API Security and Digital Rights Management
Stub. Two problems about protecting a system through its exposed interface rather than by keeping everything secret: API security (a cryptographic API whose individual operations are safe but whose combination leaks a secret) and digital rights management (enforcing usage restrictions on content the recipient's own device must, contradictorily, be able to decrypt and render).
Both problems share a structure: the defender must expose a legitimate, useful interface to an untrusted or semi-trusted party, and security means constraining what that party can achieve through combinations of otherwise-legitimate calls. API security studies cryptographic hardware APIs (HSMs) where each individual command is safe in isolation but a sequence of commands can be composed to extract a key that should never leave the device. DRM is the same problem inverted: the content owner must give the recipient’s device everything needed to decrypt and play content, while trying to prevent that same device from producing an unrestricted copy — a fundamentally hard (arguably impossible in general) constraint, which is why DRM schemes are perpetually broken and reissued rather than solved once.
Outline (TODO — flesh out each)
- API security — cryptographic hardware APIs (HSMs)
- Attacks that compose otherwise-safe API calls
- Digital rights management — the core tension
- Why DRM schemes are perpetually broken
- Copyright enforcement mechanisms