Formal Security Analysis of Widevine through the W3C EME Standard - CentraleSupélec Accéder directement au contenu
Communication Dans Un Congrès Année : 2024

Formal Security Analysis of Widevine through the W3C EME Standard

Résumé

Streaming services such as Netflix, Amazon Prime Video, or Disney+ rely on the widespread EME standard to deliver their content to end users on all major web browsers. While providing an abstraction layer to the underlying DRM protocols of each device, the security of this API has never been formally studied. In this paper, we provide the first formal analysis of Widevine, the most deployed DRM instantiating EME. We define security goals for EME, focusing on media protection and usage control. Then, relying on the TAMARIN prover, we conduct a detailed security analysis of these goals on some Widevine EME implementations, reverse-engineered by us for this study. Our investigation highlights a vulnerability that could allow for unlimited media consumption. Additionally, we present a patched protocol that is suitable for both mobile and desktop platforms, and that we formally proved secure using TAMARIN.
Fichier principal
Vignette du fichier
main.pdf (364.85 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04631369 , version 1 (02-07-2024)

Identifiants

  • HAL Id : hal-04631369 , version 1

Citer

Stéphanie Delaune, Joseph Lallemand, Gwendal Patat, Florian Roudot, Mohamed Sabt. Formal Security Analysis of Widevine through the W3C EME Standard. USENIX Security Symposium, Aug 2024, PHILADELPHIA, United States. ⟨hal-04631369⟩
0 Consultations
0 Téléchargements

Partager

Gmail Mastodon Facebook X LinkedIn More