![Fingercasting–Joint Fingerprinting and
Decryption of Broadcast Messages
André Adelsbach, Ulrich Huber, and Ahmad-Reza Sadeghi
Horst Görtz Institute for IT Security
Ruhr-Universität Bochum
Universitätsstraße 150
D-44780 Bochum
Germany
andre.adelsbach@nds.rub.de, {huber,sadeghi}@crypto.rub.de
Abstract. We propose a stream cipher that provides confidentiality,
traceability and renewability in the context of broadcast encryption as-
suming that collusion-resistant watermarks exist. We prove it to be as
secure as the generic pseudo-random sequence on which it operates. This
encryption approach, termed fingercasting, achieves joint decryption and
fingerprinting of broadcast messages in such a way that an adversary
cannot separate both operations or prevent them from happening simul-
taneously. The scheme is a combination of a known broadcast encryption
scheme, a well-known class of fingerprinting schemes and an encryption
scheme inspired by the Chameleon cipher. It is the first to provide a for-
mal security proof and a non-constant lower bound for resistance against
collusion of malicious users, i.e., a minimum number of content copies
needed to remove all fingerprints. To achieve traceability, the scheme
fingerprints the receivers’ key tables such that they embed a fingerprint
into the content during decryption. The scheme is efficient and includes
parameters that allow, for example, to trade-off storage size for compu-
tation cost at the receiving end.
Keywords: Chameleon encryption, stream cipher, spread-spectrum wa-
termarking, fingerprinting, collusion resistance, frame-proofness, broad-
cast encryption.
1 Introduction
Experience shows that adversaries attack Broadcast Encryption (BE) systems
in a variety of different ways. Their attacks may be on the hardware that stores
cryptographic keys, e.g., when they extract keys from a compliant device to
develop a pirate device such as the DeCSS software that circumvents the Content
Scrambling System [2]. Alternatively, their attacks may be on the decrypted
content, e.g., when a legitimate user shares decrypted content with illegitimate
users on a file sharing system such as Napster, Kazaa, and BitTorrent.
An extended abstract of this paper appeared in the Proceedings of the Tenth Aus-
tralasian Conference on Information Security and Privacy (ACISP 2006) [1].
Y.Q. Shi (Eds.): Transactions on DHMS II, LNCS 4499, pp. 1–34, 2007.
c
Springer-Verlag Berlin Heidelberg 2007](https://image.slidesharecdn.com/613796-250715020418-790cfe0c/85/Transactions-On-Data-Hiding-And-Multimedia-Security-Ii-1st-Edition-Andr-Adelsbach-12-320.jpg)
![2 A. Adelsbach, U. Huber, and A.-R. Sadeghi
The broadcasting sender thus has three security requirements: confidentiality,
traceability of content and keys, and renewability of the encryption scheme. The
requirements cover two aspects. Confidentiality tries to prevent illegal copies in
the first place, whereas traceability is a second line of defense aimed at finding
the origin of an illegal copy (content or key). The need for traceability originates
from the fact that confidentiality may be compromised in rare cases, e.g., when
a few users illegally distribute their secret keys. Renewability ensures that after
such rare events, the encryption system can recover from the security breach.
In broadcasting systems deployed today, e.g., Content Protection for Pre-
Recorded Media [3] or the Advanced Access Content System [4], confidential-
ity and renewability often rely on BE because it provides short ciphertexts
while at the same time having realistic storage requirements in devices and
acceptable computational overhead. Traitor tracing enables traceability of keys,
whereas fingerprinting provides traceability of content. Finally, renewability may
be achieved using revocation of the leaked keys.
However, none of the mentioned cryptographic schemes covers all three secu-
rity requirements. Some existing BE schemes lack traceability of keys, whereas
no practically relevant scheme provides traceability of content [5,6,7,8]. Traitor
tracing only provides traceability of keys, but not of content [9,10]. Fingerprint-
ing schemes alone do not provide confidentiality [11]. The original Chameleon
cipher provides confidentiality, traceability and a hint on renewability, but with
a small constant bound for collusion resistance and, most importantly, without
formal proof of security [12]. Asymmetric schemes, which provide each compli-
ant device with a certificate and accompany content with Certificate Revocation
Lists (CRLs), lack traceability of content and may reach the limits of renewabil-
ity when CRLs become too large to be processed by real-world devices. Finally,
a trivial combination of fingerprinting and encryption leads to an unacceptable
transmission overhead because the broadcasting sender needs to sequentially
transmit each fingerprinted copy.
Our Contribution. We present, to the best of our knowledge, the first rigorous
security proof of Chameleon ciphers, thus providing a sound foundation for the
recent applications of these ciphers, e.g., [13]. Furthermore, we give an explicit
criterion to judge the security of the Chameleon cipher’s key table. Our finger-
casting approach fulfills all three security requirements at the same time. It is a
combination of (i) a new Chameleon cipher based on the fingerprinting capabili-
ties of a well-known class of watermarking schemes and (ii) an arbitrary broadcast
encryption scheme, which explains the name of the approach. The basic idea is to
use the Chameleon cipher for combining decryption and fingerprinting. To achieve
renewability, we use a BE scheme to provide fresh session keys as input to the
Chameleon scheme. To achieve traceability, we fingerprint the receivers’ key ta-
bles such that they embed a fingerprint into the content during decryption. To
enable higher collusion resistance than the original Chameleon scheme, we tai-
lor our scheme to emulate any watermarking scheme whose coefficients follow a](https://image.slidesharecdn.com/613796-250715020418-790cfe0c/85/Transactions-On-Data-Hiding-And-Multimedia-Security-Ii-1st-Edition-Andr-Adelsbach-13-320.jpg)
![Fingercasting–Joint Fingerprinting and Decryption of Broadcast Messages 3
probability distribution that can be disaggregated into additive components.1
As
proof of concept, we instantiate the watermarking scheme with Spread Spectrum
Watermarking (SSW), which has proven collusion resistance [14,15]. However, we
might as well instantiate it with any other such scheme.
Joint decryption and fingerprinting has significant advantages compared to ex-
isting methods such as transmitter-side or receiver-side Fingerprint Embedding
(FE) [11]. Transmitter-side FE is the trivial combination of fingerprinting and
encryption by the sender. As discussed above, the transmission overhead is in the
order of the number of copies to be distributed, which is prohibitive in practical
applications. Receiver-side FE happens in the user’s receiver; after distribution
of a single encrypted copy of the content, a secure receiver based on tamper-
resistant hardware is trusted to embed the fingerprint after decryption. This
saves bandwidth on the broadcast channel. However, perfect tamper-resistance
cannot be achieved under realistic assumptions [16]. An adversary may succeed
in extracting the keys of a receiver and subsequently decrypt without embedding
a fingerprint.
Our fingercasting approach combines the advantages of both methods. It saves
bandwidth by broadcasting a single encrypted copy of the content. In addition, it
ensures embedding of a fingerprint even if a malicious user succeeds in extracting
the decryption keys of a receiver. Furthermore, as long as the number of colluding
users remains below a threshold, the colluders can only create decryption keys
and content copies that incriminate at least one of them.
This paper enhances our extended abstract [1] in the following aspects. First,
the extended abstract does not contain the security proof, which is the ma-
jor contribution. Second, we show here that our instantiation of SSW is exact,
whereas the extended abstract only claims this result. Last, we discuss here the
trade-off between storage size and computation cost at the receiving end.
2 Related Work
The original Chameleon cipher of Anderson and Manifavas is 3-collusion-resist-
ant [12]: A collusion of up to 3 malicious users has a negligible chance of creating
a good copy that does not incriminate them. Each legitimate user knows the
seed of a Pseudo-Random Sequence (PRS) and a long table filled with random
keywords. Based on the sender’s master table, each receiver obtains a slightly
different table copy, where individual bits in the keywords are modified in a
characteristic way. Interpreting the PRS as a sequence of addresses in the table,
the sender adds the corresponding keywords in the master table bitwise modulo
2 in order to mask the plaintext word. The receiver applies the same operation
to the ciphertext using its table copy, thus embedding the fingerprint.
The original cipher, however, has some inconveniences. Most importantly, it
has no formal security analysis and bounds the collusion resistance by the con-
stant number 3, whereas our scheme allows to choose this bound depending on
the number of available watermark coefficients. In addition, the original scheme
1
Our scheme does not yet support fingerprints based on coding theory.](https://image.slidesharecdn.com/613796-250715020418-790cfe0c/85/Transactions-On-Data-Hiding-And-Multimedia-Security-Ii-1st-Edition-Andr-Adelsbach-14-320.jpg)
![4 A. Adelsbach, U. Huber, and A.-R. Sadeghi
limits the content space (and keywords) to strings with characteristic bit po-
sitions that may be modified without visibly altering the content. In contrast,
our scheme uses algebraic operations in a group of large order, which enables
modification of any bit in the keyword and processing of arbitrary documents.
Chameleon was inspired by work from Maurer [17,18]. His cipher achieves
information-theoretical security in the bounded storage model with high prob-
ability. In contrast, Chameleon and our proposed scheme only achieve compu-
tational security. The reason is that the master table length in Maurer’s cipher
is super-polynomial. As any adversary would need to store most of the table
to validate guesses, the bounded storage capacity defeats all attacks with high
probability. However, Maurer’s cipher was never intended to provide traceability
of content or renewability, but only confidentiality.
Ferguson et al. discovered security weaknesses in a randomized stream cipher
similar to Chameleon [19]. However, their attack only works for linear sequences
of keywords in the master table, not for the PRSs of our proposed solution.
Ergun, Kilian, and Kumar prove that an averaging attack with additional
Gaussian noise defeats any watermarking scheme [20]. Their bound on the min-
imum number of different content copies needed for the attack asymptotically
coincides with the bound on the maximum number of different content copies to
which the watermarking scheme of Kilian et al. is collusion-resistant [15]. As we
can emulate [15] with our fingercasting approach, its collusion resistance is—at
least asymptotically—the best we can hope for.
