Improved Anonymous Broadcast Encryptions

Abstract

Abstract. We investigate anonymous broadcast encryptions (ANOBE) in which a ciphertext hides not only the message but also the target recipients associated with it. Following Libert et al.'s generic construction [PKC, 2012], we propose two concrete ANOBE schemes with tight reduction and better space efficiency.-The IND-CCA security and anonymity of our two ANOBE schemes can be tightly reduced to standard k-Linear assumption (and the existence of other primitives). For a broadcast system with n users, Libert et al.'s security analysis suffers from O(n 3 ) loss while our security loss is constant. -Our first ANOBE supports fast decryption and has a shorter ciphertext than the fast-decryption version of Libert et al.'s concrete ANOBE. Our second ANOBE is adapted from the first one. We sacrifice the fast decryption feature and achieve shorter ciphertexts than Libert et al.'s concrete ANOBE with the help of bilinear groups. Technically, we start from an instantiation of Libert et al.'s generic ANOBE [PKC, 2012], but we work out all our proofs from scratch instead of relying on their generic security result. This intuitively allows our optimizations in the concrete setting.

Tight lower bounds and optimal constructions of anonymous broadcast encryption and authentication

“…To formally describe them, we give a formal syntax of AtBE, whereas Kiayias and Samari considered an informal one. • Our lower bounds hold for most of the previous Anonymous BEs (i.e., BE schemes in [3,24,25]), since we only assume the properties common to them. On the other hand, it is unclear that the special property implicitly assumed in [20] holds for these BE schemes.…”

“…Throught this paper, we call a scheme optimal if a coefficient of a dominant term in the ciphertext-size is one. Li and Gong [24] proposed an optimal ANO-BE scheme where the ciphertext-size is (|S| + 6) • κ. On the other hand, there exists no optimal Full-ANO-BE scheme.…”

“…Since any ciphertext-size in IND-CCA secure PKE must be at least 2 • κ to the best of our knowldege, the most efficient Full-ANO-BE scheme in terms of the ciphertext-size has ciphertexts whose size is 2N • κ + |σ |. In this paper, we propose a Full-ANO-BE scheme where the ciphertext-size is (N + 6) • κ based on Li and Gong's ANO-BE scheme [24]. From our Full-ANO-BE scheme and ANO-BE scheme in [24], we show that the ciphertext-size in ANO-BE and Full-ANO-BE are upper bounded by…”

“…For example, the pay-TV service sometimes requires users' privacy as well as the confidentiality of contents. To address to the security requirement, several works [3,20,24,25] have proposed BE schemes meeting anonymity, 1 which ensures that no information on the designated recipients in S is leaked from ciphertexts ct S . Two main notions were introduced for anonymity, called anonymity and full anonymity by Barth et al [3] and Kiayias and Samari [20], respectively.…”

“…In this work, we also give an analysis of the authenticator sizes required for ABA, though we mainly focus on Anonymous BE. Ciphertext size of anonymous BE The previous work [3,20,24,25] has presented several Anonymous BE schemes having ciphertexts where its size grows linearly with the number of designated recipients or all recipients. Specifically, the ciphertext sizes of the ANO-BE schemes are O (|S| • κ) and those of the Full-ANO-BE schemes are O (N • κ), where |S| and N are the numbers of designated recipients and all recipients in the system, respectively, and κ is a security parameter.…”