We address the problem of distributing a grouporiented secret from a centralized key server to a number of privileged recipients, known as broadcast encryption. In a set of existent schemes, this common shared secret is distributed as an arithmetic remainder embedded in a broadcast keying message, such that upon receiving the message, a legitimate recipient only needs to perform one modular operation upon the keying information to derive the secret. In this article, however, we point out a generic weakness in these protocols and demonstrate efficient methods for cryptanalysis. The presented approaches follow a collision attack paradigm and can work in a manner that even a completely passive outsider may somehow acquire the secret. Numerical analysis shows that in practical scenarios, our technique can compromise the common shared secret with a significant probability, implying that these broadcast encryption schemes are highly vulnerable.Index Terms-Data and communication security, broadcast encryption, common secret, remainder, collision, passive outsider attack, magic number.
I. INTRODUCTIONThe broadcast encryption (BE) problem [1] [2] involves distributing a common shared secret, typically in the form of a short-term group key, from a centralized key server (KS) to a large number of intended receivers forming a possibly dynamic subscriber group, such that at any give time instance only the privileged group members are able to actually utilize certain application data that are publicly available, e.g., from a broadcast communication channel.In a large number of BE applications ranging from DVD encryption [1]-[3] to multicast access control [4]-[9] and teleconference [10] [11], the application data are protected by a symmetric cipher with the (short-term) group key; only legitimate users hold confidential information to first derive the common secret and then decrypt the data:• In BE solutions, cost-efficient manipulations like arithmetic operations, one-way (hash) functions, and symmetric encryptions / decryptions are preferred in distributing the common secret itself [1]. As an approach for content protection, broadcast encryption is envisioned to promise more flexible and resilient security compared with traditional public-key cryptography techniques [2]. • Moreover, in many cases the receivers are assumed to be stateless [3], i.e., they hold certain static cryptographic information like a pairwise key shared with the KS, and they do not update their rekey states from session to