An Improved Public-key Tracing Scheme with Sublinear Ciphertext Size

Chiara Valentina Schiavo and Andrea Visconti

Dipartimento di Informatica e Comunicazione, Universit´a degli Studi di Milano, via Comelico 39/41, 20135 Milano, Italy

Keywords:

Traitor Tracing Schemes, Piracy, Digital Content Distribution Systems, Pirate Decoders, Traitors.

Abstract:

To overcome the piracy problem in digital content distribution systems, a number of traitor tracing schemes

have been suggested by researchers. The goal of these schemes is to enable the tracer to identify at least

one of the traitors. In this context, Matsushita and Imai (2004) proposed a black-box tracing scheme with

sublinear header size that is able to perform tracing of self-defensive pirate decoders. Kiayias and Pehlivanoglu

(2009) proved that this scheme is vulnerable to an attack which allows an illicit decoder to recognize normal

ciphertext to tracing ones and distinguish two consecutive tracing ciphertexts. For making the scheme no

more susceptible to such attack, authors modiﬁed the encryption phase and assumed that traitors belong to the

same user group. In this paper, we present a solution that has no traitors restrictions, repairing the scheme

totally. In particular, we modiﬁed the tracing scheme proving that (a) a pirate decoder is not able to recognize

normal ciphertext to tracing ones with sufﬁciently high probability, and (b) the statistical distance between two

consecutive tracing operations is negligible under Decision Difﬁe Hellman assumption.

1 INTRODUCTION

Secure distribution of digital contents plays a key

role in many applications such as Pay-TV systems,

streaming media distributions, copyrighted material,

etc. in which only authorized users should be able

to use them. Since the main model for digital con-

tent distribution is virtual and not physical, malicious

users may decrypt and redistribute digital content,

disclose their personal key to unauthorized users, or

build a pirate decoder. Therefore, the piracy prob-

lem needs to be addressed and traitor tracing can

help us to mitigate this unwanted behavior. In a

ﬁrst high-level scenario, a broadcaster, or data sup-

plier, encrypts the digital contents using a session key,

blinds such key into the header, and then sent en-

crypted contents and headers to users. Authorized

users, the subscribers, by means of a decoder, can re-

trieve the session key and subsequently decrypt the

digital contents. On the other hand, malicious sub-

scribers, the traitors, may build a pirate decoder with

their own personal keys, allowing unauthorized users,

also called pirates, to illegally decrypt the copyrighted

material. In order to identify users involved in con-

structing a pirate decoder, a number of traitor trac-

ing schemes have been suggested (Dodis and Fazio,

2002), (Kiayias and Yung, 2001), (Naor and Pinkas,

2010), (Naor and Pinkas, 1998), (Chor et al., 2000),

(Kiayias and Pehlivanoglu, 2011). All such schemes

enable a broadcaster to trace at least one traitor of the

coalition. In 1994 Chor, Fiat and Naor (1994) intro-

duced the concept of traitor tracing schemes to pre-

vent the piracy. Boneh and Franklin (1999) suggested

a deterministic public key traitor tracing scheme, ap-

plying error correcting techniques, while Kurosawa

and Desmedt (1998) described a multiple-use trace-

ability scheme which use small keys and short cipher-

text. Taking into account memory capabilities and

the ability of triggering self-defense mechanisms, Ki-

ayias and Yung (2001) classiﬁed pirate decoders into

four non-disjoint categories — i.e. resettable, history-

recording, abrupt, and available. Moreover, authors

introduced the concept of list-tracing, and presented a

traitor tracing scheme that is successful against abrupt

and resettable decoders. Dodis and Fazio (2002) de-

scribed a public key broadcast encryption scheme for

stateless receivers which reduces the public key size

and user’s storage. Unfortunately, such scheme is

not effective against pirate decoder which are able

to trigger a self-defense mechanism. Dwork, Lots-

piech and Naor (1996), suggested the notion of self-

enforcement for combating leakage of keys and deter-

ring users from revealing sensitive information. An

efﬁcient revocation scheme based on secret sharing

enhanced with traitor tracing and self-enforcement

properties has been suggested by Naor and Pinkas

(2010). In (Matsushita and Imai, 2004), the idea

of Matsushita (2002) of the key generation method

302

Valentina Schiavo C. and Visconti A..

