The three remaining watermarks in the Hack SDMI contest weren't all "successfully" broken after all -- or so goes the news that is coming out of the SDMI meetings Wednesday in Washington. Although all three watermarks had hacks that passed the "oracle" test (which examined whether or not the watermark had been removed), according to the official testing committee report sent out today, two of the security systems managed to pass through the listening and repeatability tests unscathed.
In an official statement, SDMI executive director Leonardo Chiariglione offered his thanks to the 447 participants and said, "Each submission -- whether successful or not -- taught us important lessons about what can and cannot work in the marketplace." His release also noted that one of the two non-watermark systems included in the hack SDMI test also passed the challenge.
SDMI is an effort by a consortium of music and computer industry companies to develop a security system for digital music. Since Sept. 15, when SDMI invited hackers to attempt to break its proposed watermarking technology solutions, the security scheme has been under siege.
The latest results are hardly cut-and-dried. According to SDMI documents, the attempt to break the watermark from Verance, one of the participating companies, failed the listening tests -- but only by a 2-to-1 vote (which suggests that one set of "golden ears" found the sound quality of the hacked files to be perfectly adequate). Another watermark, from Blue Spike, did not pass the repeatability tests, which required that the attack be repeated on three different songs; but only because they failed on one or two of three possible tracks, which suggests that the hacks were successfully repeated on at least one song.
And finally, one of the criteria for "success" was that a successful hack had to include supporting technical documentation. It's unclear whether the most prominent group to claim to have hacked the SDMI watermarks -- the researchers from Princeton -- were included in these further tests, since they have not yet submitted their documentation. ("We will soon," says Princeton grad student Scott Craver. "We believe that if there are disputes about the quality of our attacks, they will be resolved after the technical report is out.")
And even Blue Spike, one of the two watermarking companies to offer systems that passed muster, believes that the SDMI tests don't prove that a watermarking system is secure. Says Scott Moskowitz, founder and CEO of Blue Spike, "We are not sure whether the standard by which audibility is being judged is what matters; all the systems that are going to be hacked will be hacked." He posits that a feasible digital watermarking system would have to include a secret cryptographic key -- a system which SDMI officials have decided not to examine.
Meanwhile, the successful systems have to undergo continued testing before the SDMI coalition declares a winner. And members of the consumer electronics and computer industries are expressing some consternation with the results -- especially considering the dearth of representatives from these industries involved in the listening and repeatability tests. "There's skepticism inside my industry, because we weren't involved in these later phases of the testing," says one SDMI participant. "We reserve the right to go back and review these results that are generated without our involvement. We might do that, maybe next month."
Shares