DCP to MP4 extraction

[Maab72]

Hello everybody,
I run a film festivlal in Italy. As many other events, our festival was recently moved on-line because of COVID emergency.

So, I had already received few DCPs for the screenings and I'm extracting the necessary MP4 files for the on-line screening with DCP-o-matic (in the past I used ffmpeg via command line).
However two of these DCPs are KDM protected. So I exported the necessary certificate and I've sent it to the distributor asking for the KDM key.
The distributor answered that this certificate is for DKDM, and he won't provide the DKDM key, but only the KDM key.

So my question is: where do I find the certificate in DCP-o-matic for a KDM (not DKDM) key?
Assuming this can be done, and assuming I'll receive the KDM (no DKDM) key, will I still be able to extract the MP4?

Thanks,
Marcello

[carl]

Hi Marcello,
I'm not quite sure what the distributor means here. It may be that they only want to make KDMs for projection systems, where it's not so easy to decrypt the DCP or make MP4s as it is with DCP-o-matic. Are they happy for you to make MP4s of the DCP in question?
Carl

[Maab72]

Hi Carl, thanks for your quick reply.
Well, I'm not sure if they are happy or not, maybe not, but they have to comply in some way, as the movies have been paid for, and I certainly can't screen DCPs on-line! Also the platform where we will be screening our festival offer anti-download protection.

Anyway, yes that's the point: they only want to release KDMs for projection systems. Do you think it's possible with DCP-o-matic to have a certificate for a "projection-only" KDM?

Marcello

[carl]

I'm not quite sure what a "projection-only" KDM would do. The KDM system is designed to prevent pretty much exactly what you are doing - making an unencrypted version of an encrypted DCP.

You could put things in DCP-o-matic to prevent certain uses of KDMs, but they would be easy to bypass - once you have a KDM that you have the private key for you can decrypt the content.

The only reason this works for projectors is that the private key is secret (hidden inside the projector) so only the projector can decrypt the KDM and hence the content.

I think if you are going to decrypt this distributor's content you will probably need to establish trust with them so that they send you the KDM that you asked for in the first place. Alternatively, they might be happier sending your MP4 copies of their films, since then they are not giving you access to the less-compressed DCP version.

[Maab72]

OK, thanks.
I'll insist for the DKDM or (even better) the MP4 file.

Marcello

[carl]

Great. If they are concerned about sending the DKDM, perhaps it might be worth asking them what they are worried about. Feel free to give them my email carl@dcpomatic.com if there's anything I can help to explain (albeit only in English, I'm afraid!)