An Improved Public-key Tracing Scheme with Sublinear Ciphertext Size.

DOI: 10.5220/0004074003020307

In Proceedings of the International Conference on Security and Cryptography (SECRYPT-2012), pages 302-307

ISBN: 978-989-8565-24-2

 2012 SCITEPRESS (Science and Technology Publications, Lda.)

has been applied to (Kurosawa and Yoshida, 2002).

They suggested an efﬁcient black-box tracing scheme

against abrupt pirate decoders, keeping the size of the

header sublinear in the number of receivers. In a sub-

sequent work Matsushita and Imai (2006) extended

their previous scheme presented in (Matsushita and

Imai, 2004) in order to reduce the header size. Ki-

ayias and Pehlivanoglu (2009) showed that the traitor

tracing scheme of Matsushita and Imai (2004) is sus-

ceptible to an attack that allows an illicit decoder to

avoid tracing and accuse an innocent user. In this pa-

per, we analyze the attack described by Kiayias and

Pehlivanoglu (2009) which (a) exploits the distance

between normal ciphertext from tracing ones and (b)

is able to distinguish two consecutive tracing cipher-

text with non-negligible probability. We improve the

black-box tracing algorithm described by Matsushita

and Imai (2004), showing that the restriction on the

geometry of traitors suggested in (Kiayias and Pehli-

vanoglu, 2009) can be omitted. In particular, we sug-

gest a way to repair the black-box tracing algorithm

(Matsushita and Imai, 2004) in order to reduce the

distance between normal and tracing ciphertext and

moreover close the gap between two consecutive trac-

ing ciphertext, making the scheme no more suscepti-

ble to the attack.

The paper is organized as follows. In Section 2

we recall the attack proposed by Kiayias and Pehli-

vanoglu (2009) on the Matsushita and Imai protocol.

In Section 3, we suggest a new solution that repairs

the scheme totally. Finally, in Section 4, a security

proof of the protocol is presented.

2 THE ATTACK

Due to space limitations, the authors do not describe

the Matsushita and Imai protocol (Matsushita and

Imai, 2004). However, we brieﬂy introduce the main

parameters used in such protocol Let n be the number

of users and k be the maximum number of traitors in a

coalition. Let p and q be two primes such that q | p−1

and q ≥ n+ 2k− 1. G

is a subgroup of Z

∗

of order q,

g is a generator of subgroup G

and U = {u

,...,u

}

is the set of all user where U ⊆ Z

\{0}. Let ctr

be a counter used in the tracing phase in order to

decide if the considered user u

is a traitor or not. For

generating the public key and users’ private keys, the

protocol splits the set of user U in ℓ disjoint subset

,...,U

ℓ−1

, |U

| = 2k with i = 0,...,ℓ − 1

and chooses a

,...,a

2k−1

,...,b

ℓ−1

∈

. The public key will be e =

(p,q,g,g

,...,g

2k−1

,...,g

ℓ−1

) =

(p,q,g,y

0,0

,...,y

0,2k−1

1,0

,...,y

1,l−1

). The pri-

vate key of user u ∈ U

, with 0 ≤ i ≤ ℓ − 1, is

(u,i, f

(u)), where f

(u) =

∑

2k−1

j=0

i, j

mod q with

i, j

= a

if j 6= i mod 2k or a

i, j

= b

otherwise. The

encrypted headers sent to users can be represented

as H = (H

,...,H

ℓ−1

). Each group U

receives

the header H

= (

i,0

,...,h

i,2k−1

) where

= g

with r

∈ {R

} where R

∈

are random

numbers. It is important to note that the header H

can contain either the blinded session key s ∈

—chosen by the data supplier— or a revoking value

—computed using a random value z

∈

—.