Recently there was a great deal of interest in joint fingerprinting and de-
cryption [13,21,22,11,23]. Basically, we can distinguish three strands of work.
The first strand of work applies Chameleon in different application settings.
Briscoe et al. introduce Nark, which is an application of the original Chameleon
scheme in the context of Internet multicast [13]. However, in contrast to our
new Chameleon cipher they neither enhance Chameleon nor analyze its security.
The second strand of work tries to achieve joint fingerprinting and decryption
by either trusting network nodes to embed fingerprints (Watercasting in [21]) or
doubling the size of the ciphertext by sending differently fingerprinted packets
of content [22]. Our proposed solution neither relies on trusted network nodes
nor increases the ciphertext size. The third strand of work proposes new joint
fingerprinting and decryption processes, but at the price of replacing encryption
with scrambling, which does not achieve indistinguishability of ciphertext and
has security concerns [11,23]. In contrast, our new Chameleon cipher achieves
indistinguishability of ciphertext.
3 Preliminaries
3.1 Notation
We recall some standard notations that will be used throughout the paper. First,
we denote scalar objects with lower-case variables, e.g., o1, and object tuples as](https://image.slidesharecdn.com/613796-250715020418-790cfe0c/85/Transactions-On-Data-Hiding-And-Multimedia-Security-Ii-1st-Edition-Andr-Adelsbach-15-320.jpg)
![Fingercasting–Joint Fingerprinting and Decryption of Broadcast Messages 5
well as roles with upper-case variables, e.g., X1. When we summarize objects
or roles in set notation, we use an upper-case calligraphic variable, e.g., O :=
{o1, o2, . . .} or X := {X1, X2, . . .}. Second, let A be an algorithm. By y ← A(x)
we denote that y was obtained by running A on input x. If A is deterministic,
then y is a variable with a unique value. Conversely, if A is probabilistic, then y is
a random variable. For example, by y ← N(μ, σ) we denote that y was obtained
by selecting it at random with normal distribution, where μ is the mean and
σ the standard deviation. Third, o1
R
←O and o2
R
←[0, z] denote the selection of a
random element of the set O and the interval [0, z] with uniform distribution.
Finally, V · W denotes the dot product of two vectors V := (v1, . . . , vn ) and
W := (w1, . . . , wn ), which is defined as V ·W :=
n
j=1 vj wj , while ||V || denotes
the Euclidean norm ||V || :=
√
V · V .
3.2 Roles and Objects in Our System Model
The (broadcast) center manages the broadcast channel, distributes decryption
keys and is fully trusted. The users obtain the content via devices that we refer to
as receivers. For example, a receiver may be a set-top box in the context of pay-
TV or a DVD player in movie distribution. We denote the number of receivers
with N ; the set of receivers is U := {ui | 1 ≤ i ≤ N }. When a receiver violates
the terms and conditions of the application, e.g., leaks its keys or shares content,
the center revokes the receiver’s keys and thus makes them useless for decryption
purposes. We denote the set of revoked receivers with R := {r1, r2, . . .} ⊂ U.
We represent broadcast content as a sequence M := (m1, . . . , mn) of real
numbers in [0, z], where M is an element of the content space M.2
For example,
these numbers may be the n most significant coefficients of the Discrete Cosine
Transform (DCT) as described in [14]. However, they should not be thought
of as a literal description of the underlying content, but as a representation of
the values that are to be changed by the watermarking process [20]. We refer to
these values as significant and to the remainder as insignificant. In the remainder
of this paper, we only refer to the significant part of the content, but briefly
comment on the insignificant part in Section 5.
3.3 Cryptographic Building Blocks
Negligible Function. A negligible function f : N → R is a function where the
inverse of any polynomial is asymptotically an upper bound:
∀k 0 ∃λ0 ∀λ λ0 : f(λ) 1/λk
Probabilistic Polynomial Time. A probabilistic polynomial-time algorithm
is an algorithm for which there exists a polynomial poly such that for every input
x ∈ {0, 1}∗
the algorithm always halts after poly(|x|) steps, independently of the
outcome of its internal coin tosses.
2
Although this representation mainly applies to images, we discuss an extension to
movies and songs in Section 5.](https://image.slidesharecdn.com/613796-250715020418-790cfe0c/85/Transactions-On-Data-Hiding-And-Multimedia-Security-Ii-1st-Edition-Andr-Adelsbach-16-320.jpg)
![6 A. Adelsbach, U. Huber, and A.-R. Sadeghi
Pseudo-Random Sequence (PRS). We first define the notion of pseudo-
randomness and then proceed to define a Pseudo-Random Sequence Generator
(PRSG). For further details we refer to [24, Section 3.3.1]:
Definition 1 (Pseudo-randomness). Let len : N → N be a polynomial such
that len(λ) λ for all λ ∈ N and let Ulen(λ) be a random variable uniformly dis-
tributed over the strings {0, 1}len(λ)
of length len(λ). Then the random variable X
with |X | = len(λ) is called pseudo-random if for every probabilistic polynomial-
time distinguisher D, the advantage Adv (λ) is a negligible function:
Adv (λ) :=
Pr [D(X ) = 1] − Pr
D(Ulen(λ)) = 1
Definition 2 (Pseudo-Random Sequence Generator). A PRSG is a de-
terministic polynomial-time algorithm G that satisfies two requirements:
1. Expansion: There exists a polynomial len : N → N such that len(λ) λ for
all λ ∈ N and |G(str)| = len(|str|) for all str ∈ {0, 1}∗
.
2. Pseudo-randomness: The random variable G(Uλ) is pseudo-random.
A PRS is a sequence G(str) derived from a uniformly distributed random seed
str using a PRSG.
Chameleon Encryption. To set up a Chameleon scheme CE := (KeyGenCE,
KeyExtrCE, EncCE, DecCE, DetectCE), the center generates the secret master ta-
ble MT, the secret table fingerprints TF := (TF(1)
, . . . , TF(N)
), and selects a
threshold t using the key generation algorithm (MT, TF, t) ← KeyGenCE(N , 1λ
,
parCE), where N is the number of receivers, λ
a security parameter, and parCE a
set of performance parameters. To add receiver ui to the system, the center uses
the key extraction algorithm RT(i)
← KeyExtrCE(MT, TF, i) to deliver the se-
cret receiver table RT(i)
to ui. To encrypt content M exclusively for the receivers
in possession of a receiver table RT(i)
and a fresh session key ksess
, the center
uses the encryption algorithm C ← EncCE(MT, ksess
, M ), where the output is
the ciphertext C. Only a receiver ui in possession of RT(i)
and ksess
is capable
of decrypting C and obtaining a fingerprinted copy M (i)
of content M using the
decryption algorithm M (i)
← DecCE(RT(i)
, ksess
, C).
When the center discovers an illegal copy M ∗
of content M , it executes
DetectCE, which uses the fingerprint detection algorithm DetectFP of the un-
derlying fingerprinting scheme to detect whether RT(i)
left traces in M ∗
. For
further details on our notation of a Chameleon scheme, we refer to Appendix C.
