A working implementation of traitor tracing for protected software implementations — Marc Joye and Tancrède Lepoint, Traitor Tracing Schemes for Protected Software Implementations, 11th ACM Workshop on Digital Rights Management (ACM DRM 2011), pp. 15–21 — demonstrated on a game of Snake.
A publisher encrypts premium content once. Every player receives the same
ciphertext, but each player decrypts it differently. The RSA private
exponent d is split into two halves: one half (σ_ID, the product key) is
derived from the player's identity and given to them as text, and the other half
(d_ID) is baked into a personalised copy of the decryption software. Neither
half alone decrypts anything.
The consequence is the interesting part. If a player redistributes their copy of
the software, the publisher can take that copy, feed it each registered player's
σ_ID in turn, and see which one makes it decrypt correctly. That identifies the
leaker — with no watermark, no phone-home, and without ever opening the pirated
copy up. The paper calls this black-box tracing.
$ ./demo.sh
...
TRAITOR IDENTIFIED: alice <alice@example.com> license LIC-0001
- a curses Snake game that unlocks premium levels only with a valid product key
- an authority CLI that generates keys, encrypts content, and enrols players
- an admin dashboard (browser) that traces a seized copy back to its owner
One dependency: cryptography. Everything else — curses, http.server,
sqlite3 — is the Python standard library.
git clone https://github.com/ankamteja/snake-traitor-tracing.git
cd snake-traitor-tracing
pip install -r requirements.txt
./demo.sh # end-to-end story, start here
python3 -m game.main --license dist/licenses/alice # play it
python3 -m dashboard.server # then open http://localhost:8080Written for someone who has not read the paper. Start at the top.
| Document | What it covers |
|---|---|
| docs/01-what-problem-is-this.md | The problem, in plain language, before any maths |
| docs/02-the-paper-explained.md | The paper's scheme, section by section |
| docs/03-how-the-code-works.md | Every module, every function, line by line |
| docs/04-running-the-demo.md | The full walkthrough with expected output |
| docs/05-what-this-does-not-do.md | Honest limits — what the paper assumes and this does not build |
tracing/ the paper itself: key splitting, OAEP, the personalised decoder
authority/ content provider side: key generation, packaging, enrolment
game/ curses Snake, gated on a successful decryption
dashboard/ admin web UI: license registry and the tracing test
tests/ correctness of the splits, the encoding, and the trace
docs/ the explanations linked above
The paper assumes the personalised decoder is protected by software
tamper-resistance and obfuscation, and says so in its own abstract. This
repository does not implement either — d_ID sits in a readable JSON file. It
is a faithful implementation of the scheme, not a shippable DRM product. See
docs/05-what-this-does-not-do.md.
MIT — see LICENSE.