In (Kiayias and Pehlivanoglu, 2009), authors showed

that the public-key black-box traitor tracing scheme

in (Matsushita and Imai, 2004) is vulnerable to

self-defense mechanism. The attack (Kiayias and

Pehlivanoglu, 2009) relies on the possibility to

distinguish normal ciphertext from tracing ones,

monitoring the headers H



i,0

,...,h

i,2k−1



sent

to a coalition of k non-revoked traitors that belong to

different subgroups U

, i > t. When tracing is dis-

abled, each subgroup of users U

receives

= g

—

recall that r

∈ {R

} uniformly at random. On the

other hand, when tracing is enabled, these subgroups

of users receive

= g

. Therefore, the probability

that k traitors receive the same

is 1/2

when normal

ciphertext is sent, while is 1 when tracing. The statis-

tical distance between these probability distribution

converges to 1 when the number of traitors grows

(see (Kiayias and Pehlivanoglu, 2009), Theorem 1).

Monitoring header H

, a pirate decoder is able to

distinguish these distributions with a non-negligible

probability and trigger a self-defensive mechanism.

Moreover, the pirate decoder is able to distinguish

the gap between two consecutive tracing ciphertexts

CTrace(e, j − 1,s) and CTrace(e, j,s) when j = 1

mod 2k. In the ﬁrst case, i.e. CTrace(e, j − 1,s), all

subgroups U

,...U

ℓ−1

will receive either r

= R

or r

= R

at random. In the second case, i.e.

CTrace(e, j, s), there exists a subgroup U

, which

contains u

, such that X ∩ U

0 and X ∩ U

6= U

Hence, subgroup U

will receive r

= R

, subgroups

...U

t−1

receive r

= R

or r

= R

at random,

and ﬁnally, subgroups U

t+1

...U

ℓ−1

receive r

= R

Exploiting the gap between CTrace(e, j − 1,s) and

CTrace(e, j, s), a pirate decoder is able to recognize

two consecutive tracing ciphertexts and trigger

a self-defense mechanism. As consequences of

such mechanism, counter ctr

of traitor u

will be

not increased, the probability that the difference

ctr

j−1

− ctr

gets the maximum value is dramatically

reduced, tracing is avoided, and an innocent user

is in fact accused with a non-negligible probability

(see (Kiayias and Pehlivanoglu, 2009), Corollary

1). The main problem of the Matsushita and Imai

AnImprovedPublic-keyTracingSchemewithSublinearCiphertextSize

303

protocol is the possibility to recognize normal and

tracing operations, exploiting the statistical distance

between two probability distributions. For reducing

such distance, Kiayias and Pehlivanoglu (Kiayias and

Pehlivanoglu, 2009) introduce a random cutoff point

d that is the switch point between r

= R

to r

= R

In particular, if i ≤ d then they set r

= R

, otherwise

= R

. While encrypting, the data supplier selects

a random integer d ∈ {0,...,ℓ − 1} and generates ℓ

headers H

, i = 0,...,ℓ − 1, one for each subset of

users U

, as follows

= g

(1)

i, j

(

0, j

j 6= i mod 2k

1, j

j = i mod 2k

3 AN IMPROVED SCHEME

The introduction of a random cutoff point ensures

that, monitoring the headers H

, traitors are not able to

distinguish normal ciphertext from tracing ones. This

new approach ﬁxes one problem, however, the gap be-

tween two consecutive tracing ciphertexts — i.e. the

gap between CTrace(e, j − 1, ·) and CTrace(e, j,·)