Fingerprinting. To set up a fingerprinting scheme, the center generates the
secret content fingerprints CF := (CF(1)
, . . . , CF(N)
) and the secret similarity
threshold t using the setup algorithm (CF, t) ← SetupFP(N , n
, parFP), where
N is the number of receivers, n
the number of content coefficients, and parFP
a set of performance parameters. To embed the content fingerprint CF(i)
:=
(cf (i)
1 , . . . , cf (i)
n ) of receiver ui into the original content M , the center uses the
embedding algorithm M (i)
← EmbedFP(M , CF(i)
). To verify whether an illegal
copy M ∗
of content M contains traces of the content fingerprint CF(i)
of receiver](https://image.slidesharecdn.com/613796-250715020418-790cfe0c/85/Transactions-On-Data-Hiding-And-Multimedia-Security-Ii-1st-Edition-Andr-Adelsbach-17-320.jpg)
![Transcriber's Note: Although most printer's errors have been
retained, some have been silently corrected. Some spelling
and punctuation, capitalization, accents and formatting
markup have been normalized and include the following:
Page 88 peek is now peak [peak in the masonry]
Page 213 the word as was written twice, [reflecting upon him
as as]
Page 241 the double quotation mark has been replaced by a
single quote to match the opening quote. [I saw you last—in
July, was it not?]](https://image.slidesharecdn.com/613796-250715020418-790cfe0c/85/Transactions-On-Data-Hiding-And-Multimedia-Security-Ii-1st-Edition-Andr-Adelsbach-33-320.jpg)
Transactions On Data Hiding And Multimedia Security Ii 1st Edition Andr Adelsbach
- 1. Transactions On Data Hiding And Multimedia Security Ii 1st Edition Andr Adelsbach download https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-ii-1st-edition-andr-adelsbach-1227592 Explore and download more ebooks at ebookbell.com
- 2. Here are some recommended products that we believe you will be interested in. You can click the link to download. Transactions On Data Hiding And Multimedia Security Iii 1st Edition Jrgen Bierbrauer https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-iii-1st-edition-jrgen-bierbrauer-4240488 Transactions On Data Hiding And Multimedia Security Vi 1st Edition Patchara Sutthiwan https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-vi-1st-edition-patchara-sutthiwan-2455908 Transactions On Data Hiding And Multimedia Security Iv 1st Edition Angela Piper https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-iv-1st-edition-angela-piper-4143752 Transactions On Data Hiding And Multimedia Security V 1st Edition Moussadek Laadjel https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-v-1st-edition-moussadek-laadjel-4143754
- 3. Transactions On Data Hiding And Multimedia Security Vii 1st Edition Peter Meerwald https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-vii-1st-edition-peter-meerwald-4143756 Transactions On Data Hiding And Multimedia Security Viii Special Issue On Pattern Recognition For It Security 1st Edition Hisham Alassam https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-viii-special-issue-on-pattern-recognition-for-it- security-1st-edition-hisham-alassam-4143758 Transactions On Data Hiding And Multimedia Security Ix Special Issue On Visual Cryptography 1st Edition Yun Q Shi https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-ix-special-issue-on-visual-cryptography-1st- edition-yun-q-shi-4664714 Transactions On Data Hiding And Multimedia Security X 1st Edition Yun Q Shi Eds https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-x-1st-edition-yun-q-shi-eds-5056546 Transactions On Data Hiding And Multimedia Security Iv 1st Edition Angela Piper https://ebookbell.com/product/transactions-on-data-hiding-and- multimedia-security-iv-1st-edition-angela-piper-1370792
- 5. Lecture Notes in Computer Science 4499 Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen University of Dortmund, Germany Madhu Sudan Massachusetts Institute of Technology, MA, USA Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Moshe Y. Vardi Rice University, Houston, TX, USA Gerhard Weikum Max-Planck Institute of Computer Science, Saarbruecken, Germany
- 6. Yun Q. Shi (Ed.) Transactions on Data Hiding and MultimediaSecurityII 1 3
- 7. Volume Editor Yun Q. Shi New Jersey Institute of Technology Department of Electrical and Computer Engineering 323, M.L. King Blvd., Newark, NJ 07102, USA E-mail: shi@njit.edu Library of Congress Control Number: 2007928444 CR Subject Classification (1998): K.4.1, K.6.5, H.5.1, D.4.6, E.3, E.4, F.2.2, H.3, I.4 LNCS Sublibrary: SL 4 – Security and Cryptology ISSN 0302-9743 (Lecture Notes in Computer Science) ISSN 1864-3043 (Transactions on Data Hiding and Multimedia Security) ISBN-10 3-540-73091-5 Springer Berlin Heidelberg New York ISBN-13 978-3-540-73091-0 Springer Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. Springer is a part of Springer Science+Business Media springer.com © Springer-Verlag Berlin Heidelberg 2007 Printed in Germany Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper SPIN: 12077731 06/3180 5 4 3 2 1 0
- 8. Preface In this volume we present the second issue of the LNCS Transactions on Data Hiding and Multimedia Security. In the first paper, Adelsbach et al. introduce fingercasting, a combination of broadcast encryption and fingerprinting for secure content distribution. They also provide for the first time a security proof for a lookup table-based encryp- tion scheme. In the second paper, He and Kirovski propose an estimation attack on content-based video fingerprinting schemes. Although the authors tailor the attack towards a specific video fingerprint, the generic form of the attack is ex- pected to be applicable to a wide range of video watermarking schemes. In the third paper, Ye et al. present a new feature distance measure for error-resilient image authentication, which allows one to differentiate maliciousimage manipu- lations from changes that do not interfere with the semantics of an image. In the fourth paper, Luo et al. present a steganalytic technique against steganographic embedding methods utilizing the two least significant bit planes. Experimental results demonstrate that this steganalysis method can reliably detect embedded messages and estimate their length with high precision. Finally, Alface and Macq present a comprehensive survey on blind and robust 3-D shape watermarking. We hope that this issue is of great interest to the research community and will trigger new research in the field of data hiding and multimedia security. Finally, we want to thank all the authors, reviewers and editors who devoted their valuable time to the success of this second issue. Special thanks go to Springer and Alfred Hofmann for their continuous support. March 2007 Yun Q. Shi (Editor-in-Chief) Hyoung-Joong Kim (Vice Editor-in-Chief) Stefan Katzenbeisser (Vice Editor-in-Chief)
- 9. LNCS Transactions on Data Hiding and Multimedia Security Editorial Board Editor-in-Chief Yun Q. Shi New Jersey Institute of Technology, Newark, NJ, USA shi@njit.edu Vice Editors-in-Chief Hyoung-Joong Kim Korea University, Seoul, Korea khj-@korea.ac.kr Stefan Katzenbeisser Philips Research Europe, Eindhoven, Netherlands stefan.katzenbeisser@philips.com Associate Editors Mauro Barni University of Siena, Siena, Italy barni@dii.unisi.it Jeffrey Bloom Thomson, Princeton, NJ, USA Jeffrey.Bloom@thomson.net Jana Dittmann Otto-von-Guericke-University Magdeburg, Magdeburg,Germany jana.dittmann@iti.cs.uni-magdeburg.de Jiwu Huang Sun Yat-sen University, Guangzhou, China isshjw@mail.sysu.edu.cn Mohan Kankanhalli National University of Singapore, Singapore mohan@comp.nus.edu.sg Darko Kirovski Microsoft, Redmond, WA, USA darkok@microsoft.com C. C. Jay Kuo University of Southern California, Los Angeles, USA cckuo@sipi.usc.edu Heung-Kyu Lee Korea Advanced Institute of Science and Technology, Daejeon, Korea hklee@mmc.kaist.ac.kr Benoit Macq Catholic University of Louvain, Belgium macq@tele.ucl.ac.be Nasir Memon Polytechnic University, Brooklyn, NY, USA memon@poly.edu Kivanc Mihcak Bogazici University, Istanbul, Turkey kivanc.mihcak@boun.edu.tr
- 10. VIII Editorial Board Hideki Noda Kyushu Institute of Technology, Iizuka, Japan noda@mip.ces.kyutech.ac.jp Jeng-Shyang Pan National Kaohsiung University of Applied Sciences, Kaohsiung, Taiwan jspan@cc.kuas.edu.tw Fernando Perez-Gonzalez University of Vigo, Vigo, Spain fperez@gts.tsc.uvigo.es Andreas Pfitzmann Dresden University of Technology, Germany pfitza@inf.tu-dresden.de Alessandro Piva University of Florence, Florence, Italy piva@lci.det.unifi.it Yong-Man Ro Information and Communications University, Daejeon, Korea yro@icu.ac.kr Ahmad-Reza Sadeghi Ruhr-University, Bochum, Germany sadeghi@crypto.rub.de Kouichi Sakurai Kyushu University, Fukuoka, Japan sakurai@csce.kyushu-u.ac.jp Qibin Sun Institute of Infocomm Research, Singapore qibin@i2r.a-satr.edu.sg Edward Wong Polytechnic University, Brooklyn, NY, USA wong@poly.edu Advisory Board Pil Joong Lee Pohang University of Science and Technology, Pohang, Korea pjl@postech.ac.kr Bede Liu Princeton University, Princeton, NJ, USA liu@ee.princeton.edu
- 11. Table of Contents Fingercasting–Joint Fingerprinting and Decryption of Broadcast Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 André Adelsbach, Ulrich Huber, and Ahmad-Reza Sadeghi An Estimation Attack on Content-Based Video Fingerprinting . . . . . . . . . 35 Shan He and Darko Kirovski Statistics- and Spatiality-Based Feature Distance Measure for Error Resilient Image Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Shuiming Ye, Qibin Sun, and Ee-Chien Chang LTSB Steganalysis Based on Quartic Equation. . . . . . . . . . . . . . . . . . . . . . . 68 Xiangyang Luo, Chunfang Yang, Daoshun Wang, and Fenlin Liu From 3D Mesh Data Hiding to 3D Shape Blind and Robust Watermarking: A Survey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Patrice Rondao Alface and Benoit Macq Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
- 12. Fingercasting–Joint Fingerprinting and Decryption of Broadcast Messages André Adelsbach, Ulrich Huber, and Ahmad-Reza Sadeghi Horst Görtz Institute for IT Security Ruhr-Universität Bochum Universitätsstraße 150 D-44780 Bochum Germany andre.adelsbach@nds.rub.de, {huber,sadeghi}@crypto.rub.de Abstract. We propose a stream cipher that provides confidentiality, traceability and renewability in the context of broadcast encryption as- suming that collusion-resistant watermarks exist. We prove it to be as secure as the generic pseudo-random sequence on which it operates. This encryption approach, termed fingercasting, achieves joint decryption and fingerprinting of broadcast messages in such a way that an adversary cannot separate both operations or prevent them from happening simul- taneously. The scheme is a combination of a known broadcast encryption scheme, a well-known class of fingerprinting schemes and an encryption scheme inspired by the Chameleon cipher. It is the first to provide a for- mal security proof and a non-constant lower bound for resistance against collusion of malicious users, i.e., a minimum number of content copies needed to remove all fingerprints. To achieve traceability, the scheme fingerprints the receivers’ key tables such that they embed a fingerprint into the content during decryption. The scheme is efficient and includes parameters that allow, for example, to trade-off storage size for compu- tation cost at the receiving end. Keywords: Chameleon encryption, stream cipher, spread-spectrum wa- termarking, fingerprinting, collusion resistance, frame-proofness, broad- cast encryption. 1 Introduction Experience shows that adversaries attack Broadcast Encryption (BE) systems in a variety of different ways. Their attacks may be on the hardware that stores cryptographic keys, e.g., when they extract keys from a compliant device to develop a pirate device such as the DeCSS software that circumvents the Content Scrambling System [2]. Alternatively, their attacks may be on the decrypted content, e.g., when a legitimate user shares decrypted content with illegitimate users on a file sharing system such as Napster, Kazaa, and BitTorrent. An extended abstract of this paper appeared in the Proceedings of the Tenth Aus- tralasian Conference on Information Security and Privacy (ACISP 2006) [1]. Y.Q. Shi (Eds.): Transactions on DHMS II, LNCS 4499, pp. 1–34, 2007. c Springer-Verlag Berlin Heidelberg 2007
