And also, in my mind, a decryption key is not copyrightable - it's a utility number. Clean room is meant to avoid any doubt of copyright violations, so if this isn't copyrightable then it shouldn't be a problem right?
Way back in the early days of emulation, I recall that PS1 emulators (before a workable reverse engineered BIOS was available) would be distributed, but you had to find a bios dump and provide it to the emulator to actually load a game. This helped avoid infringement but of course was a 'hurdle' in getting things running. TBF, it wasn't that bad if you knew how to search right or had a buddy in the scene that knew a good place to download one [0].
On an unrelated note, is it bad that (most of) those early emulation sites seemed less intrusive with popups/adverts than the legitimate news sites of today?
[0] - There was a period where anyone brave enough to distribute a BIOS but allow their page to get indexed by a search engine, stood a good risk of getting a C&D/DMCA.
This is not about copyright, this is about circumventing a copy protection. See https://en.wikipedia.org/wiki/Illegal_number, which is also cited in the above video. Therefore, it also makes no difference from where this number actually comes from, "clean room approach" makes no difference here.
I think this is where DMCA has overreach imho. It's one of the worst pieces of legislations to have been created regarding copyright and intellectual property.
IF KFC dropped a recipe card and you found it with 5 of the 7 spices and you cracked the final 2, can KFC come after you? How is that any different from Nintendo being sloppy and dropping their decryption key in memory for someone to find?
Say you found all but the last 4 bytes of the key on the ground and you cracked the last 4 yourself? What if Nintendo published the entire key by accident on Github?
What is the point of keeping a private key private if it's illegal to use it if it's not yours? None of it makes sense.
https://youtube.com/watch?v=hsQtv5IvrD8&feature=share7