— still remain. In order to make traitors unable to

recognize tracing activities, in (Kiayias and Pehli-

vanoglu, 2009) authors assume that all traitors are in

the same user group U

and they apply the tracing al-

gorithm in parallel to U

...U

ℓ−1

. For mitigating all

these problems, we present a solution that repair the

scheme totally without restriction on the geometry of

traitors. In order to reduce the gap between two prob-

ability distributions, we suggest to modify the black

box tracing phase, thereby preserving the encryption

phase. In particular, when there exists a subset U

with 0 ≤ t ≤ ℓ − 1 such that X ∩U

0, X ∩U

6= U

we suggest to modify the construction of the header

for i 6= t as follows

= g

, r

= R

or R

i, j











0, j

( j 6= i mod 2k,r

= R

)

0, j

( j 6= i mod 2k,r

= R

)

1,i

( j = i mod 2k,X ∩ U

0,r

= R

)

1,i

( j = i mod 2k,X ∩ U

0,r

= R

)

( j = i mod 2k,X ∩ U

= U

)

This new black box tracing phase ensures that traitors

are not able to distinguish normal ciphertext from

tracing ones, and at the same time, ﬁxes the gap be-

tween two consecutive tracing ciphertexts. Tables 1

and 2 can help us to ﬁgure out the improvements sug-

gested. In particular, ﬁrst and second rows of Table

1 show the statistical gap between CTrace(e, j − 1, ·)

and CTrace(e, j,·) in Matsushita-Imai protocol while

third and fourth rows show how our solution closes

such gap, making two consecutive tracing ciphertext

indistinguishable. Table 2 shows how traitors can ex-

ploit the Matsushita-Imai distribution of r

in order

to distinguish tracing activities and how our approach

avoids this unwanted behavior. It is not hard to show

that in the improved scheme a set of users U

— i.e.

users that are not chosen to be revoked — are able to

compute the session key s. In fact, suppose there ex-

ists a subgroup U

with 0 ≤ t < ℓ such that X ∩U

and X ∩ U

6= U

. Then, for i 6= t users residing in

the subset U

such that X ∩ U

0 and r

= R

are

able compute the session key s using the header H

shown in Equation 2

(

i,0

× h

i,1

× · · · × h

2k−1

i,2k−1

(u)

)

1/u

i mod 2k

(2)

(

i mod 2k

∑

2k−1

j=0

(

∑

2k−1

j=0

−a

)

(u)

)

1/u

i mod 2k

1/u

i mod 2k

= s

4 PROOF OF SECURITY

The security proof of the improved tracing algorithm

relies on the Decision Difﬁe-Hellman (DDH) prob-

lem (Boneh, 1998). For this reason, we will introduce

(a) M

DDH

, a probabilistic polynomial time (p.p.t.)

algorithm which solve the DDH problem in G

and

(b) three lemmas which can help us to show that the

traitor tracing scheme we propose is able to identify

at least one traitor of a coalition with non-negligible

probability.

Lemma 4.1 (Indistinguishability of an input). The

computational complexity for k non revoked sub-

scribers to distinguish a valid input from an invalid

one is as hard as DDH in G

Proof. Let C be a set of k non-revoked subscribers

and D

dist

be a p.p.t. algorithm used by users in C to

distinguish a valid from an invalid one. Let M

DDH

a p.p.t. algorithm that is able to solve the DDH prob-

lem in G

. In particular, the p.p.t. algorithm M

DDH

inputs a 4-tuple (g

) and outputs whether

such tuple is a Difﬁe-Hellman tuple or a Random tu-

ple. We prove that D

dist

⇔ M

DDH

for any C such

that X ∩ C =

0 and |C| = k. It is straightforward to

prove that M

DDH

⇒ D

dist

, therefore we prove that

dist

⇒ M

DDH

. Split the set of subscribers U into

SECRYPT2012-InternationalConferenceonSecurityandCryptography

304

Table 1: Distribution of r

, case CTrace(e, j −1,·) and CTrace(e, j, ·).

