Public Key Broadcast Encryption Schemes With Shorter Transmissions

Abstract

Broadcast encryption allows a sender to securely distribute messages to a dynamically changing set of users over an insecure channel. In a public key broadcast encryption (PKBE) scheme, this encryption is performed in the public key setting, where the public key is stored in a user's device, or directly transmitted to the receivers along with ciphertexts. In this paper, we propose two PKBE schemes for stateless receivers which are transmission-efficient. A distinctive feature in our first construction is that, different than existing schemes in the literature, only a fraction of the public key related to the set of intended receivers is required in the decryption process. This feature results in the first PKBE scheme with ( ) transmission cost and (1) user storage cost for revoked users. Our second construction is a generalized version of the first one providing a tradeoff between ciphertext size and public key size. With appropriate parametrization, we obtain a PKBE scheme with ( ) transmission cost and (1) user storage cost for any large set of users. The transmission cost of our second scheme is at least 30\% less than that of the recent result of Boneh et al.'s PKBE scheme, which is considered as being the current state-of-the-art. By combining the two proposed schemes, we suggest a PKBE scheme that achieves further shortened transmissions, while still maintaining (1) user storage cost. The proposed schemes are secure against any number of colluders and do not require costly re-keying procedures followed by revocation of users.

Adaptively secure broadcast encryption under standard assumptions with better efficiency

“…A non-trivial PKBE scheme that does not rely on the NNL framework was proposed by Boneh, Gentry, and Waters [7]. After the PKBE scheme of Boneh et al, various PKBE schemes were proposed in [14,28]. One disadvantage of PKBE is that the total number of users in the system is limited to the polynomial value of the security parameter.…”

“…They first propose a simple PKBE scheme with linear size of public keys and constant size of ciphertexts, and then they proposed a generalized PKBE scheme with sub-linear size of public keys and ciphertexts. After the pioneering work of Boneh et al, many other PKBE schemes with different properties were proposed in bilinear groups [13,14,28]. However, these PKBE schemes were proven to be secure in the static security model under q-type assumptions where the value q depends on the number of users in the system.…”

Public-Key Revocation and Tracing Schemes with Subset Difference Methods Revisited

“…Their first PKBE scheme has the ciphertext size of O(1), the private key size of O(1), and the public key size of O(N), and their second PKBE scheme has the ciphertext size of O( √ N), the private key size of O (1), and the public key size of O( √ N) where N is the number of users in the system. After the construction of Boneh et al [5], many other PKBE schemes based on bilinear groups were proposed [10,16,24,27]. Delerablée [9] proposed an identity-based broadcast encryption (IBBE) scheme such that the total number of users is not fixed, the ciphertext is related to the set S of receivers, and the public key size is linear to the maximum size of receiver sets.…”

Selectively chosen ciphertext security in threshold public‐key encryption

“…In this section, we introduce an extension of the modified bilinear Diffie-Hellman (mBDH) problem from [22], which is used for security proof of our scheme. The extended and modified bilinear Diffie-Hellman (extended-mBDH) problem in G is defined; Let g 0 be a generator of G .…”