On Some Methods for Unconditionally Secure Key Distribution and Broadcast Encryption

Stinson, D. R.

doi:10.1007/978-1-4615-5489-9_2

Cited by 49 publications

(65 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…There have been several works in this area [Sti97], [SW98] since then, but the most popular scheme out of these is the tree-based Subset Difference (SD) method of [NNL01]. Since it is a symmetric key based scheme, it is very efficient in terms of encryption and decryption time.…”

Section: What Is Broadcast Encryption?mentioning

confidence: 99%

Complete tree subset difference broadcast encryption scheme and its analysis

Bhattacherjee

Sarkar

2012

Des. Codes Cryptogr.

View full text Add to dashboard Cite

The Subset Difference (SD) method proposed by Naor-Naor-Lotspeich is the most popular broadcast encryption (BE) scheme. It is suitable for real-time applications like Pay-TV. It has been suggested for use by the AACS standard for digital rights management in Blu-Ray and DVD discs. The SD method assumes the number of users to be a power of two. (1) We propose the Complete Tree Subset Difference (CSD) method that subsumes the SD method by allowing arbitrary number of users in the system. All the results obtained in this work for the CSD scheme hold good for the SD scheme by assuming the number of users to be the next power of two. (2) Given the importance of the SD scheme, its detailed combinatorial analysis is of practical interest. We find recurrences for the CSD scheme to count the number of possible ways r users in the system of n users can be revoked to result in a transmission overhead (header length) of h. The header length h of a broadcast is an important efficiency parameter in BE. The usefulness of these recurrences is demonstrated by generating exhaustive data of the above count, obtaining bounds on the header length and various other interesting results some of which are difficult to prove without the recurrences. (3) An O(r log n) time algorithm is proposed to compute the expected header length in the CSD scheme for n users in the system, r out of which are revoked. This algorithm is of practical interest in its own right, for efficiency and performance analysis of the CSD scheme. Using this algorithm, we show that for practical values of n and r, the transmission efficiency of the CSD scheme is better than the SD scheme. For n a power of two and a fixed r ≥ 2, we obtain an upper bound on the expected header length and show that this bound is also the limit as n → ∞.

show abstract

Section: What Is Broadcast Encryption?mentioning

confidence: 99%

Complete tree subset difference broadcast encryption scheme and its analysis

Bhattacherjee

Sarkar

2012

Des. Codes Cryptogr.

View full text Add to dashboard Cite

show abstract

“…Blundo, Mattos and Stinson [7], as well as Kurosawa, Yoshida, Desmedt and Burmester [21] showed other interesting bounds on required memory sizes. In [29], in depth survey of various constructions of KPS and corresponding properties has been investigated. KPS may seem to be the best building blocks for unconditionally secure communication systems, however, they are not suitable for certain applications e.g.…”

Section: Related Workmentioning

confidence: 99%

Unconditionally Secure Anonymous Encryption and Group Authentication

Hanaoka

Shikata

Hanaoka³

et al. 2002

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract.Anonymous channels or similar techniques that can achieve sender's anonymity play important roles in many applications. However, they will be meaningless if cryptographic primitives containing his identity is carelessly used during the transmission. The main contribution of this paper is to study the security primitives for the above problem. In this paper, we first define unconditionally secure asymmetric encryption scheme (USAE), which is an encryption scheme with unconditional security and is impossible for a receiver to deduce the identity of a sender from the encrypted message. We also investigate tight lower bounds on required memory sizes from an information theoretic viewpoint and show an optimal construction based on polynomials. We also show a construction based on combinatorial theory, a non-malleable scheme and a multi-receiver scheme. Then, we define and formalize group authentication code (GA-code), which is an unconditionally secure authentication code with anonymity like group signatures. In this scheme, any authenticated user will be able to generate and send an authenticated message while the receiver can verify the legitimacy of the message that it has been sent from a legitimate user but at the same time retains his anonymity. For GA-code, we show two concrete constructions.

show abstract

“…Key distribution patterns (KDP) [16] are explicitly or implicitly used by numerous authors to construct key distribution systems [9,12,14,17,22,23] …”

Section: A General Constructionmentioning

confidence: 99%

“…A Key Distribution Systems (KDS) is one of the main primitives for distributing keys in network and group communication [22]. In a KDS, the collection of all subsets of n users is divided into privileged subsets and forbidden subsets.…”

Section: A Secure Dynamic Conference Systemmentioning

confidence: 99%

Broadcast Authentication in Group Communication

Wang

1999

Advances in Cryptology - ASIACRYPT’99

View full text Add to dashboard Cite

Abstract. Traditional point-to-point message authentication systems have been extensively studied in the literature. In this paper we consider authentication for group communication. The basic primitive is a multireceiver authentication system with dynamic sender (DMRA-code). In a DMRA-code any member of a group can broadcast an authenticated message such that all other group members can individually verify its authenticity. In this paper first we give a new and flexible 'synthesis' construction for DMRA-codes by combining an authentication code (Acode) and a key distribution pattern. Next we extend DMRA-codes to tDMRA-codes in which t senders are allowed. We give two constructions for tDMRA-codes, one algebraic and one by 'synthesis' of an A-code and a perfect hash family. To demonstrate the usefulness of DMRA systems, we modify a secure dynamic conference key distribution system to construct a key-efficient secure dynamic conference system that provides secrecy and authenticity for communication among conferencees. The system is key-efficient because the key requirement is essentially the same as the original conference key distribution system and so authentication is effectively obtained without any extra cost. We show universality of 'synthesis' constructions for unconditional and computational security model that suggests direct application of our results to real-life multicasting scenarios in computer networks. We discuss possible extensions to this work.

show abstract

On Some Methods for Unconditionally Secure Key Distribution and Broadcast Encryption

Cited by 49 publications

References 31 publications

Complete tree subset difference broadcast encryption scheme and its analysis

Complete tree subset difference broadcast encryption scheme and its analysis

Unconditionally Secure Anonymous Encryption and Group Authentication

Broadcast Authentication in Group Communication

Contact Info

Product

Resources

About