collusion resistant broadcast encryption with short ciphertexts and private key s n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Key s PowerPoint Presentation
Download Presentation
Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Key s

Loading in 2 Seconds...

play fullscreen
1 / 18

Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Key s - PowerPoint PPT Presentation


  • 173 Views
  • Uploaded on

Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Key s. Dan Boneh, Craig Gentry, and Brent Waters. Broadcast Encryption [FN’93]. Encrypt to arbitrary subsets S. Collusion resistance : secure even if all users in S c collude. d 1. CT = E[M,S]. d 2.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Key s' - emily


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
collusion resistant broadcast encryption with short ciphertexts and private key s

Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Keys

Dan Boneh, Craig Gentry, and Brent Waters

broadcast encryption fn 93
Broadcast Encryption [FN’93]
  • Encrypt to arbitrary subsets S.
  • Collusion resistance:
    • secure even if all users in Sc collude.

d1

CT = E[M,S]

d2

S  {1,…,n}

d3

broadcast encryption
Broadcast Encryption
  • Public-key BE system:
    • Setup(n): outputs private keys d1 , …, dn

and public-key PK.

    • Encrypt(S, PK, M):

Encrypt M for users S  {1, …, n}

Output ciphertext CT.

    • Decrypt(CT, S, j, dj, PK): If j  S, output M.
  • Note: broadcast contains ( [S], CT )
trivial solutions
Trivial Solutions
  • Small private key, large ciphertext.
    • Every user j has unique private key dj .

CT = { Edj[M] | jS }

|CT| = O(|S|) |priv| = O(1)

  • Large private keys, small ciphertexts
    • Unique key KS for every subset S  {1, …, n}
    • User j’s priv-key: dj = { KS | jS }

|CT| = O(1) |priv| = O(2n)

outline
Outline
  • Previous work
  • Security Definitions
  • Overview scheme
  • Applications
  • Conclusions
previous solutions
Previous Solutions
  • t-Collusion resistant schemes [FN’93]
    • Resistant to t-colluders
    • |CT| = O(t2log n) |priv| = O(tlog n)
    • Attacker knows t
  • Broadcast to large sets [NNL,HS,GST]
    • |CT|= O(r) |priv|=O(log n)
    • Useful if small number of revoked players
summary

EFS, Email

Subs. Service

DVD’s

Summary

n

0

broadcast encryption security

S  {1, …, n }

PK, { dj| j  S }

m0, m1  G

C* = Enc( S, PK, mb)

b’  {0,1}

Broadcast Encryption Security
  • Semantic security when users collude. (static adversary)
  • Def: Alg. A -breaks BE sem. sec. if Pr[b=b’] > ½ + 
  • (t,)-security: no t-time alg. can -break BE sem. sec.

Challenger

Attacker

RunSetup(n)

b{0,1}

bilinear maps
Bilinear Maps
  • G , GT : finite cyclic groups of prime order p.
  • Def: An admissible bilinear mape: GG GTis:
    • Bilinear:e(ga, gb) = e(g,g)ab a,bZ, gG
    • Non-degenerate:g generates G  e(g,g) generates GT .
    • Efficiently computable.
broadcast system
Broadcast System
  • Setup(n): g  G , ,   Zp, gk = g(k)

PK = ( g, g1, g2, … , gn , gn+2 , …, g2n , v=g )  G2n+1

For k=1,…,n set: dk = (gk)  G

  • Encrypt(S, PK, M): t  Zp

CT = ( gt , (v  jS gn+1-j)t , Me(gn,g1)t )

  • Decrypt(CT, S, k,dk, PK): CT = (C0, C1, C2)

Fact: e( gk, C1 ) / e( dk gn+1-j+k , C0 ) = e(gn,g1)t

jSjk

security theorem
Security Theorem
  • Thm:

 t-time alg. that -breaks BE sem. sec. in G

 t-time alg. that -solves bilinear n-DDHE in G.

~

app encrypted file systems

EPKC[KF]

Header< 256K

App : Encrypted File Systems
  • Broadcast to small sets: |S| << n
  • Best construction: trivial. |CT|=O(|S|) , |priv|=O(1)
  • Examples: EFS.

MS Knowledge Base:EFS has a limit of 256KB in the file header for the EFS metadata. This limits the number of individual entries for file sharing to a maximum of 800 users.

EPKB[KF]

EPKA[KF]

File FEKF[F]

apps sharing in enc file system

[S]

E[S,PK,KF]

Hdr

File FEKF[F]

Apps: Sharing in Enc. File System
  • Store PK on file system. n=216 |PK|=1.2MB
  • File header: ([S], E[S,PK,KF])
  • Sharing among “800” users:
    • 8002 + 40 = 1640 bytes << 256KB
  • Each user obtains priv-key duid  G from admin.
    • Admin only stores   Zq

S  {1, …, n }

40 bytes

incremental file sharing

C0

C1

[S]

E[S,PK,KF]

NonceF

Hdr

File FEKF[F]

Incremental file sharing
  • File hdr: ([S], gt , (v  jS gn+1-j)t)
  • To grant user u access to file F,

owner does: C1 C1  (gn+1-u)t

  • File owner: instead of storing t for every file do: t  PRFKO (NonceF )
app secure email lists
App: secure email lists
  • Set n=216. Let gk = g(k)Suppose (g, g1, g2,…, gn, gn+2,…, g2n) are global (1.2MB)
  • Simple encrypted email lists:
    • ListA: PKA = (vA = gA) ; ListB: PKB = (vB = gB)
    • When new user joins ListA do:
      • Assign new index 1  k  216,give key dk = (gk)A
    • Encrypt msgs to ListA using B.E. for current members.
  • Much simpler than existing techniques (e.g. LKH)
summary and open problems
Summary and Open Problems
  • New public-key broadcast encryption systems:
    • Full collusion resistance. Constant size priv key.
    • System 1: |CT| = O(1) |PK| = O(n)
    • System 2: |CT| = O(n) |PK| = O(n)
  • Open problems:
    • Reduce public key size. Weaker assumption.
    • Security against adaptive adversary.
    • Tracing traitors with same parameters.
apps content protection

4216 G.E.

Apps: Content Protection
  • DVD content protection: n = 232. r – revoked.
    • No room for PK in player.
    • Store ( [S], CT, PK) on each DVD disk.
    • Goal: minimize |CT|+|PK|  n system
  • Using n system: |PK|=O(n) , |CT|=O(n) :

|DVD-hdr| = |PK|+|CT|+|[S]| = 5MB + (4r bytes)

  • NNL-type: |DVD-hdr| = |CT|+|[S]| = (36r bytes)
app content protection
App : Content Protection
  • DVD Content Protection. n = 232
    • DVD player i ships with private key di
    • DVD disks encrypted to unrevoked players.
  • Broadcast to large sets: |S| = n-r where r << n.

d1

d2

d3

d4