_OPT_FLAGS -DOPENSSL_NO_EC"
%configure CPPFLAGS="%{optflags} -I%{_includedir}/ffmpeg"

[hakayova]

...
UPDATE2: Kudos to nevergonnahappen4me for figuring out the bug and workaround. The workaround works for both F19 and F20.

In F20, you can run './configure' as usual, then edit the Makefile, adding ' -DOPENSSL_NO_EC' to the line that starts with 'CFLAGS='. Build and install normally after that.

Thank you for this awesome solution. It did work for me.

[heretic]

Confirmed for me as well. The makefile work-around did the trick for me too. Thanks to spear also for sharing the FC19 work-around.

Now I can get back to ripping all these BDs I bought at the Blockbuster closure sales.

[zeroepoch]

I'd suggest that the configure script detect if EC curves work with the selected openssl library and if not automatically append -DOPENSSL_NO_EC to CFLAGS. This is what the configure script is suppose to do anyways. It detects your system configuration and adjusts to it. If this change was made for future releases then no one would need any hacks.

[belegdol]

I did some checks and found the following: the ec support was added to openssl-1.0.1e-27.fc20, but was then limited to only NIST Suite B in openssl-1.0.1e-28.fc20. -27 works with makemkv, -28 does not.
Which curves are needed by makemkv? With this information I could file a bug asking to have them re-enabled. Hopefully these are not the encumbered ones...

[mike admin]

I did some checks and found the following: the ec support was added to openssl-1.0.1e-27.fc20, but was then limited to only NIST Suite B in openssl-1.0.1e-28.fc20. -27 works with makemkv, -28 does not.
Which curves are needed by makemkv? With this information I could file a bug asking to have them re-enabled. Hopefully these are not the encumbered ones...

This is not because of NIST curves. The openssl in fedora has an unique fips patch. The library can be in two modes - fips and non-fips. Several "insecure" ciphers are always disabled in fips mode. On fedora default is non-fips, and even then application can switch to non-fips mode, in order to use "old" ciphers. Now, the bug - most places where fips check is made, it is made properly - inside #ifdef OPENSSL_FIPS and by calling "is fips enabled" function. However for EC, whoever was making a patch made an unconditional decision: all EC curves smaller than 256 bits are always disabled if OPENSSL_FIPS is #defined. AACS uses 192-bit curves. The patch is fedora-specific and there is no way to detect the condition during configure/compile time. The proper fix is to allow any curve order in non-fips mode. Starting with next version MakeMKV will automatically use its own EC code if compiled on fedora.

[belegdol]

Thank you for the detailed explanation. I have posted this to redhat bugzilla, hopefully 192 bit curves can be enabled.

ETA: I got the answer, turns out it has nothing to do with FIPS - 192 bit curves cannot be enabled for legal reasons. Damn patents...

[mike admin]

Can you please post the link to a bug here - I'm curious.

[belegdol]

https://bugzilla.redhat.com/show_bug.cgi?id=1042715

There is almost nothing specific there, as the legal stuff cannot be discussed in public

[gchen98]

Thanks for the following guys! This worked for me and I am actually running F18, just in case anyone with an older version of Fedora is coming across this problem too.

I upgraded to F20 just to test this, and can confirm, my earlier suggestion does result in a segmentation fault in F20 (it worked just fine in F19, I promise).

In F20, you can run './configure' as usual, then edit the Makefile, adding ' -DOPENSSL_NO_EC' to the line that starts with 'CFLAGS='. Build and install normally after that.