In Crypto＇05, Boneh et al. presented two broadcast encryption schemes. Their work has exciting achievements： the header （also called ciphertexts） and the private keys are of constant size. In their paper, they giv...In Crypto＇05, Boneh et al. presented two broadcast encryption schemes. Their work has exciting achievements： the header （also called ciphertexts） and the private keys are of constant size. In their paper, they give an open question to construct a traitor tracing algorithm for their broadcast encryption schemes, and combine the two systems to obtain an efficient trace-and-revoke system. In this paper, we give a negative answer to their open question. More precisely, we show that three or more insider users are able to collude to forge a valid private key for pirate decoding against their schemes. Moreover, we prove that there exists no traitor tracing algorithm to identify the colluders. Our pirate decoding can also similarly be applied to Lee et al.＇s broadcast encryption schemes in ISPEC＇06.展开更多
T6 et al presented a bilinear-map-based traitor tracing scheme（TSZ scheme） with revocation, but it is a symmetric scheme because it does not provide non-repudiation. In this paper, an improved TSZ scheme was propose...T6 et al presented a bilinear-map-based traitor tracing scheme（TSZ scheme） with revocation, but it is a symmetric scheme because it does not provide non-repudiation. In this paper, an improved TSZ scheme was proposed by using oblivious polynomial evaluation （OPE） protocol and service parameters. Under the recondition of general sameness capabilities of both TSZ and improved TSZ scheme, the new scheme adds some advantages such as providing multi-service capability, user＇s non-repudiation and data provider＇s no-framing innocent users. Furthermore, it is also proved to be semantically secure under the decisional bilinear Diffie-Hellman （DBDH problem） assumption.展开更多
Three broadcast schemes for small receiver set using the property of RSA modulus are presented. They can solve the problem of data redundancy when the size of receiver set is small. In the proposed schemes, the center...Three broadcast schemes for small receiver set using the property of RSA modulus are presented. They can solve the problem of data redundancy when the size of receiver set is small. In the proposed schemes, the center uses one key to encrypt the message and can revoke authorization conveniently. Every authorized user only needs to store one decryption key of a constant size. Among these three schemes, the first one has indistinguishability against adaptive chosen ciphertext attack （IND-CCA2） secure, and any collusion of authorized users cannot produce a new decryption key but the sizes of encryption modulus and ciphertext are linear in the number of receivers. In the second scheme, the size of ciphertext is half of the first one and any two authorized users can produce a new decryption key, but the center can identify them using the traitor tracing algorithm. The third one is the most efficient but the center cannot identify the traitors exactly.展开更多
基金the National Natural Science Foundation of China (Grant Nos. 60303026, 60573030, and 60673077)
文摘In Crypto＇05, Boneh et al. presented two broadcast encryption schemes. Their work has exciting achievements： the header （also called ciphertexts） and the private keys are of constant size. In their paper, they give an open question to construct a traitor tracing algorithm for their broadcast encryption schemes, and combine the two systems to obtain an efficient trace-and-revoke system. In this paper, we give a negative answer to their open question. More precisely, we show that three or more insider users are able to collude to forge a valid private key for pirate decoding against their schemes. Moreover, we prove that there exists no traitor tracing algorithm to identify the colluders. Our pirate decoding can also similarly be applied to Lee et al.＇s broadcast encryption schemes in ISPEC＇06.
基金Supported by the National Natural Science Foundation of China (60372046)
文摘T6 et al presented a bilinear-map-based traitor tracing scheme（TSZ scheme） with revocation, but it is a symmetric scheme because it does not provide non-repudiation. In this paper, an improved TSZ scheme was proposed by using oblivious polynomial evaluation （OPE） protocol and service parameters. Under the recondition of general sameness capabilities of both TSZ and improved TSZ scheme, the new scheme adds some advantages such as providing multi-service capability, user＇s non-repudiation and data provider＇s no-framing innocent users. Furthermore, it is also proved to be semantically secure under the decisional bilinear Diffie-Hellman （DBDH problem） assumption.
基金supported by the National Natural Science Foundation of China (60473029)the National Basic Research Program of China (2007CB311201)the Open Foundation of Beijing Institute of Electronic Science and Technology.
文摘Three broadcast schemes for small receiver set using the property of RSA modulus are presented. They can solve the problem of data redundancy when the size of receiver set is small. In the proposed schemes, the center uses one key to encrypt the message and can revoke authorization conveniently. Every authorized user only needs to store one decryption key of a constant size. Among these three schemes, the first one has indistinguishability against adaptive chosen ciphertext attack （IND-CCA2） secure, and any collusion of authorized users cannot produce a new decryption key but the sizes of encryption modulus and ciphertext are linear in the number of receivers. In the second scheme, the size of ciphertext is half of the first one and any two authorized users can produce a new decryption key, but the center can identify them using the traitor tracing algorithm. The third one is the most efficient but the center cannot identify the traitors exactly.