- 13. 2 A. Adelsbach, U. Huber, and A.-R. Sadeghi The broadcasting sender thus has three security requirements: confidentiality, traceability of content and keys, and renewability of the encryption scheme. The requirements cover two aspects. Confidentiality tries to prevent illegal copies in the first place, whereas traceability is a second line of defense aimed at finding the origin of an illegal copy (content or key). The need for traceability originates from the fact that confidentiality may be compromised in rare cases, e.g., when a few users illegally distribute their secret keys. Renewability ensures that after such rare events, the encryption system can recover from the security breach. In broadcasting systems deployed today, e.g., Content Protection for Pre- Recorded Media [3] or the Advanced Access Content System [4], confidential- ity and renewability often rely on BE because it provides short ciphertexts while at the same time having realistic storage requirements in devices and acceptable computational overhead. Traitor tracing enables traceability of keys, whereas fingerprinting provides traceability of content. Finally, renewability may be achieved using revocation of the leaked keys. However, none of the mentioned cryptographic schemes covers all three secu- rity requirements. Some existing BE schemes lack traceability of keys, whereas no practically relevant scheme provides traceability of content [5,6,7,8]. Traitor tracing only provides traceability of keys, but not of content [9,10]. Fingerprint- ing schemes alone do not provide confidentiality [11]. The original Chameleon cipher provides confidentiality, traceability and a hint on renewability, but with a small constant bound for collusion resistance and, most importantly, without formal proof of security [12]. Asymmetric schemes, which provide each compli- ant device with a certificate and accompany content with Certificate Revocation Lists (CRLs), lack traceability of content and may reach the limits of renewabil- ity when CRLs become too large to be processed by real-world devices. Finally, a trivial combination of fingerprinting and encryption leads to an unacceptable transmission overhead because the broadcasting sender needs to sequentially transmit each fingerprinted copy. Our Contribution. We present, to the best of our knowledge, the first rigorous security proof of Chameleon ciphers, thus providing a sound foundation for the recent applications of these ciphers, e.g., [13]. Furthermore, we give an explicit criterion to judge the security of the Chameleon cipher’s key table. Our finger- casting approach fulfills all three security requirements at the same time. It is a combination of (i) a new Chameleon cipher based on the fingerprinting capabili- ties of a well-known class of watermarking schemes and (ii) an arbitrary broadcast encryption scheme, which explains the name of the approach. The basic idea is to use the Chameleon cipher for combining decryption and fingerprinting. To achieve renewability, we use a BE scheme to provide fresh session keys as input to the Chameleon scheme. To achieve traceability, we fingerprint the receivers’ key ta- bles such that they embed a fingerprint into the content during decryption. To enable higher collusion resistance than the original Chameleon scheme, we tai- lor our scheme to emulate any watermarking scheme whose coefficients follow a
- 14. Fingercasting–Joint Fingerprinting and Decryption of Broadcast Messages 3 probability distribution that can be disaggregated into additive components.1 As proof of concept, we instantiate the watermarking scheme with Spread Spectrum Watermarking (SSW), which has proven collusion resistance [14,15]. However, we might as well instantiate it with any other such scheme. Joint decryption and fingerprinting has significant advantages compared to ex- isting methods such as transmitter-side or receiver-side Fingerprint Embedding (FE) [11]. Transmitter-side FE is the trivial combination of fingerprinting and encryption by the sender. As discussed above, the transmission overhead is in the order of the number of copies to be distributed, which is prohibitive in practical applications. Receiver-side FE happens in the user’s receiver; after distribution of a single encrypted copy of the content, a secure receiver based on tamper- resistant hardware is trusted to embed the fingerprint after decryption. This saves bandwidth on the broadcast channel. However, perfect tamper-resistance cannot be achieved under realistic assumptions [16]. An adversary may succeed in extracting the keys of a receiver and subsequently decrypt without embedding a fingerprint. Our fingercasting approach combines the advantages of both methods. It saves bandwidth by broadcasting a single encrypted copy of the content. In addition, it ensures embedding of a fingerprint even if a malicious user succeeds in extracting the decryption keys of a receiver. Furthermore, as long as the number of colluding users remains below a threshold, the colluders can only create decryption keys and content copies that incriminate at least one of them. This paper enhances our extended abstract [1] in the following aspects. First, the extended abstract does not contain the security proof, which is the ma- jor contribution. Second, we show here that our instantiation of SSW is exact, whereas the extended abstract only claims this result. Last, we discuss here the trade-off between storage size and computation cost at the receiving end. 2 Related Work The original Chameleon cipher of Anderson and Manifavas is 3-collusion-resist- ant [12]: A collusion of up to 3 malicious users has a negligible chance of creating a good copy that does not incriminate them. Each legitimate user knows the seed of a Pseudo-Random Sequence (PRS) and a long table filled with random keywords. Based on the sender’s master table, each receiver obtains a slightly different table copy, where individual bits in the keywords are modified in a characteristic way. Interpreting the PRS as a sequence of addresses in the table, the sender adds the corresponding keywords in the master table bitwise modulo 2 in order to mask the plaintext word. The receiver applies the same operation to the ciphertext using its table copy, thus embedding the fingerprint. The original cipher, however, has some inconveniences. Most importantly, it has no formal security analysis and bounds the collusion resistance by the con- stant number 3, whereas our scheme allows to choose this bound depending on the number of available watermark coefficients. In addition, the original scheme 1 Our scheme does not yet support fingerprints based on coding theory.
- 15. 4 A. Adelsbach, U. Huber, and A.-R. Sadeghi limits the content space (and keywords) to strings with characteristic bit po- sitions that may be modified without visibly altering the content. In contrast, our scheme uses algebraic operations in a group of large order, which enables modification of any bit in the keyword and processing of arbitrary documents. Chameleon was inspired by work from Maurer [17,18]. His cipher achieves information-theoretical security in the bounded storage model with high prob- ability. In contrast, Chameleon and our proposed scheme only achieve compu- tational security. The reason is that the master table length in Maurer’s cipher is super-polynomial. As any adversary would need to store most of the table to validate guesses, the bounded storage capacity defeats all attacks with high probability. However, Maurer’s cipher was never intended to provide traceability of content or renewability, but only confidentiality. Ferguson et al. discovered security weaknesses in a randomized stream cipher similar to Chameleon [19]. However, their attack only works for linear sequences of keywords in the master table, not for the PRSs of our proposed solution. Ergun, Kilian, and Kumar prove that an averaging attack with additional Gaussian noise defeats any watermarking scheme [20]. Their bound on the min- imum number of different content copies needed for the attack asymptotically coincides with the bound on the maximum number of different content copies to which the watermarking scheme of Kilian et al. is collusion-resistant [15]. As we can emulate [15] with our fingercasting approach, its collusion resistance is—at least asymptotically—the best we can hope for. Recently there was a great deal of interest in joint fingerprinting and de- cryption [13,21,22,11,23]. Basically, we can distinguish three strands of work. The first strand of work applies Chameleon in different application settings. Briscoe et al. introduce Nark, which is an application of the original Chameleon scheme in the context of Internet multicast [13]. However, in contrast to our new Chameleon cipher they neither enhance Chameleon nor analyze its security. The second strand of work tries to achieve joint fingerprinting and decryption by either trusting network nodes to embed fingerprints (Watercasting in [21]) or doubling the size of the ciphertext by sending differently fingerprinted packets of content [22]. Our proposed solution neither relies on trusted network nodes nor increases the ciphertext size. The third strand of work proposes new joint fingerprinting and decryption processes, but at the price of replacing encryption with scrambling, which does not achieve indistinguishability of ciphertext and has security concerns [11,23]. In contrast, our new Chameleon cipher achieves indistinguishability of ciphertext. 3 Preliminaries 3.1 Notation We recall some standard notations that will be used throughout the paper. First, we denote scalar objects with lower-case variables, e.g., o1, and object tuples as
- 16. Fingercasting–Joint Fingerprinting and Decryption of Broadcast Messages 5 well as roles with upper-case variables, e.g., X1. When we summarize objects or roles in set notation, we use an upper-case calligraphic variable, e.g., O := {o1, o2, . . .} or X := {X1, X2, . . .}. Second, let A be an algorithm. By y ← A(x) we denote that y was obtained by running A on input x. If A is deterministic, then y is a variable with a unique value. Conversely, if A is probabilistic, then y is a random variable. For example, by y ← N(μ, σ) we denote that y was obtained by selecting it at random with normal distribution, where μ is the mean and σ the standard deviation. Third, o1 R ←O and o2 R ←[0, z] denote the selection of a random element of the set O and the interval [0, z] with uniform distribution. Finally, V · W denotes the dot product of two vectors V := (v1, . . . , vn ) and W := (w1, . . . , wn ), which is defined as V ·W := n j=1 vj wj , while ||V || denotes the Euclidean norm ||V || := √ V · V . 3.2 Roles and Objects in Our System Model The (broadcast) center manages the broadcast channel, distributes decryption keys and is fully trusted. The users obtain the content via devices that we refer to as receivers. For example, a receiver may be a set-top box in the context of pay- TV or a DVD player in movie distribution. We denote the number of receivers with N ; the set of receivers is U := {ui | 1 ≤ i ≤ N }. When a receiver violates the terms and conditions of the application, e.g., leaks its keys or shares content, the center revokes the receiver’s keys and thus makes them useless for decryption purposes. We denote the set of revoked receivers with R := {r1, r2, . . .} ⊂ U. We represent broadcast content as a sequence M := (m1, . . . , mn) of real numbers in [0, z], where M is an element of the content space M.2 For example, these numbers may be the n most significant coefficients of the Discrete Cosine Transform (DCT) as described in [14]. However, they should not be thought of as a literal description of the underlying content, but as a representation of the values that are to be changed by the watermarking process [20]. We refer to these values as significant and to the remainder as insignificant. In the remainder of this paper, we only refer to the significant part of the content, but briefly comment on the insignificant part in Section 5. 3.3 Cryptographic Building Blocks Negligible Function. A negligible function f : N → R is a function where the inverse of any polynomial is asymptotically an upper bound: ∀k 0 ∃λ0 ∀λ λ0 : f(λ) 1/λk Probabilistic Polynomial Time. A probabilistic polynomial-time algorithm is an algorithm for which there exists a polynomial poly such that for every input x ∈ {0, 1}∗ the algorithm always halts after poly(|x|) steps, independently of the outcome of its internal coin tosses. 2 Although this representation mainly applies to images, we discuss an extension to movies and songs in Section 5.
