Logic problem in using card ..

Question

hi !!
i have a movie file stored on a cd, but it is in encrypted format (encrypted with symmetric key key1). key1 is stored on the cd also, but encrypted with public key key2. the corresponding private key key3 is stored on the card. there is a function in the card applet, where, if i pass it data encrypted with key2, it decrypts it and returns the decrypted (plain text) data. there is also a java program on the cd, that does the communication with the card, retrieves key1 in decrypted format (after passing the encrypted data to the card), then decrypts the movie file (decrypts on the fly, as and when the user moves forward, rewinds, seeks, etc in the movie file).
each user has a card containing a different key pair, on his/her own card .. (key1 is the same for a particular video).
the reason that key1 is used to encrypt the video file, and not key2, is that using the card to decrypt the entire video would be very slow ..
now, the problem is, that, a rogue user, he can write his own proggie, that takes the encrypted key1 from the cd, passes it to the card, and retrieves key1 in plaintext, and then uses it to decrypt the movie file, and then makes illegal copies of this movie file... while the main puprose of this entire program was to prevent illegal copies of the video files being made ..
there are ways to copy protect cds, but even then, someone can write their own version of a media player that saves the video data somehwere else as and when it is read from the cd ..
so, does anyone have any idea as to what i can do to make this thing more secure ??
thanks :)
muskad202

Answer 1

hi !!
u are saying to use asymmetric encryption .. that is what i am doing .. key2 is the public key and key3 is the private key ... key2 is used for encryption and key3 for decryption .. the private key, (i.e. key3) is stored on the card, and thus the user requires the card for decryption .. (key1 comes into the picture, coz, if i directly used key2 for encryption, then i would need to use key3 for decrypting the entire move .. but key3 is on the card, and passing the entire movie file to the card and waiting for the card to decrypt it would take a lot of time, so, instead ... the movie is encrypted with a key key1 (which is a symmetric key), and this key1 is encrypted with key2 .. so the user just has to pass encrypted-key1 to the card (which will decrypt the passed data using the private key key3) to get key1 back, and then use it to decrypt the movie file
forget key1 for now ... assume the video is encrypted with key2 (i.e. the user's public key), and thus for decryption, he requires the private key (i.e. key3) .. this is what you are saying.. right ???
but, here's the problem .. suppose the user wants to obtain the video in decrypted format so that anyone can view it without requiring the card .. what he can do is, write his own program that reads bytes from the encrypted movie file (which was encrypted using key2), passes it to the card, and, when the card decrypts the data (using the private key stored on it - key3), and then, stores the decrypted data in another file (in my player, i would display the decrypted data on the screen as a video frame, but this guy is instead saving it using his own program so that he can recreate the original video) ..
muskad202