add Widevine and DRM Glossary

docs/DRM.md

@@ -0,0 +1,75 @@
+# Widevine and DRM Glossary  
+
+This document serves as a resource for understanding Widevine Digital Rights Management (DRM), its ecosystem, and associated terminology. The links and descriptions provided aim to help readers navigate the technical and procedural aspects of Widevine and DRM systems more effectively.  
+
+---
+
+## **Widevine Digital Rights Management (DRM)**  
+Widevine is a leading DRM technology developed by Google, designed to protect video content and ensure secure delivery across a wide range of devices. It supports various security levels, enabling seamless integration with content providers while safeguarding intellectual property.  
+
+---
+
+### **Core Concepts and Terms**  
+
+#### **Certified Widevine Implementation Partner (CWIP)**  
+The [CWIP program](https://support.google.com/widevine/answer/2938263?hl=en) ensures that individuals and organizations are equipped to install, configure, and troubleshoot Widevine DRM systems effectively. Key objectives of this program include:  
+- Teaching candidates to implement Widevine systems with precision.  
+- Enhancing satisfaction for integrators and end-users.  
+- Ensuring trust among content owners.  
+
+#### **Widevine Device Certificate Status List (DCSL)**  
+The [Widevine DCSL](https://developers.google.com/widevine/drm/overview) provides a detailed list of certified devices, including:  
+- **System ID**: A unique identifier for devices using Widevine.  
+- **Security Level**: Defines the degree of hardware-based protection (e.g., L1, L2, or L3).  
+- **Provisioning Method**: How keys and certificates are deployed (e.g., Factory Keybox).  
+- **Device Type**: Identifies whether a device is a phone, set-top box, TV, etc.  
+
+---
+
+### **Key Technical Terms**  
+
+#### **Security Levels (L1, L2, L3)**  
+Widevine security levels determine the degree of protection applied to content playback:  
+- **L1**: Uses Trusted Execution Environment (TEE) for all decryption and processing.  
+- **L2**: Partially relies on the TEE but may use additional secure layers.  
+- **L3**: Relies entirely on software-based protection, typically for devices without TEE.  
+
+#### **Provisioning Methods**  
+The way keys and certificates are securely delivered to devices:  
+- **Factory Keybox**: Embedded during manufacturing to ensure hardware-level security.  
+- **Device Provisioning**: Post-manufacturing certificate injection.  
+
+#### **Content Encryption**  
+Widevine utilizes standardized encryption methods, typically AES (Advanced Encryption Standard), to secure video streams.  
+
+#### **DRM Key Types**  
+- **Content Key**: Used to decrypt protected content.  
+- **License Key**: Issued by the DRM license server to authorize content playback.  
+
+---
+
+### **Security Vulnerabilities and Updates**  
+
+#### **CVE-2024-36971**  
+[Learn More](https://thehackernews.com/2024/08/google-patches-new-android-kernel.html)  
+A critical vulnerability in the Android kernel exploited in the wild. Google released a patch to address this issue, highlighting:  
+- The importance of maintaining up-to-date systems.  
+- Potential risks of targeted attacks using DRM components.  
+
+#### **Patching Processes**  
+Widevine relies on regular updates to mitigate vulnerabilities. This includes:  
+- Firmware updates for device security components.  
+- Collaboration with OEMs to ensure ecosystem-wide fixes.  
+
+---
+
+### **Further Resources**  
+
+- **Widevine Overview**: [Google Developers Documentation](https://developers.google.com/widevine/drm/overview)  
+- **Understanding DRM**: [Wikipedia - Digital Rights Management](https://en.wikipedia.org/wiki/Digital_rights_management)  
+- **Android Security Bulletins**: [Google Security Updates](https://source.android.com/security/bulletin)  
+
+---
+
+### **Conclusion**  
+This glossary aims to centralize essential Widevine and DRM-related terms, helping researchers, integrators, and developers understand the ecosystem. For those working with Widevine or exploring DRM technologies, these resources are foundational to a secure and efficient implementation.