- 17. 6 A. Adelsbach, U. Huber, and A.-R. Sadeghi Pseudo-Random Sequence (PRS). We first define the notion of pseudo- randomness and then proceed to define a Pseudo-Random Sequence Generator (PRSG). For further details we refer to [24, Section 3.3.1]: Definition 1 (Pseudo-randomness). Let len : N → N be a polynomial such that len(λ) λ for all λ ∈ N and let Ulen(λ) be a random variable uniformly dis- tributed over the strings {0, 1}len(λ) of length len(λ). Then the random variable X with |X | = len(λ) is called pseudo-random if for every probabilistic polynomial- time distinguisher D, the advantage Adv (λ) is a negligible function: Adv (λ) := Pr [D(X ) = 1] − Pr D(Ulen(λ)) = 1 Definition 2 (Pseudo-Random Sequence Generator). A PRSG is a de- terministic polynomial-time algorithm G that satisfies two requirements: 1. Expansion: There exists a polynomial len : N → N such that len(λ) λ for all λ ∈ N and |G(str)| = len(|str|) for all str ∈ {0, 1}∗ . 2. Pseudo-randomness: The random variable G(Uλ) is pseudo-random. A PRS is a sequence G(str) derived from a uniformly distributed random seed str using a PRSG. Chameleon Encryption. To set up a Chameleon scheme CE := (KeyGenCE, KeyExtrCE, EncCE, DecCE, DetectCE), the center generates the secret master ta- ble MT, the secret table fingerprints TF := (TF(1) , . . . , TF(N) ), and selects a threshold t using the key generation algorithm (MT, TF, t) ← KeyGenCE(N , 1λ , parCE), where N is the number of receivers, λ a security parameter, and parCE a set of performance parameters. To add receiver ui to the system, the center uses the key extraction algorithm RT(i) ← KeyExtrCE(MT, TF, i) to deliver the se- cret receiver table RT(i) to ui. To encrypt content M exclusively for the receivers in possession of a receiver table RT(i) and a fresh session key ksess , the center uses the encryption algorithm C ← EncCE(MT, ksess , M ), where the output is the ciphertext C. Only a receiver ui in possession of RT(i) and ksess is capable of decrypting C and obtaining a fingerprinted copy M (i) of content M using the decryption algorithm M (i) ← DecCE(RT(i) , ksess , C). When the center discovers an illegal copy M ∗ of content M , it executes DetectCE, which uses the fingerprint detection algorithm DetectFP of the un- derlying fingerprinting scheme to detect whether RT(i) left traces in M ∗ . For further details on our notation of a Chameleon scheme, we refer to Appendix C. Fingerprinting. To set up a fingerprinting scheme, the center generates the secret content fingerprints CF := (CF(1) , . . . , CF(N) ) and the secret similarity threshold t using the setup algorithm (CF, t) ← SetupFP(N , n , parFP), where N is the number of receivers, n the number of content coefficients, and parFP a set of performance parameters. To embed the content fingerprint CF(i) := (cf (i) 1 , . . . , cf (i) n ) of receiver ui into the original content M , the center uses the embedding algorithm M (i) ← EmbedFP(M , CF(i) ). To verify whether an illegal copy M ∗ of content M contains traces of the content fingerprint CF(i) of receiver
- 18. Random documents with unrelated content Scribd suggests to you:
- 19. 'No, later than that. The day you came over to tell me about Miss Marlowe, you know. I confess I don't think I have ever been well since. You must have something more to tell me now, have you not?' 'What about?' said Mrs. Hennifer, fixing her eyes sharply upon her. Mrs. Severn avoided them; her gaze idly followed the play of her own fingers through the fringe of the coverlet thrown over her. 'Well, you know—about Miss Marlowe.' Mrs. Hennifer scrutinised her face in silence for some time, but its absence of colour was equalled by that of expression. 'Clothilde,' she said, 'we will not deal in innuendo. It is detestable. Why don't you say like an honest woman, Have you seen Lucius Danby yet? Is he the man I was once engaged to marry? It is perfectly natural, in fact necessary, that you should still be interested in him to that extent. For you'll have to keep out of his way. But this dallying with a love-affair that was wholly dishonouring to yourself is disgusting. You chose to obliterate yourself from his life years ago, and you did not choose to confess your dishonour to your husband; and though circumstances are so cruel that you are compelled to recall all now, it can only be for the sake of impressing upon yourself the necessity of dignified self-effacement. If you are ever compelled to meet him it will be as a married woman and the mother of children, the wife of the man who will, practically speaking, be his upper servant.' 'Then it really is the same Lucius?' 'It is the same Mr. Danby.' 'And he is at Lafer?' 'Not at all, as you know, for Severn would have named it had he been. There are a good many preliminaries to be gone through in the case of a Miss Marlowe. Cynthia was aware of that. She came home to smooth the way. The Admiral was very much ruffled.' 'I should think he intended it to fall through so soon as they had separated by her coming home.'
- 20. 'He did not cause the separation. She knew what was due to him and to herself——' 'Why, she surely has not thought more of her own dignity than of Lucius?' said Mrs. Severn, with one of her low laughs. 'Her own dignity!' repeated Mrs. Hennifer. 'She has done what was right, Clothilde, whether by instinct or deliberation I don't know. She has acted wisely. The Admiral sees her quiet determination and respects it. He is becoming reconciled, and Cynthia will soon have her way.' 'Very deep of her,' said Mrs. Severn; 'I should think you will have been struck by the new phase of her character. You would not have thought she had such management, would you? So he has not come over and contrived to see her?' Mrs. Hennifer's boiling indignation admitted only of ejaculatory refrains. 'Contrived to see her?' 'Well, I mean is he risking nothing? It all seems to me a preposterously cool transaction. Of course he knew she was an heiress?' 'Heiress! Transaction! My word, Clothilde, I could shake you! Cynthia is not a girl to be met in a lane,' cried Mrs. Hennifer breathlessly. 'The next thing you will assert is that he is going to marry her for the purpose of being near you. Preposterous! You don't understand. He did not know she was an heiress when he proposed to her. You will have to make up your mind not to call him Lucius and also to stay at home. So you went to the Mires again after I had been here that day? Highly creditable! And how long did you mean to stay there this time? You never will be satisfied until you have created a scandal. I don't suppose Mr. Danby knows where you are or anything about you, and cares less, I should think. I wonder you haven't thought of writing to inform him of the interesting and agreeable facts. Ah! but I suppose you don't know his address? Well, he'll be at Lafer soon.'
- 21. 'I should not think of writing to him there.' 'I should think not indeed. I don't advise you even to ask him for mercy by not acknowledging you to Severn's face. Leave it to him. He'll soon respect Severn sufficiently to wish not to humiliate him. But you surely have not seriously thought of writing to him at all?' Mrs. Severn smiled, and a faint colour flickered into her face for a moment. 'I did,' she said; 'I confess to the folly. You know I went to the Mires again—you have heard? I began a letter to him that day to tell him where I was. It seemed best that he should know. I wrote it on the moor, and I was startled by—some one coming for me. I slipped it into a book I had taken to read, and in the hurry I dropped it and never thought of it again for weeks.' 'Letter and all? I should think you have wondered if they have ever been found.' 'I have indeed. But I daren't say a word about them.' 'And what has possessed you to be telling me the truth, eh? You're not in the habit of telling the truth, Clothilde.' 'You are very hard upon me,' she murmured. 'God knows I don't wish to be,' Mrs. Hennifer burst out, with a voice that suddenly trembled. 'Be hard upon yourself. It seems to me, inconceivable though it be, that you are trifling with memories on which it is sheer wickedness to dwell. You trifled with him once; for Heaven's sake don't trifle with yourself.' Mrs. Severn moved uneasily. There was a palm-leaf fan near, and she took it up and held it against her brows. Mrs. Hennifer, with every faculty upon the alert, and energy of observation as much as of suspicion, was convinced that her lip trembled. Her eyes were downcast. Her face, however, remained pale and calm. It was impossible to judge of her phase of feeling. And at that moment, as though to baffle any effort on Mrs. Hennifer's part to do so, she slid her feet to the ground and rose, then rearranged herself at the
- 22. darker end of the settee. Mrs. Hennifer, noting each movement with a jealousy for Cynthia that was almost fierce, reluctantly admired while she mistrusted. The profile of her face and throat against the wainscot was like a bas-relief in ivory; every gesture had a slow and self-abandoned grace. She prayed while she watched her. 'It has struck me that he might go to see the Pitons,' said Mrs. Severn; 'I suppose he returned to Jersey after Miss Marlowe left. If he went there Ambrose would probably tell him all. I know Anna told him of the engagement when she wrote when Miss Marlowe was going there.' 'A most excellent opportunity, and I hope Ambrose would make the best use of it. In that case he is au fait with everything, and we need not distress ourselves,' said Mrs. Hennifer decisively. After this they sat for some time in silence. 'Clothilde, are you very fond of your children?' said Mrs. Hennifer at last, half unconscious of the question evolved from such a rush of rambling thought, that whatever had been uttered must have seemed inconsequent. 'I suppose so. They are handsome. I am always thankful they are not plain.' 'You'll miss Anna, or rather, perhaps, they will.' 'Anna cannot be spared yet. I think Mr. Borlase a very selfish and inconsiderate man, but I was really too vexed to tell him so. I told Anna, however.' 'Does Mr. Severn say she cannot be spared?' 'John? You know what John is—crazy for people to be happy, as he calls it. He said he should have her when he wanted her. It is I who have the common sense. I told him I could not spare her until Antoinette was old enough to take her place; and I told Anna Mr. Borlase might die and leave her a widow without a farthing. I do think, when John has given her a home all these years, she ought to
- 23. make us the first consideration. But every one seems very hard to convince.' She got up as she spoke and moved to the piano. While turning over some music she said in a low voice of bell-like clearness, 'Miss Marlowe was here the other day telling us about her visit to the Pitons at Rocozanne. I thought from her manner you had not told her then about me. Have you since?' Mrs. Hennifer started to her feet, throwing the book she held on to the table with a vigour that startled even Mrs. Severn. It made her look round hastily. 'Clothilde,' she said, 'how can you torture me? This is torture. Don't you know I love Cynthia Marlowe with my whole heart—a thousand times more than ever I loved you with a foolish creature's adoration of your mere superficial beauty? It pierces me to the quick to think she should ever have a moment's pain of mind. Don't you think that if the Admiral knew her future husband had been jilted by you, he might not tolerate the match? And her heart might break with the misery of it all; the Admiral may live twenty years! And how am I to tell her—and yet how am I to let it go untold?' Her voice sank, and she added this more to herself than aloud. 'Oh! she must know,' said Mrs. Severn in a matter-of-fact tone. Mrs. Hennifer looked at her quickly. 'You either won't see it from another's point of view, or you want to break it all off,' she said. 'No, no! Only we shall meet, and he will betray something.' 'You rarely leave Old Lafer, Clothilde.' 'Still I do go into Wonston occasionally, and I dine at the Hall, and the Marlowes call upon me. You know, Mary, every one knows I am something different to John. And Lucius may already know I am here.' Mrs. Hennifer considered a moment.