... U

t−1

t+1

... U

ℓ−1

Matsushita-Imai scheme: CTrace(e, j − 1,·) R

... R

Matsushita-Imai scheme: CTrace(e, j,·) R

... R

Our scheme: CTrace(e, j − 1, ·) R

... R

Our scheme: CTrace(e, j,·) R

... R

Table 2: Distribution of r

with Normal Ciphertext (1st row) and Tracing Ciphertext (2nd, 3rd rows— case: ∃U

(0 ≤ t ≤ ℓ−1)

such that X ∩ U

6= 0 and X ∩ U

6= U

... U

t−1

t+1

... U

ℓ−1

Matsushita-Imai scheme - Normal ciphertext R

... R

Matsushita-Imai scheme - Tracing ciphertext R

... R

Our scheme - Tracing ciphertext R

... R

ℓ disjoint subset U

,...,U

ℓ−1

. Let X be the set of

subscribers, or users, chosen to be revoked such that

X ⊆ U . Choose C = {x

,...,x

} a set of k sub-

scribers such that X ∩ C =

0. Choose k − 1 distinct

elements x

k+1

,...,x

2k−1

∈

\ C and random num-

bers β

,..., β

,λ,µ,ψ

,ω

∈

, k + 1 ≤ t ≤ 2k − 1.

There exists a unique polynomial α(x) = α

+ α

··· + α

2k−1

mod q such that g

= g

and

(α(x

),.. .,α(x

2k−1

))

= (β

,.. ., β

2k−1

)

= (α

,.. .,α

)

+V(α

,.. .,α

2k−1

) mod q

(α

,.. .,α

2k−1

)

= V

−1

(β

− α

,.. .,β

2k−1

− α

)

mod q

where g

= g

, k + 1 ≤ t ≤ 2k − 1, and V is the

Vandermonde matrix. Let (v

m,1

,...,v

m,2k−1

) be the

mth row of V

−1

matrix, then compute α

, 1 ≤ m ≤

2k− 1, as follows:

= v

m,1

+ ··· + v

m,2k−1

2k−1

− α

m,1

+ ··· + v

m,2k−1

) mod q

hence g

= g

m,1

+···+v

m,2k−1

2k−1

/(g

)

m,1

+···+v

m,2k−1

For computing users’ personal key (x

), we (a)

choose a user x

∈ U

where 1 ≤ j ≤ k and i

∈

{0,...,ℓ − 1} , (b) deﬁne a set I = {i

|1 ≤ j ≤ k, x

∈

}, (c) randomly choose λ

,µ

∈

for each i,

0 ≤ i ≤ ℓ − 1, and δ

∈

for all elements i

∈ I .

