Some Advances in Broadcast Encryption and Traitor Tracing Duong - PowerPoint PPT Presentation

Some Advances in Broadcast Encryption and Traitor Tracing Duong Hieu Phan ( S´ eminaire LIPN - 18 Novembre 2014 ) Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 1 / 42

Multi-receiver Encryption From “One-to-one” to ‘one-to-many” communications Provide all users with the same key → problems: Impossibility to know the source of the key leakage (traitor) 1 Impossibility to revoke a user, except by resetting the parameters 2 Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 2 / 42

Broadcast Encryption [B91,FN94] & Traitor Tracing [CFN94] BO: 12 32:47 BO: 12 32:47 BO: 12 32:47 BO: 12 32:47 BO: 12 32:47 Desired Properties Tracing traitors from a pirate decoder 1 ◮ White-box tracing ◮ Black-box confirmation, black-box tracing Revoking non-legitimate users 2 Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 3 / 42

Broadcasting & Tracing Composed by G.Allegri (around 1630) for use in the Sistine Chapel on Wednesday and Friday Kept secret by the Vatican Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 4 / 42

Broadcasting & Tracing The piece was revealed in 1771 → Mozart Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 5 / 42

Broadcasting & Tracing The piece was revealed in 1771 → Mozart Only Mozart can do it! Same idea in traitor tracing: identify who is capable of producing the pirate decoder Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 5 / 42

Outline Randomized Exclusive Set System 1 Lattice-based Encryption 2 Extended Models 3 Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 6 / 42

Outline Randomized Exclusive Set System 1 Lattice-based Encryption 2 Extended Models 3 Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 7 / 42

Exclusive Set System (ESS) [ALO98] F is an ( N , ℓ, r , s ) -ESS if: F : a family of ℓ subsets of [ N ] For any R ⊆ [ N ] of size at most r , there exists S 1 , . . . S s ∈ F s.t. s � [ N ] − R = S i i = 1 Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 8 / 42

Exclusive Set System (ESS) [ALO98] F is an ( N , ℓ, r , s ) -ESS if: F : a family of ℓ subsets of [ N ] For any R ⊆ [ N ] of size at most r , there exists S 1 , . . . S s ∈ F s.t. s � [ N ] − R = S i i = 1 From ESS to Revoke System Each S i ∈ F is associated to a key K i User u receives all keys K i that u ∈ S i To revoke a set R ⊆ [ N ] of size at most r : ◮ Find S 1 , . . . S s ∈ F s.t. [ N ] − R = � s i = 1 S i ◮ Encrypt the message with each key K i Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 8 / 42

NNL Schemes viewed as Exclusive Set Systems [NNL01] S 1 S S 2 3 S S S S 5 6 7 4 S S S S S S S S 9 10 11 12 13 14 15 8 u u u u u u u u 2 3 5 1 4 6 7 8 F = { S 1 , S 2 , . . . , S 15 } S i contains all users ( i.e. leaves) in the subtree of node i (e.g. S 2 = { u 1 , u 2 , u 3 , u 4 } ) Revoked set R = { u 4 , u 5 , u 6 } Encrypt with keys at S 4 , S 7 , S 10 Complete-subtree is a ( N , 2 N − 1 , r , r log ( N / r )) -ESS Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 9 / 42

Exclusive Set System under Code’s View u 1 u 2 u 3 u 4 u 5 u 6 u 7 u 8 S 1 1 1 1 1 1 1 1 1 S 2 1 1 1 1 S 3 1 1 1 1 S 4 1 1 S 5 1 1 S 1 S 6 1 1 S S 2 3 S 7 1 1 S S S S 4 5 6 7 S 8 1 1 S S S S S S S S 12 14 9 10 11 13 15 8 S 9 1 u u u u u u u u 2 3 5 1 4 6 7 8 S 10 1 S 11 1 S 12 1 S 13 1 S 14 1 S 15 1 Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 10 / 42

NNL Schemes u 1 u 2 u 3 u 4 u 5 u 6 u 7 u 8 S 1 1 1 1 1 1 1 1 1 S 2 1 1 1 1 S 3 1 1 1 1 S 4 1 1 S 5 1 1 S 1 S 6 1 1 S 7 1 1 S S 2 3 S 8 1 1 S S 9 1 S S S 4 5 6 7 S 10 1 S S S S S S S S S 11 1 9 10 11 12 13 14 15 8 S 12 1 u u u u u u u u 2 3 5 1 4 6 7 8 S 13 1 S 14 1 S 15 1 Tracing Levels for NNL schemes Relaxed level of black-box tracing Black-box tracing for “naive” decoders Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 11 / 42

