DKDM for 3rd party?

[ale_dc711]

Hi there.
I was asked to deliver an ecnrypted DCP and the DKDM for the distributor to be able to make their own KDMs later.
My question is: I know I can make a DKDM for my own DCPOMATIC, but how can I make a DKDM to other people make their own KDMs in other systems?
I know that if I asked them for their certificate I am able to make a KDM for this certificate and then they could use it to make other KDMs once the DCP is decrypted. But KDMs expires right?
What I understand is that the diference between a KDM and a DKDM is only this: A KDM has a date to expire and a DKDM doesn't. Is that right?
Is there a way to generate a DKDM that doesnt expire to a 3rd party or I just have to generate a KDM that expires in "2099" and give that to the distributor?

[carl]

I know that if I asked them for their certificate I am able to make a KDM for this certificate and then they could use it to make other KDMs once the DCP is decrypted.

That's right: that's how you make a DKDM.

But KDMs expires right?

Sort of. Expiry is enforced by the system reading the KDM. So projection systems will enforce it, but I would have thought most other tools (that accept DKDMs) would not.

I think if you just make a KDM to expire in 2099 you should be fine.

[ale_dc711]

Thank you for your response Carl.
I will do it that way then!

[Carsten]

I think we recently had it that a commercial DCP release in germany suffered from DKDM expiration. Theaters and service companies stored valid encrypted DCPs of the title, but after half a year, the DKDM for the service company expired and they were not able to issue new KDMs for bookings of his DCP. In this case, the DKDM had been issued by the US studio with a very limited timeframe. The german branch of this studio were not able to resolve the issue. At some point, a new DCP had to be mastered/encrypted. So I think DKDMs DO expire. Same as distributors want to limit cinema's options to play the content, the right holders want to limit service company's capabilities to create playout licenses/KDMs.

The only difference is probably - the DCI playout servers are built with heavy hardware security implementations, while the systems to issue KDMs are pure software systems. But they use certificates and chains, so, an original right holder would be free to deny a DKDM for a KDM authoring system that does not enforce DKDM expiration rules.

- Carsten