Charles M. Hannum's Description of the CSS Cipher (original) (raw)
The PAL p[] is defined with the following equations, where a is the lowest input bit and A is the lowest output bit:
!A =3D (a & b) ^ d !B =3D (e & f) ^ g !C =3D (A & B) ^ f !D =3D (A & B) ^ b !E =3D (a & b) ^ c !F =3D (e | f) ^ h !G =3D (E & F) ^ a !H =3D (E | F) ^ e
Given:
- a 40-bit scrambling key expressed as a vector of five 8-bit bytes in k[0:4],
- a DVD sector expressed as a vector of 2^11 (2048) 8-bit bytes in s[0:2047],
- a function r() which reverses the bits in an 8-bit byte,
- two linear feedback shift registers l[] and m[], defined as follows,
- the sum of l[] and m[], called x[],
- an 8-bit PAL p[], defined as follows, and
- the temporary variables k'[], l'[] and m'[], Then:
k'[n] = r(k[n] ^ s[84+n])
l[127] = k'[1] | (1 << 8) | (k'[0] << 9)
m[127] = k'[4] | (k'[3] << 8) | ((k'[2] & 00011111) << 16) | (1 << 21) | ((k'[2] & 11100000) << 17)
x[127] = 0
l'[n] = l[n] ^ (l[n] >> 14)
l[n=128:2047] = (l[n-1] >> 8) ^ (l'[n-1] << 9) ^ (l'[n-1] << 12) ^ (l'[n-1] << 15)
m'[n] = m[n] ^ (m[n] >> 3) ^ (m[n] >> 4) ^ (m[n] >> 12)
m[n=128:2047] = (m[n-1] >> 8) ^ (m'[n-1] << 17)
x[n=128:2047] = !(l[n] >> 9) + (m[n] >> 17) + (x[n-1] >> 8)
The PAL p[] is defined with the following equations, where a is the lowest input bit and A is the lowest output bit:
A = ! (a & b) ^ d
B = ! (e & f) ^ g
C = ! (A & B) ^ f
D = ! (A & B) ^ b
E = ! (a & b) ^ c
F = ! (e | f) ^ h
G = ! (E & F) ^ a
H = ! (E | F) ^ e
And the descrambled sector corresponding to k[] and s[] is:
s'[n=0:127] = s[n]
s'[n=128:2047] = p[s[n]] ^ x[n]