Graph-Decomposition-Based Frameworks for Subset-Cover Broadcast Encryption and Efficient Instantiations

Abstract

Abstract. We present generic frameworks for constructing efficient broadcast encryption schemes in the subset-cover paradigm, introduced by Naor et.al., based on various key derivation techniques. Our frameworks characterize any instantiation completely to its underlying graph decompositions, which are purely combinatorial in nature. This abstracts away the security of each instantiated scheme to be guaranteed by the generic one of the frameworks; thus, gives flexibilities in designing schemes. Behind these are new techniques based on (trapdoor) RSA accumulators utilized to obtain practical performances. We then give some efficient instantiations from the frameworks. Our first construction improves the currently best schemes, including the one proposed by Goodrich et.al., without any further assumptions (only pseudorandom generators are used) by some factors. The second instantiation, which is the most efficient, is instantiated based on RSA and directly improves the first scheme. Its ciphertext length is of order O(r), the key size is O(1), and its computational cost is O(n 1/k log 2 n) for any (arbitrary large) constant k; where r and n are the number of revoked users and all users respectively. To the best of our knowledge, this is the first explicit collusion-secure scheme in the literature that achieves both ciphertext size and key size independent of n simultaneously while keeping all other costs efficient, in particular, sub-linear in n. The third scheme improves Gentry and Ramzan's scheme, which itself is more efficient than the above schemes in the aspect of asymptotic computational cost.

A Novel Broadcast Encryption Scheme Based on SD Scheme Reconstruction

“…Tree-based schemes usually use balanced binary tree or n-ary(n > 2) tree to organize users' subsets, and assigns subset keys following "Subset Cover" [5] concept. Those schemes include Complete Subtree(CS) scheme [5], Subset Difference(SD)scheme [5], Layered Subset Difference(LSD) [6] scheme, Stratified Subset Difference(SSD) scheme [7], Graph Decomposition scheme [8], RSA accumulator-based scheme [9][10] [11] and so on.Chainbased schemes use hash chain to organize users' subsets and keys. Their subset deduction procedure always can be seen as forming an interval from a line.…”

Forward-Secure and Searchable Broadcast Encryption with Short Ciphertexts and Private Keys

“…3 The only constraint is that hdr = hdr if either ID = ID or ID is a prefix of ID . In both cases, C responds as in Phase 1.…”

“…The previously best schemes [20,19,18], along the line of the subset-cover paradigm by Naor, Naor, and Lotspiech (NNL) [20], can only achieve a broadcast ciphertext of size O(r) with each user's private key being of size O(log n), where r = n − |S| is the number of revoked users. Although these schemes are improved in [3] by reducing the private key size to O (1), the ciphertext is still of size O(r). 1 These NNL derivatives are originally private-key schemes.…”

Public Key Broadcast Encryption with Low Number of Keys and Constant Decryption Time

“…Without considering the time of scanning the header to find out his containing subset, each user needs to perform 2 modular exponentiations and 3 pairing functions. Thus, the decryption cost is O (1).…”

“…with the same probability 1 Similarly, we can modify our PBE-SD-PI scheme to have IND-CCA security like Section 4…”