Cracked TI-OS Keys

This article is under construction and needs to be completed. You can help by expanding it.

September 25, 2009 | By Jennifer Granick
UPDATE: Hey, TI, Leave Those Kids Alone

Graphing calculators have long inspired geeks in remarkable ways. But, sadly, rather than celebrating the hobbyists that love their programmable calculators, Texas Instruments has set the lawyers loose on them, invoking the Digital Millennium Copyright Act (DMCA).

The story is a familiar one: hobbyists started tinkering with their calculators, intent on improving them, much like gearheads have been doing with cars for generations. But TI’s programmable graphing calculators perform a signature check that only allows a signed operating system to be loaded onto the hardware. That didn't stop our intrepid tinkers, however. Researchers used distributed computing to perform a brute-force cryptanalysis of the public keys embedded in each model of calculator to derive the corresponding private keys. (When the keys were discovered, people in the programmer community were excited. Some saw this as the first real world example of "angry mob cryptanalysis," an attack by a bunch of people getting together on the Internet to crack your key.)

With the key, calculator owners can install their own homebrew operating system that unlocks new functionality in the hardware. There's long been a devoted hobbyist community writing OS code and a repository of alternative operating systems on the web. The cracked keys allow for easy and elegant use of this code.

In other words, in the best traditions of tinkers everywhere, these hobbyists took their tools and made them better.

TI’s response has been to target programmers and bloggers with cease and desist letters telling them that the anti-circumvention provisions of the Digital Millennium Copyright Act require them to take down the keys, remove links to forum discussions, and delete blog posts.

The law, however, is not on TI's side. Courts have repeatedly rejected attempts to use the DMCA to control owners’ use of embedded software in the devices they buy.

The DMCA prohibits circumvention of DRM or other technological measures that control access to, or copying of, copyrighted works, as well as distribution of circumvention tools. But owners of TI calculators already have unlimited access to the TI operating system and bootrom code that comes installed on their calculators. They can run the code on their calculators or just download it from the TI website. The software is not encrypted or otherwise locked up (unlike the firmware on Apple's iPhone, which is encrypted, which is why we're seeking a DMCA exemption for iPhone jailbreaking). And that means that the signing key does not "control access" within the meaning of the DMCA. In the words of the court in Lexmark v. Static Controls (where Lexmark tried to use the DMCA to stop refills of laser printer toner cartridges):

Just as one would not say that a lock on the back door of a house "controls access" to a house where the front door does not contain a lock and just as one would not say that a lock on any door of a house "controls access" to the house after a purchaser receives the key to the lock, it does not make sense to say that this provision of the DMCA applies to otherwise-readily-accessible copyrighted works.

And TI's DMCA claim fails for another reason, as well: running software of your choice on your calculator has no "nexus" with copyright infringement. The courts have made it clear (1, 2) that you need a nexus with infringement if you want your DMCA claim to stick. This is not about decrypting copyrighted code so that you can distribute it to the four corners of the Internet. This is about running your own software on your own calculator. So where's the copyright infringement in that?

That's two fatal flaws in TI's DMCA arguments, without even considering the explicit exemption in the statute (Section 1201(f)) for reverse engineering in order to create interoperable software (like homebrew operating systems for your calculator).

It looks like TI is following in the footsteps of Apple, sending baseless legal threats that invoke the DMCA. This strategy could end up alienating the most committed TI customers, and selling fewer calculators.

UPDATE: EFF sent TI a letter October 13th, warning the company not to pursue its baseless legal threats.

(Taken from EFF claim letter)

On or around July 30, 2009, Benjamin Moody announced on the United-TI web forum that he had derived the operating system ("OS") signing key for the TI-83+ calculator. After the announcement, other TI calculator hobbyists successfully derived the private keys for other TI calculator models. TI uses the public/private key pair to perform a signature check on its calculators in an effort to restrict the devices to running only TI-approved operating systems. Hobbyists who develop their own OS software for their TI calculators need to use the same signing key in order to efficiently install and use their custom software. There are many reasons a calculator owner would want to install and run alternate operating systems on their calculators, including to add new functions to the devices., a repository of software for TI calculators, lists three alternative operating systems that run on the TI-83+ calculator alone. See The the best of our clients' knowledge, TI has no copyright or other ownership interest in these alternative operating systems written by hobbyists, nor do these original works infringe on any TI copyrights. news features:

TI DMCA Situation Update — Posted by Michael on 30 October 2009

For Texas Instruments, Calculator Hackers Don't Add Up
After hobbyist cracks key to operating system, TI says: Cease and desist!
By David Kushner / October 2009

28 October 2009—In August, Brandon Wilson, a 25-year-old programmer in Johnson City, Tenn., posted a giddy new blog entry on his personal home page. "83+ OS signing key cracked!" his headline read.

Wilson is a calculator hacker, and for geeks like him, the news was big. The signing key is a security code that, when unlocked, allows hackers to put their own operating systems on a Texas Instruments TI-83 Plus graphing calculator. While most people picture hackers tinkering with PCs or video games, Wilson belongs to an engineering subculture that is less known but equally passionate. Calculator hackers code games and even get USB peripherals running on their machines. "I reached a point where I could understand all there was to understand about this device," says Wilson. "That's a rewarding feeling. You can try to do that on a computer, but you'll never get there."

There's one problem: Texas Instruments doesn't want hackers modifying their calculators. Shortly after Wilson uploaded his post, TI insisted he take down the links from his site leading to the signing key. Wilson reluctantly complied, but the incident raises compelling questions about the boundaries of innovation and collaboration online.

Wilson is among several calculator hackers who have received a cease-and-desist letter from TI for violating the anticircumvention provisions of the Digital Millennium Copyright Act (DMCA). "The TI-83 Plus operating system uses encryption to effectively control access to the operating system code and to protect its rights as a copyright owner in that code," wrote Herbert W. Foster, manager of business services for TI's Education Technology Group, in the letter. "Unauthorized use of these files is strictly prohibited."

On behalf of Wilson and the other hobbyists, the Electronic Frontier Foundation (EFF), a nonprofit advocacy group based in San Francisco, fired back at TI over what it calls "baseless legal threats [that] squash free speech and innovation." Jennifer Stisa Granick, civil liberties director for the EFF, argues that calculator hackers do not violate the DMCA. The DMCA protects a user's right to reverse engineer hardware in order to run homebrew operating systems or other programs. Furthermore, the EFF contends, Texas Instruments makes its software available online, so the release of the signing keys does not contribute to unauthorized distribution.

The importance of the case goes beyond calculator hobbyists and illustrates a rising trend—consumers' desire to customize the many gadgets in their everyday lives. "What we're seeing is a real push on the part of consumers—that they want to open up their devices and have a robust marketplace for code to run on these devices," Granick says. Astrid Smith, a University of Washington student who also received a letter from TI, thinks hacking is a way to improve the performance of the machines. "There's a general consensus in the TI programming community that we've gone about as far as we can if we're going to keep using TIOS," he says [TIOS is what hackers call TI's operating system]. "There are many places in TIOS where the code is simply horrible."