VideoCrypt is without doubt a resilient system. It has been hacked
in the past eighteen months and it has recovered successfully. The
fact that it has been hacked illustrated that it is not pirate proof or
indeed hacker proof.
When the system was launched, some of the public relations
people claimed that it was the most pirate proof system yet devised.
This pirate proof attribute was a myth. A myth is an attempt to explain
a reality with the mental tools available. Therefore since the public
relations people neither understood the abilities of hackers or
security of the system it would be, to them at least, pirate proof.
The philosophy of the VideoCrypt system is that of the Detach;
Secure Processor. The decoder itself is merely a dumb terminal.
detachable secure processor is the smart card. Theoretically
smart card contains the Critical data and the decoder contains not
of significance. This "dumb terminal' idea has been echoed by N
Datacom and Sky executives.
The scrambling technique used in VideoCrypt is line cut and rotate.
The video is digitised and then cut at one of 256 possible points. the
digitised video segments are then rotated about this point and the
digital video is converted back to analogue.
The fact that the cut point is one of 256 points means that it can be
defined as an eight bit word. This byte is supplied by a Pseudo
Random Number Generator. The PRNG is sixty stages long and is
reset approximately every two and a half seconds. The seed is sent in
an encrypted format in the vertical blanking data.
VideoCrypt transmits addressing and access control data in a few
lines of the VBI. The data rate is slower than that of teletext. Each of
the packets of data has a checksum. This checksum is a product of
the active data in the packets.
The checksum is apparently not a standard one. It is, according to
sources, some sort of message digest or hash function. The data is
fed into a routine that generates a fixed length output. This output
block is attached to the data packet. If any of the bits in the data are
changed, the change will be detected. The decoder will run the data
through the same routine. The output block should be the same as
that transmitted with the data packet. If the comparison check fails
then the data has been altered.
Only 585 lines or so in each frame are scrambled. This is to enable
the VBI signals to be checked without descrambling the video. The
reason for this is so that the signal quality can be checked on SMATV
and cablenets without having to descramble the signal. It is a
standard feature on most scrambling systems.
Decoder Architecture
====================
The VideoCrypt stand alone decoder is a hybrid design. It uses
both discrete components and surface mount components. This is
necessary to reduce the size of the board. The board type used in the
early stand alone decoders is SRBP or synthetic resin bonded paper.
It is not the most reliable of board materials but it is one of the
cheapest. It does reject the television manufacturing industry as most
of the boards in television receivers are SRBP.
In the IRD version, the power supply is part of the main receiver
PSU. There are four voltage rails in the decoder: +21V, +12V5, +15V
and +5V. The main part of the circuitry runs off of the +5V0 rail.
The House Keeper microcontroller
================================
The main processor in the descrambler is the 8052 from Intel. This
is a microcontroller and has an on-chip ROM and RAM. There are
also two types of this microcontroller available; the BASIC ROM
version and the Mask programmable version. It is probable that the
version used in the descrambler is the Mask version. This means that
there is an 8K program running the descrambler. The 8052 can be
forced to disgorge the control program.
Many veteran hackers who examined the Sky decoder were
suspicious of the ease with which the 8052 could be forced to
disgorge the control program. By putting a finger across pins on the
ICs, some very strange messages came up on the screen. One of
these was "FALSE CUT POINT". The control program when
disassembled proved to be little more than house keeping with a few
card zap routines.
The incriminating text proved that the ZC404044 was a secure
Microcontroller. There was one other way of getting confirmation -
phone Motorola, the manufacturers of the chip, and ask them about
the IC.
Of course the fact that the program in the 8052 could be read and
examined meant that the whole card to secure processor interface
could be monitored and where necessary the data could be modified.
This has led to the most devastating hack on VideoCrypt - The
KENtucky Fried Chip.
The Secure Processor
====================
The real heart of the Sky decoder is the ZC404044 or in later
versions the ZC404047. The earlier decoders have an eight pin
EEPROM. The later versions incorporate the EEPROM data on the
ZC404047. The control program is held in masked ROM and as such
is very difficult to read. Ordinary attempts to disgorge it failed and
there are rumours that the ICs are being reversed in the Far East.
The Custom Logic
================
TCllOG03AP is custom logic. It handles the control of the video
descrambling circuitry. This is also the most likely area for the PRNG.
On same of the later versions of VideoCrypt decoders this part is
labelled TCE mV-2. The TCE possibly standing for Thomson
Consumer Electronics. This IC also handles the clock generation for
the whole decoder. The IC's clock is derived from a 28 MHz crystal.
The Video Descrambler
=====================
The video section of the VideoCrypt decoder is elegantly simple.
The scrambled video is digitised by a TDA8703 ADC. This turns the
video into a sequence of 8 bit words. The digitised video is then fed to
a set of two FIFO memories. FIFO stands for first in first out. These
ICs are capable of storing 910 8 bit words each.
Each FIFO holds one segment of the line so that reassembling the
video is merely a question of switching between the two FIFOs when
clocking out the data. The descrambled digitised video, with the
segments in the correct order, is fed to a TDA8702 DAC.
The multiplexing and latching is controlled by the custom logic IC.
The analogue video is then fed to the output stage. This stage is a
discrete transistor design. The video signal is clamped and the on
screen graphics are added. The resulting signal is filtered before
being routed to the SCART connector or back into the receiver.