NNL Schemes u 1 u 2 u 3 u 4 u 5 u 6 u 7 u 8 S 1 1 1 1 1 1 1 1 1 S 2 1 1 1 1 S 3 1 1 1 1 S 4 1 1 S 5 1 1 S 1 S 6 1 1 S 7 1 1 S S 2 3 S 8 1 1 S S 9 1 S S S 4 5 6 7 S 10 1 S S S S S S S S S 11 1 9 10 11 12 13 14 15 8 S 12 1 u u u u u u u u 2 3 5 1 4 6 7 8 S 13 1 S 14 1 S 15 1 Weakness in Black-box Tracing Highly structured matrix Pirate could thus detect “dangerous” queries and refuse to decrypt Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 11 / 42

NNL Schemes u 1 u 2 u 3 u 4 u 5 u 6 u 7 u 8 S 1 1 1 1 1 1 1 1 1 S 2 1 1 1 1 S 3 1 1 1 1 S 4 1 1 S 5 1 1 S 1 S 6 1 1 S 7 1 1 S S 2 3 S 8 1 1 S S 9 1 S S S 4 5 6 7 S 10 1 S S S S S S S S S 11 1 9 10 11 12 13 14 15 8 S 12 1 u u u u u u u u 2 3 5 1 4 6 7 8 S 13 1 S 14 1 S 15 1 In General, Previous Results for ESS Black-box tracing for “naive” decoders (decrypt all ciphertexts without any strategy) c -traceability: a white-box tracing for “imperfect” decoders Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 11 / 42

NNL Schemes u 1 u 2 u 3 u 4 u 5 u 6 u 7 u 8 S 1 1 1 1 1 1 1 1 1 S 2 1 1 1 1 S 3 1 1 1 1 S 4 1 1 S 5 1 1 S 1 S 6 1 1 S 7 1 1 S S 2 3 S 8 1 1 S S 9 1 S S S 4 5 6 7 S 10 1 S S S S S S S S S 11 1 9 10 11 12 13 14 15 8 S 12 1 u u u u u u u u 2 3 5 1 4 6 7 8 S 13 1 S 14 1 S 15 1 Our Objectives Black-box tracing in ESS for “smart” decoders (efficiency comparable to NNL schemes) Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 11 / 42

Randomized ESS Recall 1 row → 1 subset → 1 key 1 column → 1 user → user j has key K i iff M ij = 1 Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 12 / 42

Randomized ESS Recall 1 row → 1 subset → 1 key 1 column → 1 user → user j has key K i iff M ij = 1 Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 12 / 42

Randomized ESS Property Set n = r log 2 ( N 2 e / r ) , b = 4 r With overwhelming probability → ( N , 8 r 2 log N , r , 8 r log N ) -ESS. (complete-subtree is ( N , 2 N − 1 , r , r ( log ( N / r )) -ESS) Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 12 / 42

Tracing for ESS White-box Tracer can open the box → get the pirate word w which is the union of traitors’ codewords Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 13 / 42

White-box Tracing for ESS White-box Tracing ( r , s , N , l ) -ESS is also a r -disjunct matrix, i.e., no column is contained in the union of any r other columns r -disjunct matrix: from the union of at most r columns, one can find back the r columns (the Group Testing technique ) ↔ Given the pirate word w , trace back the traitors Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 14 / 42

White-box Tracing for ESS White-box Tracing ( r , s , N , l ) -ESS is also a r -disjunct matrix, i.e., no column is contained in the union of any r other columns r -disjunct matrix: from the union of at most r columns, one can find back the r columns (the Group Testing technique ) ↔ Given the pirate word w , trace back the traitors Challenge for Black-box Tracing How to find the pirate word w ? Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 14 / 42

Black-box Tracing for ESS Shadow Group Testing Technique[NPP , Algorithmica13] Black-box access to pirate decoder Asking random queries of the same form as broadcasted ciphertexts Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 15 / 42

Black-box Tracing for ESS Shadow Group Testing Technique[NPP , Algorithmica13] Black-box Access to Pirate Decoder Asking random queries of the same form as broadcasted ciphertexts Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 15 / 42

Black-box Tracing for ESS Shadow Group Testing Technique[NPP , Algorithmica13] Test the decryptability of the piarte decoder on the queries → Get “Feedback” vector = union of the columns at position 1 in the pirate word w Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 15 / 42

Black-box Tracing for ESS Shadow Group Testing Technique[NPP , Algorithmica13] We show that the matrix of queries is also an ESS → From “Feedback” vector, get the pirate word w Large number of queries → the tracing is efficient when the number of traitors is O ( log N ) Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 15 / 42

Black-box Tracing for ESS Shadow Group Testing Technique[NPP , Algorithmica13] In brief: We get ( N , 8 r 2 log N , r , 8 r log N ) -ESS Ciphertext: constant factor w.r.t the complete-subtree and a log N factor w.r.t the subset-difference scheme The first black-box tracing ESS against non-naive pirates Duong Hieu Phan Some Advances in BE&TT S´ eminaire LIPN 15 / 42