This info is described in several lexicons on the net (search on "lexicon" on this board).
Briefly:
there is a heirarchy of Irdeto keys.
(Hex-)Masterkey is the most "powerful".
then PlainMasterKey
finally Plainkey
Note: "plain" refers to the form of key which is stored in the moemory and will not be subject to further decryption. IE it is the "output" (say) of the decryption, and the key directly referenced by the CAM every minute or so when watching TV.
The keys that change as often as once per hour on some providers (eg SCT, Nova) are the plainkeys.
The PMK (actually paired with a "provider-id") changes ad hoc, usually when the provider gets wind of the fact that there is another PMK/Prov-id in circulation, built into the goldwafer files for example.
The (hex-) Masterkey does not change as such, but can be killed. That is the key which is uniquely associated with an actual subscriber somewhere. And these are the keys which everyone is so cautious not to publish. After all, if the hexmasterkey of your own officially paid-for subscription were to enter the public domain and the providers discovered that, they would kill it - and so disable your officially paid-for subscription (leaving you pretty unhappy I imagine).
A card which contains a valid hexmasterkey will automatically update on pmk/prov-id. That's why official subscriber cards continue to work through all the key changes.
A card which contains no hex-masterkey but does contain a PMK+prov-id will automatically update on plainkey but the pmk/prov-id itself will not update. That's why people like Strsh & Beamer are kept busy constantly updating their goldwafer files. That's why even when you think you have an auto-updating goldwafer, eventually certain providers will nevertheless stop working (most frequently Nova/Hellas & SCT) - i.e. because the providers have "disabled" the PMK.
I think that Service keys are some kind of super key which allows the creation of clone-cards and for some reason can not be killed. But exactly what it does and how I'm not sure on. The Stream service key is in the public domain.
I invite others to help here.
2old