- 24. 'One thing is certain,' she said drily, 'you must cure yourself of your old habit of calling him Lucius, and in order that you shall clearly understand their confidence in each other he shall tell her who you are.' For an instant their eyes met. Mrs. Severn's bore a darting glance of defiant appeal, and her whole figure seemed to tremble. But whatever her fear she conquered it, and putting her arm through Mrs. Hennifer's proposed that they should go into the garden.
- 25. CHAPTER XIII SCILLA REASONS WITH HARTAS 'Then you won't do a half-day's job?' 'No, I won't that. I wonder you've fashed yoursel to come and ask me. You ken I never will, least of all of a Friday. It's against common sense to think t'Almighty means you to tail off a week when He's sent sike a downpour the first four days. I'll none trouble t' pits this side o' Sabbath.' 'You might be the religiousest man in t' land, Hartas.' 'It's none religion. It's common sense. Sabbath's a landmark; it'll hev its due on either side from me. I'm none going to split a week or two days. We left half a dozen loads o' stuff at t' shaft mouth last week- end, and not a cart 'll hev crossed t' moor this tempest. They may come thick to-day, and if you like to go and wait for custom, you can.' Dick Chapman laughed angrily. 'If 'twer a matter o' trapping a few rabbits none ud be keener nor yoursel,' he said. 'I can't drop into t' pit alone, and so, as Reuben's off, I'm left in t' lurch. And next week's Martinmas.' 'I ken so.' 'And 'll no split that either, I reckon.' 'Martinmas's out o' count.' 'Ah! ah! there's no spree where there's no brass, eh?' 'Brass! Brass indeed! It's folk without fire and with friends that I think on. Now, Dick, make off. I'll promise four days in t' fore-end. How art thee going, on Nobbin?'
- 26. 'I lay I'll keep drier on my own shanks, and there 'll be nought for Nobbin to do, though that deuced hind leg o' hers 'll be getting stiff enough for t' farrier if she stands much longer.' 'I'll look after Nobbin.' 'Just a walk along t' track 'll do nought.' 'I think I ken t' needs o' that limb by now.' 'Well, I'll gang and see what's doing.' Chapman sauntered off, turning up his collar and jamming his hat down on his brows. The pits lay between the Mires and Old Lafer on the moor above the Hall, and here the three able-bodied men of the Mires worked in all seasons except hay-time. At hay-time they hired out to the low-country farmers as monthly labourers. A small stock of coal sufficed in summer to eke out the dwindling turfs in the peat shanties, and keep the fire smouldering while the household laboured in the meadows. But there were days all the year round when the wild west wind, sweeping off Great Whernside, brought tempests of rain, and made it 'that rough on the tops' that no man could stand against it and even the sheep went uncounted. Then the doors at the Mires were fast shut, except when a woman in clogs pattered round for a skep of peats, or a man slouched down to the marsh to count the foaming streams pouring into it. This when it 'abated like.' Then would come another rush of wind and wet, blotting out the whole world to within a yard or two of the cottage windows. If there were one kind of weather that Scilla detested more than another it was fog. A snow-storm or deluge of rain kept Hartas at home, but betwixt the liftings of fog he would make his way to the Inn at East Lafer, and when he came back at night there was a wath over the beck to cross, the moor-track to strike, and the pit-shaft to miss. It was nothing when he finished off by rolling down the slape sides of the hollow.
- 27. It was foggy to-day. Hartas was restless, and she was sure he would slip off after dinner. She had run into Chapman's and suggested the pits. But her hope had failed and she foresaw a vigil. She had not dared say a word while the men were talking, lest evident anxiety should make Hartas contradictious. But despite her forbearance he had been so. There was no managing him! She was frying bacon, and sighed over the pan, as into her simple mind there rushed the certainty of his headlong course to perdition, a perdition symbolised to her by the flames curling and hissing at every turn of the fork that sent sprints of fat on to the embers. This was really her idea of hell. She had an equally vivid one of heaven. Three miles away, straight as an arrow to the north, lay Wherndale. She had walked many a time to the edge of the moors to see it. Skirting a deep natural moat round an old copperas mine, she had slid down the refuse slide, and plunged through bracken, rush, and spagnum to a great rock overhanging the valley. From hence the view was glorious on a fine summer evening. The western valley lay bathed in sun-rays falling through the vapoury heat-mists shrouding the mountains; the eastern flooded with sunshine; the Meupher range clear against the sky. Below, the moor fell abruptly into meadow-land; rocks were scattered in Titanic confusion among the ling; the meadows dimpled with hollows; the lowering sun streamed through the foliage, and cast long shadows from every tree and hay-pike; mists of blue smoke hung above the farmsteads; here and there was a lake-like gleam of river. Scilla, with the velvet breeze blowing against her, felt that here was heaven. Did she not touch it, when the very tufts of grass over which she walked glistened like frosted silver, and the bent-flower gleamed like cloth of gold? 'I wish the fog would lift,' she said, as she placed dinner on the table, and they drew up their chairs. 'If it would, I'd mount Nobbin and give her a good stretch, better than you'll have patience for, maybe. We mustn't have her leg worsen.' 'It only worsens with standing in t' stable. We hevn't plenty o' work for her, winding up t' coil at t' pits; she'd thrive better on twice as
- 28. much, and that's truth. I've an extra job for her to-day, and spite o' t' fog I'll carry it through.' 'Why, father, she'll be that stiff after these few days!' 'It works off t' farther she goes, and what with t' weather-shakken look o' t' skies when there is a rift, and Martinmas holiday at hand, she'll be heving so much stable that her leg 'll be her doom i' now.' Scilla listened with a sensation of breathlessness. It was rarely he talked so much, or informed her of any of his intentions. She wondered what the 'extra job' was, but was so certain that she was to know that she easily hid her curiosity. Hartas ate on phlegmatically, pushing his meat on to the knife with the fork, and thence conveying it with a pump-handle-like motion to his mouth. When he had finished he placed them cross-wise on the plate, drew the back of his hand across his lips, and tilted his chair, sticking his thumbs into the armholes of his coat. 'There's t' sale ower at Northside Edge to-day,' he said. 'Yes. Poor Mrs. Carling, how she'll feel it!' 'I met Luke Brockell when I wer i' Wonston some days back, and he wer talking o' taking his trolly up. He has his trolly, but he's lost his nag, dropped in a fit.' 'Then how could he take it up, and what would be the use of it? Does he want to put it in the sale?' Hartas chuckled, leering at her with a scowling grin. 'Thee never wer a bright un, Scilla. All t' glint o' thy wits has run to waste in your hair. I kenned that when Kit gave you hare soup, and you never guessed what it was nor where it came from. There, there, no call to flare up! What, there's a glint in your temper too, is there?' Scilla had turned deathly white, and pushed her chair back hastily, making a harsh sound on the roughly-paved floor that somehow suggested to Hartas the sound her voice would have had had she
- 29. spoken. She looked at him with a threatening disdain as she stood a moment balancing her slight figure against the table, and apparently expecting him to speak. He did not, however, and she went to the door. Opening it, she leant against the lintel. There was something piteously like the fog that shrouded the world in the wanness that had overclouded her face. The sweet clearness of the blue eyes was gone. More than a suspicion of tears weighted their lids and lurked in the trembling of her mouth. But she was determined not to cry. It was not to fall a prey to the ready scoff that she had won her way through tribulation to a calm that—whatever the shocks of the future —should be abiding. And at that moment the sky cleared, and a growing light which, in the absorption of Hartas's confidences, she had not noticed, burst into a ray of sunshine. It fell upon her. She turned, and going in again sat down on the settle. A smile had flitted over her face. 'I know now what you meant, father. It was very stupid of me not to understand. Of course you offered Nobbin for Luke's trolly, and now you are going with her.' She spoke in her usual bright voice, but not with any expectation of disarming him. She knew well by this stage of her dearly-bought experience that such men are not to be disarmed. Always surly, his surliness only varied in degree. 'Them that's fools this side o' t' grave are less like for it t' other,' he said. 'It's true I'm taking Nobbin ower to Northside Edge, but there's no need for all t' Mires to ken. It may or it mayn't come to Dick Chapman's knowledge, but mind you, you're dumb. I offered her to Dick to ride to t' pits.' While he spoke, avoiding looking at her, a foreboding of some wholly formless but very decided evil darted into her mind. For an instant she hesitated to utter the suggestion of principle that rose simultaneously to her lips. But to have done so would have been to shirk what he was shirking.
