broadcast encryption.pptVIP

Jan. 11, 2001 SUCSES Project Fully Collusion Resistant Traitor Tracing with Short Ciphertexts and Private Keys Broadcast Systems Tracing Pirate Devices[CFN’94] FAQ-1 “The Content can be Copied?” DRM- Impossibility Argument Protecting the service Goal: Stop attacker from creating devices that access the original broadcast FAQ 2-Why black-box tracing? [BF’99] D: may contain unrecognized keys,  is obfuscated, or tamper resistant. All we know: Pr[ M ? G, C ? Encrypt (PK, M) : D(C)=M] 1-? Formally: Secure TT systems (1) Semantically secure, and (2) Traceable: Brute Force System Setup (n): Generate n PKE pairs (PKi, Ki) Output private keys K1 , …, Kn  PK ? (PK1, …, PKn) , TK ? PK . Encrypt (PK, M): C ? ( EPK1(M), …, EPKn(M) ) Tracing: next slide. This is the best known TT system secure under arbitrary collusion. … until now TraceD(PK): [BF99, NNL00, KY02] For i = 1, …, n+1 define for M ? G : pi := Pr[ D( EPK1(?), …, EPKi-1(?), EPKi(M), …, EPKn(M) ) = M ] Then: p1 1- ? ; pn+1 ? 0 1-? = |pn+1 – p1 | = | ? pi+1 – pi | ? ? |pi+1 – pi | ? Exists i?{1,…,n} s.t. | pi+1 – pi | ? (1- ?)/n ? User i must be one of the pirates. Security Theorem Tracing algorithm estimates: | pi - pi | (1-?)/4n Need O(n2) samples per pi. (D – stateless) Cubic time tracing. Can be improved to quadratic in |S| . Thm: underlying PKE system is semantically secure ? No eff. adv wins tracing game with non-neg adv. Abstracting the Idea [BSW’06] Properties needed: For i = 1 ,… , n+1 need to encrypt M so: Without Ki adversary cannot distinguish: Enc(i, PK, M) from Enc(i+1, PK, M) Private Linear Broadcast Enc (PLBE) Setup(n): outputs private keys K1 , …, Kn and public-key PK. Encrypt( u, PK, M): Encrypt M for users {u, u+1, …, n} Output ciphertext CT. Decrypt(CT, j, Kj, PK): If j ? u, output M Broadc