Quote:
root ..............................................A
level 1 ............................B..........................C
level 2 .....................E...........F.............G............H
level 3 (devices) ....d0..d1....d2..d3......d4..d5.....d6..d7
d1 has device keys A-d0, A-F, A-C, B-d0, B-F, E-d0
d6 has device keys A-d7, A-G, A-B, C-d7, C-G, H-d7
(I've added all the keys they would be assigned on this part of the tree)
d0 has device key B-d1, but not C-d6. The first node must be above the device, and the second one not above. C is not above d0 (not on path from d0 to top), so he does not have C-d6.
|
For those interested:
The notation used above (like B-E) refers to a single device key. You can think of the device key as being located at the second node (E node) on one of arnezami's parking garage floors defined by the first node (B-node). A parking garage floor includes the root node for which the floor is named (the B-node) and all nodes on the tree below it (like E and F), but no other nodes. Thus, every device key that starts with a B is on the B floor. The B floor is distinct from the C floor and from the E and F floors. You can't get from one floor to another, even if they are at the same level - you have to start with a DK on the correct floor. There is one and only one device key for every node on every floor, except for the root node on that floor.
If you have a device key (say B-E) located at node E on floor B then you can calculate all the device keys on that floor for all the other nodes on the tree below the DK you have (but not above due to the "one way function" relationship). If you have B-E, then you can calculate B-d0 and B-d1, but not B-F, B-d2 or B-d3. If you have B-d0, you can't figure out B-E or B-d1.
For every device key there is one and only one processing key and you can calculate that associated PK from the DK. Thus, there's one and only one PK for every node on every floor. Since the same node is on lots of floors, each node has lots of DKs and PKs, but only one per floor.
What about the root node on a floor? I said above there is no DK for that node, but I lied.
Take the root node B on the B-floor. The DK for that node would be B-B. What does that DK refer to? It refers to the set of all devices below B minus all devices below B. IOW, it refers to a set of devices with no members. Since there are no devices assigned to that set, no devices get that device key, but it does exist.
If you had the DK for B-B, you could calculate the DK for B-E and B-F, and from those, you could get all the PKs on the B-floor. Guess who has the A-A and B-B and C-C DKs? Yep - it's the AACS LA. If you had the DKs at the root node of each floor, you'd have all the keys and AACS would be broken.