- 30. 'Of course Nobbin is half his,' she said. Hartas did not answer but got up slowly. 'And what she earns must be his, half of it, I mean,' she said with more inward tremor, but more outward steadiness. 'Besides,' she added, getting up too and going close to him, 'do you think she's fit for this piece of work, father? It's all very well her hobbling a bit when it's only to the pits, and often no work when she gets there. No one could call us cruel to her, she's——' Hartas raised his hand suddenly and struck out. But it was only into the air, and Scilla did not wince as he had hoped she would. He would not glance at her. Not for worlds would he have owned what the influence of that glance into her earnest unwavering eyes might have been. 'Cruel to her!' he exclaimed in his thick voice, 'she's as fat as butter, and if we're stinted she has her meat. Come, Scilla, what are you driving at? Let's leave riddles.' 'The law,' said Scilla, with an urgency which felt to her own keen emotions desperate. Was not the law her phantom, the dread avenger that dogged her steps and filled her thoughts? She loved her husband with all her heart, but in her utmost loyalty she still always considered him as a transgressor, not as a victim. To Hartas he was a victim, the victim of adverse circumstance, of an embodiment of spite in the shape of Elias Constantine. Hartas Kendrew's predominant article of faith was that in which Admiral Marlowe, Mr. Severn, and Elias Constantine were inextricably mingled. But his trinity in unity possessed, according to his distorted reasoning, a viciousness which could only nurture revengefulness. 'The law,' said Scilla again, nerving herself to appeal; 'don't let us put ourselves near it. It seems a dishonest thing to say,' she added, faltering a moment, while a look of perplexity filled her eyes, 'as though we were all the time doing wrong, but you know lots of folk 'll see Nobbin at Northside Edge, and if she goes lame——'
- 31. 'There's not a sore on her, and what's a hobble? There's not a sprain about her. She's sound, I tell you. D—— the law!' His violence convinced her of his misgivings. It was not then so much what Nobbin might earn that day, a sum that would probably be balanced on Chapman's side at the pits, but the risk he ran in taking her so far from home that made him anxious to do it quietly. But why run the risk? Where was the advantage of it? It could only be as a matter of convenience to Luke Brockell. She knew Luke and did not like him. Not that she had ever heard any evil of him. But there was something cautious and furtive about him that she instinctively resented. The straightforwardness which Hartas chose to construe as slowness of comprehension made her shrink from imputing interested or dishonest motives to others. But she was often compelled to do so. And now she searched her mind for a clue to this compact of friendliness on Hartas's part with a man who, on his side, would do well to keep out of his companionship. She had moved aside and stood leaning against the settle-back with a droop in her figure expressive of her dismayed despondency. What more could she say or urge? To a man of Hartas Kendrew's temperament, risk added zest. To run into it quickened his sluggish blood to a degree which he cherished with delight; failure nurtured his lowest nature, success was only more enthralling as feeding a triumph whose chief charm lay in its maliciousness. 'You must have weighed it all, father,' Scilla said at last, timidly, again raising her eyes to his, and searching his face for confirmation of her worst fears. 'You know that if anything goes wrong when you take her off in this way, Dick 'll come down on us for all her value. And though she mayn't be worth much to others, she is to us.' 'You talk quite book-like,' said Hartas, with a sneer. It pleased him to think she had grasped the whole situation, and was made proportionately miserable. But after all, were not her qualms wholly womanly? His were those of manhood. He would dare the devil to do his worst at him. Had he not other plans for circumventing the
- 32. devil's own? Luke Brockell was a more cautious chap than Kit, he would beat him out and out as a partner over the snare, the sack, and the dub; folks never pried into the stuff on his trolly; already grouse were again on their way from Admiral Marlowe's moors to distant markets, with which Luke dealt in the delf line. Luke had fast and influential friends, and he meant to leave no stone unturned whereby Luke might also be his. END OF VOL. I Printed by R. R. Clark, Edinburgh G. C. Co.
- 33. Transcriber's Note: Although most printer's errors have been retained, some have been silently corrected. Some spelling and punctuation, capitalization, accents and formatting markup have been normalized and include the following: Page 88 peek is now peak [peak in the masonry] Page 213 the word as was written twice, [reflecting upon him as as] Page 241 the double quotation mark has been replaced by a single quote to match the opening quote. [I saw you last—in July, was it not?]
- 34. *** END OF THE PROJECT GUTENBERG EBOOK MRS. SEVERN: A NOVEL, VOL. 1 (OF 3) *** Updated editions will replace the previous one—the old editions will be renamed. Creating the works from print editions not protected by U.S. copyright law means that no one owns a United States copyright in these works, so the Foundation (and you!) can copy and distribute it in the United States without permission and without paying copyright royalties. Special rules, set forth in the General Terms of Use part of this license, apply to copying and distributing Project Gutenberg™ electronic works to protect the PROJECT GUTENBERG™ concept and trademark. Project Gutenberg is a registered trademark, and may not be used if you charge for an eBook, except by following the terms of the trademark license, including paying royalties for use of the Project Gutenberg trademark. If you do not charge anything for copies of this eBook, complying with the trademark license is very easy. You may use this eBook for nearly any purpose such as creation of derivative works, reports, performances and research. Project Gutenberg eBooks may be modified and printed and given away—you may do practically ANYTHING in the United States with eBooks not protected by U.S. copyright law. Redistribution is subject to the trademark license, especially commercial redistribution. START: FULL LICENSE
- 35. THE FULL PROJECT GUTENBERG LICENSE
- 36. PLEASE READ THIS BEFORE YOU DISTRIBUTE OR USE THIS WORK To protect the Project Gutenberg™ mission of promoting the free distribution of electronic works, by using or distributing this work (or any other work associated in any way with the phrase “Project Gutenberg”), you agree to comply with all the terms of the Full Project Gutenberg™ License available with this file or online at www.gutenberg.org/license. Section 1. General Terms of Use and Redistributing Project Gutenberg™ electronic works 1.A. By reading or using any part of this Project Gutenberg™ electronic work, you indicate that you have read, understand, agree to and accept all the terms of this license and intellectual property (trademark/copyright) agreement. If you do not agree to abide by all the terms of this agreement, you must cease using and return or destroy all copies of Project Gutenberg™ electronic works in your possession. If you paid a fee for obtaining a copy of or access to a Project Gutenberg™ electronic work and you do not agree to be bound by the terms of this agreement, you may obtain a refund from the person or entity to whom you paid the fee as set forth in paragraph 1.E.8. 1.B. “Project Gutenberg” is a registered trademark. It may only be used on or associated in any way with an electronic work by people who agree to be bound by the terms of this agreement. There are a few things that you can do with most Project Gutenberg™ electronic works even without complying with the full terms of this agreement. See paragraph 1.C below. There are a lot of things you can do with Project Gutenberg™ electronic works if you follow the terms of this agreement and help preserve free future access to Project Gutenberg™ electronic works. See paragraph 1.E below.
