How FairPlay Works

Schneier pointed to this very well done description of Apple's FairPlay, including a nice discussion of AAC:

How FairPlay Works: Apple's iTunes DRM Dilemma

Protected, purchased content is locked within iTunes; songs are not scrambled on Apple's server. This speeds and simplifies the transaction by delegating that work to iTunes on the local computer.

The result is an authorization system that does not require iTunes to verify each song with Apple as it plays. Instead, iTunes maintains a collection of user keys for all the purchased tracks in its library.

To play a protected AAC song, iTunes uses the matching user key to unlock the master key stored within the song file, when is then used to unscramble the song data.

Every time a new track is purchased, a new user key may be created; those keys are all encrypted and stored on the authorized iTunes computer, as well as being copied to Apple's servers.

When a new computer is authorized, it also generates a globally unique ID number for itself and sends it to Apple, which stores it as one of the five authorizations in the user account.

Apple's server sends the newly authorized machine the entire set of user keys for all the tracks purchased under the account, so all authorized systems will be able to play all purchased songs.

I didn't realize AAC was used by satellite radio. The essay also explains why Job wrote his anti-DRM post. The writing is really on the wall for DRM.