Basic KDM / DKDM Festival Question

[mrhenderson8]

Hi, I have what is probably a very dumb question but I'm new to this so please bare with me. I work for a production company and a small festival has reached out to screen one of our films. The filmmaker dealt with this all last year so he's told me what to do, but I know the festival had a number of issues with the keys last year, so I just want to confirm the following:

The festival has 3 cinemas that will show the film. He told me to reach out to our key manager Deluxe to request DKDM's, then send 3 DKDM's to each cinema. I thought I should be requesting 3 KDM's from Deluxe for each cinema, as a DKDM isn't something a cinema uses to project a film, but rather a master key used to create KDM's. Basically, does it matter if I request a DKDM or a KDM or are they the same thing?

Thanks!

[carl]

You just need a KDM for each screen that will show the film. If a cinema has more than 1 screen it's a good idea to make KDMs for each, in case there is some confusion or your film is swapped to a different screen at the last minute.

So if Deluxe already knows about/distributes your film, I would just ask them to send KDMs to the 3 cinemas in question.

A DKDM is really the same as a KDM, except that a KDM allows a projection system to decrypt your DCP, whereas as DKDM allows some arbitrary computer system to decrypt it.

The practical difference here is that the projection systems are quite carefully designed to make it difficult, once the DCP is decrypted, to do anything else except play it. So a KDM made for a projection system allows that system to play the DCP (within the time window you specify). You are not really opening yourself up to anything else.

A DKDM (made for a computer, i.e. some software like DCP-o-matic or EasyDCP) also allows decryption of your DCP, but the difference is what the user can do once it's decrypted. They could make a decrypted copy, make their own KDMs, edit your film and make a new version where it plays backwards, whatever they want. So you need to be careful who you give a DKDM to.

Deluxe goes to quite some lengths to make sure that when asked for a KDM they are issuing it for a projection system.

[mrhenderson8]

Thanks very much for the detailed explanation. This is precisely what I was worried about. It also makes sense why Deluxe mentioned we need to seek extra approval to issue DKDM's, but can issue KDM's no problem.

One more question out of curiosity. If a DKDM can open up a DCP to anything but a KDM can only screen the film, why do I keep reading that DKDM's and KDM's are technically identical, but just have different purposes?

[carl]

Right - KDMs are a much more relaxed affair - the only people who are really worried about them are those who don't want you to watch their film (maybe it's not out yet, or maybe they don't think you paid enough for the privilege).

If people seeing your film is welcome, a KDM is not really a problem

[carl]

If a DKDM can open up a DCP to anything but a KDM can only screen the film, why do I keep reading that DKDM's and KDM's are technically identical, but just have different purposes?

It's correct that they are technically identical. I'll try to distill the important bits of a longer explanation.

You have some video and audio in a DCP, and you want to protect them, so you encrypt them with some key, let's call it S. Now if anybody wants to play your video and audio they need to know S.

But you don't really want to give just anybody S, because they can then do what they like with your video and audio.

A KDM solves this problem by taking S and encrypting that. It encrypts S using a system called asymmetric or public/private key encryption. With asymmetric encryption you create two more keys, let's call them P and Q. If I know P, I can encrypt some data with it, and once I've done that only Q can decrypt it (not even P can). This seems counterintuitive/magic, because it sort of is!

So now in your KDM you can have an encrypted S that only Q can decrypt.

The difference between a DKDM and a KDM lies in who knows this key, Q. If I know Q, I can decrypt your KDM to get S, and then use that to decrypt your video and audio.

With a KDM, Q is buried inside an integrated circuit in a projector, so it's very hard to recover. The projector manufacturer created P and Q, kept P (and gave it to Deluxe) and put Q inside the projector where nobody can easily get it. Now Deluxe takes your S, encrypts it with P, and the only key in the world that can decrypt it is buried inside a particular projection system. That system can decrypt your DCP and play it back. And Hollywood/Deluxe etc. all make sure that the only projectors that work with this stuff do not have any way of getting that decrypted video/sound (short of connecting some cables to the cinema sound rack and pointing a camera at the screen, and even then the video is watermarked so they can work out who did it).

With a DKDM, whoever created P and Q still knows Q. DCP-o-matic, for example, creates a P and a Q when you first run it. Then when somebody makes a DKDM they encrypt their S with P, and DCP-o-matic decrypts it again with Q. There's no restrictions on what DCP-o-matic can then do.

[mrhenderson8]

That's very interesting, thanks so much for explaining so clearly! I'll read the longer explanation as well but that makes sense to me now.

[RAY-NUE]

That's very interesting, thanks so much for explaining so clearly! I'll read the longer explanation as well but that makes sense to me now.

Some festivals and film archives often request open DCP files, without the need for KDM, to facilitate screening at any event.