- 37. 1.C. The Project Gutenberg Literary Archive Foundation (“the Foundation” or PGLAF), owns a compilation copyright in the collection of Project Gutenberg™ electronic works. Nearly all the individual works in the collection are in the public domain in the United States. If an individual work is unprotected by copyright law in the United States and you are located in the United States, we do not claim a right to prevent you from copying, distributing, performing, displaying or creating derivative works based on the work as long as all references to Project Gutenberg are removed. Of course, we hope that you will support the Project Gutenberg™ mission of promoting free access to electronic works by freely sharing Project Gutenberg™ works in compliance with the terms of this agreement for keeping the Project Gutenberg™ name associated with the work. You can easily comply with the terms of this agreement by keeping this work in the same format with its attached full Project Gutenberg™ License when you share it without charge with others. 1.D. The copyright laws of the place where you are located also govern what you can do with this work. Copyright laws in most countries are in a constant state of change. If you are outside the United States, check the laws of your country in addition to the terms of this agreement before downloading, copying, displaying, performing, distributing or creating derivative works based on this work or any other Project Gutenberg™ work. The Foundation makes no representations concerning the copyright status of any work in any country other than the United States. 1.E. Unless you have removed all references to Project Gutenberg: 1.E.1. The following sentence, with active links to, or other immediate access to, the full Project Gutenberg™ License must appear prominently whenever any copy of a Project Gutenberg™ work (any work on which the phrase “Project Gutenberg” appears, or with which the phrase “Project Gutenberg” is associated) is accessed, displayed, performed, viewed, copied or distributed:
- 38. This eBook is for the use of anyone anywhere in the United States and most other parts of the world at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at www.gutenberg.org. If you are not located in the United States, you will have to check the laws of the country where you are located before using this eBook. 1.E.2. If an individual Project Gutenberg™ electronic work is derived from texts not protected by U.S. copyright law (does not contain a notice indicating that it is posted with permission of the copyright holder), the work can be copied and distributed to anyone in the United States without paying any fees or charges. If you are redistributing or providing access to a work with the phrase “Project Gutenberg” associated with or appearing on the work, you must comply either with the requirements of paragraphs 1.E.1 through 1.E.7 or obtain permission for the use of the work and the Project Gutenberg™ trademark as set forth in paragraphs 1.E.8 or 1.E.9. 1.E.3. If an individual Project Gutenberg™ electronic work is posted with the permission of the copyright holder, your use and distribution must comply with both paragraphs 1.E.1 through 1.E.7 and any additional terms imposed by the copyright holder. Additional terms will be linked to the Project Gutenberg™ License for all works posted with the permission of the copyright holder found at the beginning of this work. 1.E.4. Do not unlink or detach or remove the full Project Gutenberg™ License terms from this work, or any files containing a part of this work or any other work associated with Project Gutenberg™. 1.E.5. Do not copy, display, perform, distribute or redistribute this electronic work, or any part of this electronic work, without prominently displaying the sentence set forth in paragraph 1.E.1
- 39. with active links or immediate access to the full terms of the Project Gutenberg™ License. 1.E.6. You may convert to and distribute this work in any binary, compressed, marked up, nonproprietary or proprietary form, including any word processing or hypertext form. However, if you provide access to or distribute copies of a Project Gutenberg™ work in a format other than “Plain Vanilla ASCII” or other format used in the official version posted on the official Project Gutenberg™ website (www.gutenberg.org), you must, at no additional cost, fee or expense to the user, provide a copy, a means of exporting a copy, or a means of obtaining a copy upon request, of the work in its original “Plain Vanilla ASCII” or other form. Any alternate format must include the full Project Gutenberg™ License as specified in paragraph 1.E.1. 1.E.7. Do not charge a fee for access to, viewing, displaying, performing, copying or distributing any Project Gutenberg™ works unless you comply with paragraph 1.E.8 or 1.E.9. 1.E.8. You may charge a reasonable fee for copies of or providing access to or distributing Project Gutenberg™ electronic works provided that: • You pay a royalty fee of 20% of the gross profits you derive from the use of Project Gutenberg™ works calculated using the method you already use to calculate your applicable taxes. The fee is owed to the owner of the Project Gutenberg™ trademark, but he has agreed to donate royalties under this paragraph to the Project Gutenberg Literary Archive Foundation. Royalty payments must be paid within 60 days following each date on which you prepare (or are legally required to prepare) your periodic tax returns. Royalty payments should be clearly marked as such and sent to the Project Gutenberg Literary Archive Foundation at the address specified in Section 4, “Information
- 40. about donations to the Project Gutenberg Literary Archive Foundation.” • You provide a full refund of any money paid by a user who notifies you in writing (or by e-mail) within 30 days of receipt that s/he does not agree to the terms of the full Project Gutenberg™ License. You must require such a user to return or destroy all copies of the works possessed in a physical medium and discontinue all use of and all access to other copies of Project Gutenberg™ works. • You provide, in accordance with paragraph 1.F.3, a full refund of any money paid for a work or a replacement copy, if a defect in the electronic work is discovered and reported to you within 90 days of receipt of the work. • You comply with all other terms of this agreement for free distribution of Project Gutenberg™ works. 1.E.9. If you wish to charge a fee or distribute a Project Gutenberg™ electronic work or group of works on different terms than are set forth in this agreement, you must obtain permission in writing from the Project Gutenberg Literary Archive Foundation, the manager of the Project Gutenberg™ trademark. Contact the Foundation as set forth in Section 3 below. 1.F. 1.F.1. Project Gutenberg volunteers and employees expend considerable effort to identify, do copyright research on, transcribe and proofread works not protected by U.S. copyright law in creating the Project Gutenberg™ collection. Despite these efforts, Project Gutenberg™ electronic works, and the medium on which they may be stored, may contain “Defects,” such as, but not limited to, incomplete, inaccurate or corrupt data, transcription errors, a copyright or other intellectual property infringement, a defective or
- 41. damaged disk or other medium, a computer virus, or computer codes that damage or cannot be read by your equipment. 1.F.2. LIMITED WARRANTY, DISCLAIMER OF DAMAGES - Except for the “Right of Replacement or Refund” described in paragraph 1.F.3, the Project Gutenberg Literary Archive Foundation, the owner of the Project Gutenberg™ trademark, and any other party distributing a Project Gutenberg™ electronic work under this agreement, disclaim all liability to you for damages, costs and expenses, including legal fees. YOU AGREE THAT YOU HAVE NO REMEDIES FOR NEGLIGENCE, STRICT LIABILITY, BREACH OF WARRANTY OR BREACH OF CONTRACT EXCEPT THOSE PROVIDED IN PARAGRAPH 1.F.3. YOU AGREE THAT THE FOUNDATION, THE TRADEMARK OWNER, AND ANY DISTRIBUTOR UNDER THIS AGREEMENT WILL NOT BE LIABLE TO YOU FOR ACTUAL, DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE OR INCIDENTAL DAMAGES EVEN IF YOU GIVE NOTICE OF THE POSSIBILITY OF SUCH DAMAGE. 1.F.3. LIMITED RIGHT OF REPLACEMENT OR REFUND - If you discover a defect in this electronic work within 90 days of receiving it, you can receive a refund of the money (if any) you paid for it by sending a written explanation to the person you received the work from. If you received the work on a physical medium, you must return the medium with your written explanation. The person or entity that provided you with the defective work may elect to provide a replacement copy in lieu of a refund. If you received the work electronically, the person or entity providing it to you may choose to give you a second opportunity to receive the work electronically in lieu of a refund. If the second copy is also defective, you may demand a refund in writing without further opportunities to fix the problem. 1.F.4. Except for the limited right of replacement or refund set forth in paragraph 1.F.3, this work is provided to you ‘AS-IS’, WITH NO OTHER WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED,
- 42. INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY OR FITNESS FOR ANY PURPOSE. 1.F.5. Some states do not allow disclaimers of certain implied warranties or the exclusion or limitation of certain types of damages. If any disclaimer or limitation set forth in this agreement violates the law of the state applicable to this agreement, the agreement shall be interpreted to make the maximum disclaimer or limitation permitted by the applicable state law. The invalidity or unenforceability of any provision of this agreement shall not void the remaining provisions. 1.F.6. INDEMNITY - You agree to indemnify and hold the Foundation, the trademark owner, any agent or employee of the Foundation, anyone providing copies of Project Gutenberg™ electronic works in accordance with this agreement, and any volunteers associated with the production, promotion and distribution of Project Gutenberg™ electronic works, harmless from all liability, costs and expenses, including legal fees, that arise directly or indirectly from any of the following which you do or cause to occur: (a) distribution of this or any Project Gutenberg™ work, (b) alteration, modification, or additions or deletions to any Project Gutenberg™ work, and (c) any Defect you cause. Section 2. Information about the Mission of Project Gutenberg™ Project Gutenberg™ is synonymous with the free distribution of electronic works in formats readable by the widest variety of computers including obsolete, old, middle-aged and new computers. It exists because of the efforts of hundreds of volunteers and donations from people in all walks of life. Volunteers and financial support to provide volunteers with the assistance they need are critical to reaching Project Gutenberg™’s goals and ensuring that the Project Gutenberg™ collection will
- 43. remain freely available for generations to come. In 2001, the Project Gutenberg Literary Archive Foundation was created to provide a secure and permanent future for Project Gutenberg™ and future generations. To learn more about the Project Gutenberg Literary Archive Foundation and how your efforts and donations can help, see Sections 3 and 4 and the Foundation information page at www.gutenberg.org. Section 3. Information about the Project Gutenberg Literary Archive Foundation The Project Gutenberg Literary Archive Foundation is a non-profit 501(c)(3) educational corporation organized under the laws of the state of Mississippi and granted tax exempt status by the Internal Revenue Service. The Foundation’s EIN or federal tax identification number is 64-6221541. Contributions to the Project Gutenberg Literary Archive Foundation are tax deductible to the full extent permitted by U.S. federal laws and your state’s laws. The Foundation’s business office is located at 809 North 1500 West, Salt Lake City, UT 84116, (801) 596-1887. Email contact links and up to date contact information can be found at the Foundation’s website and official page at www.gutenberg.org/contact Section 4. Information about Donations to the Project Gutenberg Literary Archive Foundation Project Gutenberg™ depends upon and cannot survive without widespread public support and donations to carry out its mission of increasing the number of public domain and licensed works that can be freely distributed in machine-readable form accessible by the widest array of equipment including outdated equipment. Many
- 44. small donations ($1 to $5,000) are particularly important to maintaining tax exempt status with the IRS. The Foundation is committed to complying with the laws regulating charities and charitable donations in all 50 states of the United States. Compliance requirements are not uniform and it takes a considerable effort, much paperwork and many fees to meet and keep up with these requirements. We do not solicit donations in locations where we have not received written confirmation of compliance. To SEND DONATIONS or determine the status of compliance for any particular state visit www.gutenberg.org/donate. While we cannot and do not solicit contributions from states where we have not met the solicitation requirements, we know of no prohibition against accepting unsolicited donations from donors in such states who approach us with offers to donate. International donations are gratefully accepted, but we cannot make any statements concerning tax treatment of donations received from outside the United States. U.S. laws alone swamp our small staff. Please check the Project Gutenberg web pages for current donation methods and addresses. Donations are accepted in a number of other ways including checks, online payments and credit card donations. To donate, please visit: www.gutenberg.org/donate. Section 5. General Information About Project Gutenberg™ electronic works Professor Michael S. Hart was the originator of the Project Gutenberg™ concept of a library of electronic works that could be freely shared with anyone. For forty years, he produced and distributed Project Gutenberg™ eBooks with only a loose network of volunteer support.
- 45. Project Gutenberg™ eBooks are often created from several printed editions, all of which are confirmed as not protected by copyright in the U.S. unless a copyright notice is included. Thus, we do not necessarily keep eBooks in compliance with any particular paper edition. Most people start at our website which has the main PG search facility: www.gutenberg.org. This website includes information about Project Gutenberg™, including how to make donations to the Project Gutenberg Literary Archive Foundation, how to help produce our new eBooks, and how to subscribe to our email newsletter to hear about new eBooks.
- 46. Welcome to our website – the perfect destination for book lovers and knowledge seekers. We believe that every book holds a new world, offering opportunities for learning, discovery, and personal growth. That’s why we are dedicated to bringing you a diverse collection of books, ranging from classic literature and specialized publications to self-development guides and children's books. More than just a book-buying platform, we strive to be a bridge connecting you with timeless cultural and intellectual values. With an elegant, user-friendly interface and a smart search system, you can quickly find the books that best suit your interests. Additionally, our special promotions and home delivery services help you save time and fully enjoy the joy of reading. Join us on a journey of knowledge exploration, passion nurturing, and personal growth every day! ebookbell.com