For each i

∈ I , there exists an element γ

∈

such

that δ

= b

+ γ

− α

mod 2k

and g

= g

, there-

fore we can compute last parameter of the key d

follows: d

= α(x

) + δ

mod 2k

. Since the user’s

private key is (u, i, f

(u)), we impose that d

= f

(u),

computing coefﬁcients a

,...,a

2k−1

as follows. Con-

sider the set {0,...,2k− 1} \ {i

mod 2k|i

∈ I }. It is

possible to select k elements from this set which can

be represented as θ

,..., θ

. Compute g

′

,...,g

′

such that g

∑

τ∈{θ

,...,θ

}α

′

= g

mod 2k

. In order to

compute the public key e, it is necessary to calculate

with 0 ≤ m ≤ 2k − 1 as follows,

(

m 6∈ {θ

,.. .,θ

}

′

m ∈ {θ

,.. .,θ

}

and the public key e will be e =

,.. .,g

2k−1

,.. .,g

ℓ−1

). Let s ∈

the session key and r ∈

be a random number. For

each i, 0 ≤ i ≤ ℓ − 1, if U

∩X =

0 or U

∩X = U

set

= 0 or B

= 1, otherwise, set B

= 1. It is possible

to identify eight compact headers H. Four are related

to case ∃U

such that U

∩ X 6=

0 and U

∩ X 6= U

0 ≤ l ≤ ℓ − 1, while the remaining when such U

does not exist. In particular, if U

exists then compact

header H will be computed as follow,

1. if B

= 0 for i < l, and B

= 0 for i > l,

,.. .,g

2k−1

,.. .,g

2k−1

,.. .,sg

l−1

,sg

l+1

,.. .,sg

ℓ−1

2. if B

= 1 for i < l, and B

= 0 for i > l,

,.. .,g

2k−1

,.. .,g

2k−1

,.. .,sg

l−1

,sg

l+1

,.. .,sg

ℓ−1

3. if B

= 0 for i < l, and B

= 1 for i > l,

,.. .,g

2k−1

,.. .,g

2k−1

,.. .,sg

l−1

,sg

l+1

,.. .,sg

ℓ−1

4. if B

= 1 for i < l, and B

= 1 for i > l,

,.. .,g

2k−1

,.. .,sg

ℓ−1

If such U

does not exist, then U

∩ X = U

, or U

∩

X =

0, 1 ≤ i ≤ ℓ − 1. Hence, compact header H will

be computed as follow,

AnImprovedPublic-keyTracingSchemewithSublinearCiphertextSize

305

5. if B

= 0 for U

∩X = U

and B

= 1 for U

∩X =

0, then the header H is computed as in case 3

6. if B

= 1 for U

∩X = U

and B

= 1 for U

∩X =

0, then the header H is computed as in case 4

7. if B

= 0 for U

∩X = U

and B

= 0 for U

∩X =

,.. .,g

2k−1

,.. .,sg

ℓ−1

8. if B

= 1 for U

∩X = U

and B

= 0 for U

∩X =

,.. .,g

2k−1

,.. .,g

2k−1

,.. .,sg

l−1

,sg

l+1

,.. .,sg

ℓ−1

Knowing that

(

j 6∈ {θ

,.. .,θ

}

′

j ∈ {θ

,.. .,θ

}

and g

∑

τ∈{θ

,...,θ

}α

′



z mod 2k



mod 2k

with 1 ≤ z ≤ k, it is not hard to note that the

compact headers described above behaves as nor-

mal encryption headers when (g

)-tuple

is a Difﬁe-Hellman tuple, and as tracing header

when (g

)-tuple is a random tuple in which

traitors in C are not revoked. Public key e, private

keys (x

),... ,(x

) and compact header H

input D

dist

. The p.p.t. algorithm decides weather

header H is a valid input or an invalidone, and outputs

“Difﬁe-Hellman tuple” or “Random tuple”. Since

dist

is able to distinguish a valid input from an in-

valid one, C chosen arbitrarily such that X ∩ C =

and |C| = k, we constructed M

DDH

using D

dist

, hence

DDH

can solve the DDH problem. We can conclude

that D

dist

⇒ M

DDH

for any C arbitrarily chosen.

Lemma 4.2 (Secrecy of a Session Key in an Invalid

Input). The computational complexity to compute the

session key, for k subscribers revoked that received an

invalid input, is as hard as DDH in G

Proof. The proof of Lemma 4.2 follows step by step

the proof provided in (Matsushita and Imai, 2004,

p. 269,270). However it is necessary to replace the

following condition: - if X ∩ U

0, then compute H

as:

= g

i, j

(

( j 6= i mod 2k)

s(g

)

( j = i mod 2k)

with this: - if X ∩ U

0, set B

= 0 or 1 and compute

as follows:

(

= 0)

= 1)

i, j











( j 6= i mod 2k,B

= 0)

)

( j 6= i mod 2k,B

= 1)

s(g

)

( j = i mod 2k,B

= 0)

s(g

)

( j = i mod 2k,B

= 1)

Lemma 4.3 (Indistinguishability of a Suspect).

Given a subscriber u

, the computational complexity

for a coalition of k subscribers to distinguish an in-

valid input in which the user u

is not revoked — i.e.

