A Revocation Scheme with Minimal Storage at Receivers

Abstract

Abstract. A revocation or a broadcast encryption technology allows a sender to transmit information securely over a broadcast channel to a select group of receivers excluding some revoked receivers. In this paper we propose two efficient revocation methods which are suitable for stateless receivers. The proposed methods use an a-ary key tree structure and require at most r log (N/r) log a + 1 ciphertexts broadcast. Our Method 1 requires only one key to be stored and O 2 a log 5 N log a computational overhead at a receiver, whereas Method 2 requires log N log a keys and O (2 a ) computational overhead, where N and r respectively denote the total number of receivers and the number of revoked receivers. Our methods are very efficient with respect to the number of keys each receiver stores, especially Method 1 minimizes it.

Graph-Decomposition-Based Frameworks for Subset-Cover Broadcast Encryption and Efficient Instantiations

“…Almost all subset-cover broadcast encryption schemes based on PRSG (or one-way function) or RSA accumulator in the literature can be rewritten as instantiations in our paradigms. In fact, [18,14,17,4,12,20,15] can be viewed as PRSG-instantiated schemes and [2,3,11] are non-trapdoor-RSA-instantiated schemes from our frameworks.…”

“…In this paper, we characterize the two orthogonal components in general. We then explicitly present three generic sub-frameworks for computational key derivation component (generic as arbitrary set systems are ap- 2kr ≤ log n + 1 -O(n 1/k ) RSA Accumulator -based ↓ Asano [2] O(r log a ( n r )+r) 1 O(2 a log 5 a n) O(2 a log 2 a n) The main issue is that we characterize three sub-frameworks so that such instantiations in these frameworks and their resulting efficiencies will depend solely on properties related to graph decompositions of the set systems being instantiated; while in the same time the security will be guaranteed automatically from the general frameworks. The PRSG based framework will be based on tree decomposition, and the two RSA based frameworks will be based on chain decomposition; both are purely combinatorial.…”

“…The number of primes used per user is optimal as being O(log n) for (LSIC[k]) acc and further reduced to O((log n)/k) for (LSIC[k]) tacc (so that the on-the-fly prime generation cost is O((log 5 n)/k 5 )). Had one used the non-optimal AklTaylor's framework as put forth to the context of BE by [2,3,11], it would be O(n 1/k log n) which is super-logarithmic (and the prime generation cost would be O(n 1/k log 5 n)).…”

“…(And in fact, ours uses only a constant number of primes). The previous improvement for this class of schemes was done by [11] to improve [2] but only in the constant term involving a. (See Table 1).…”

“…Schemes which were considered the current state of the art (before two very recent works, see below) are: (i) Pseudo-random sequences generator (PRSG) based schemes such as the Subset Difference scheme (SD) [18], its refinement-the Layered SD scheme (LSD) [14], and their somewhat generalizations in [4]. (ii) RSA accumulator based schemes such as Asano's scheme [2], and its optimal generalizations in [3,11]. See Table 1 for the efficiency comparison.…”