How to detect DRM schemes?

[mickael-menu]

I recently opened a Kotlin PR to detect known DRM schemes (so far only LCP and Adobe ADEPT). It would be useful to create a note on how to detect the various available DRM schemes.

I'm opening this discussion to gather intel and thoughts.

For each DRM scheme, we need:

1. A unique URI identifying it
2. A user-facing name
3. An algorithm to detect it in a file

[mickael-menu]

LCP

• Unique URI: http://readium.org/2014/01/lcp
• Name: Readium LCP
• Detected if any of these conditions are true:
  • An archive containing a /license.lcpl file.
  • An EPUB containing a /META-INF/license.lcpl file OR a /META-INF/encryption.xml file containing at least one element RetrievalMethod with a Type attribute http://readium.org/2014/01/lcp#EncryptedContentKey.

[llemeurfr]

If you find an archive with an encryption.xml containing mention of LCP BUT NO license.lcpl file, this is an encrypted file with no known license. The app won't be able to do anything with it, therefore it should display a message like "Unable to process this LCP encrypted file; the LCP license is missing".

Also, encryption.xml does not contain http://readium.org/2014/01/lcp: as per the spec it contains
<ds:RetrievalMethod URI="license.lcpl#/encryption/content_key" Type="http://readium.org/2014/01/lcp#EncryptedContentKey"/> in the KeyInfo element.

I'm tempted to consider that LCP is detected if license.lcpl is found (in the root of the archive if it is RPF, in META-INF if it is EPUB).

[mickael-menu]

Good point for the encryption.xml, I'll update the rule.

This DRM detection system is only for the case where an app does not support it, so I don't think it's useful to enter into too much details when the license.lcpl is missing. This is the error message that is reported:

For an app supporting LCP, yes the error message should be more accurate when the license.lcpl is missing.

[mickael-menu]

Adobe

• Unique URI: http://ns.adobe.com/adept
• Name: Adobe ADEPT
• Detected if all of these conditions are true:
  • An EPUB containing a /META-INF/encryption.xml file.
  • Any of these conditions is true:
    • There's a /META-INF/rights.xml file with a root node with the XML namespace http://ns.adobe.com/adept
    • The encryption.xml file contains at least one EncryptedData/KeyInfo/resource node with the namespace http://ns.adobe.com/adept.

[qnga]

Looks good to my memory!

[mickael-menu]

Apple

• Name: Apple FairPlay

[mickael-menu]

Kobo

Thoughts?

[mickael-menu]

Google

Thoughts?

[killerpuppytails]

Hey @qnga , could you talk a little about our Axis work?

[qnga]

The issue with AxisNow is that the encryption.xml file doesn't make any sense. They did "Copy/Paste" from LCP, so with the current criterion, LCP would be detected. There's no license.lcpl file though, so if we followed Laurent's temptation, it would work.
As to provide a criterion specific to AxisNow, it's difficult as well. We could only rely on the JSOM schema of license.json file, since there's no identifier inside.

[killerpuppytails]

Also @mickael-menu is this just for EPUB or are we considering audiobooks as well?

[mickael-menu]

@killerpuppytails It's for all kind of publications.

[killerpuppytails]

Thank you! I'll talk to our team about Findaway.