X = {u

,...,u

j−1

} — from another one in which u

revoked — i.e. X = {u

,...,u

} — is as hard as DDH

in G

Proof. Let C be the set of k colluders. Let A

dist

a p.p.t. algorithm used by the coalition C to distin-

guish two invalid input, one in which a given user

is revoked and the other one in which the user is

not revoked. We prove that A

dist

⇔ M

DDH

for any

coalition C such that |C | = k. Firstly, it is clear that

DDH

⇒ A

dist

for any coalition C. Secondly, we

prove that A

dist

⇒ M

DDH

for any C by construct-

ing M

DDH

using A

dist

as a subroutine. The algorithm

DDH

takes in input a challenge tuple (g

)

and outputs “Difﬁe-Hellman tuple” or “Random tu-

ple”. The construction of the algorithm is as follows.

Split the set of subscribers U into ℓ disjoint subset

,...,U

ℓ−1

. Let X a set of revoked subscribers.

Choose k users which form the set C and choose a

user u

which has to be a subscriber who does not

belong to the set of colluders, i.e., u

∈

U \ C . We

suppose that user u

∈ U

. We also suppose that for

i = 0, . . .,t − 1 sets U

are such that U

∩ X = U

and

for i = t+1,...,ℓ −1 sets U

are such that U

∩X =

According to its relation with the set of revoked users,

the set U

can be such that:

1. U

∩ X 6= U

and U

∩ X 6=

0. This case has to be

considered both when u

∈ X and when u

6∈ X .

2. U

∩X =

0 when u

6∈ X and U

∩X = {u

} when

∈ X .

3. U

∩X = U

\{u

} when u

6∈ X and U

∩X = U

when u

∈ X .

Now, choose C = {x

,...,x

} a set of k sub-

scribers. Consider the user x

∈ U

and com-

pute its personal key (x

) and public key e =

SECRYPT2012-InternationalConferenceonSecurityandCryptography

306

,...,g

2k−1

,...,g

ℓ−1

) using the same pro-

cedure of Lemma 4.1. Construct the header H =

,...,H

ℓ−1

) executing the following procedure for

0 ≤ i ≤ ℓ − 1. The single header H

for the group U

will be H

= (

i,0

,...,h

i,2k−1

) where the single el-

ements in H

are computed as follows:

• if X ∩ U

0, set B

= 0 or 1:

(

= 0)

= 1)

i, j











( j 6= i mod 2k,B

= 0)

)

( j 6= i mod 2k,B

= 1)

s(g

)

( j = i mod 2k,B

= 0)

)

( j = i mod 2k,B

= 1)

• if X ∩ U

= U

, set B

= 0 or 1 and compute H

follows, selecting each time a random z

∈

(

= 0)

= 1)

i, j

(

′

i, j

( j 6= i mod 2k)

( j = i mod 2k)

where h

′

i, j

is computed in two different ways de-

pending on the existence of a subset U

with 0 ≤

t ≤ ℓ − 1 such that X ∩ U

0 and X ∩ U

6= U

If such a set exists then

′

i, j

(

= 0)

)

= 1)

Otherwise:

′

i, j

(

= 0)

)

= 1)

• if X ∩U

0 and X ∩ U

6= U

, the header H

will

be constructed as follows. First, construct a poly-

nomialC(x) =

∑

2k−1

j=0

such that for u ∈ U with

u 6= u

, C(u) ≡ 0 mod q if and only if it holds that

u ∈ (U

\ X ). We also suppose that for the user u

it holds that C(u

) ≡ 0 mod q. Then:

= g

i, j

(

)

( j 6= i mod 2k)

)

( j = i mod 2k)

Note that if (g

) is a Difﬁe-Hellman tuple,

the subscriber u

is not revoked in the header H, oth-

erwise, if (g

) is a Random tuple then the

subscriber u

is revoked. Run the algorithm A

dist

, by

giving in input to it u,H,e,(x

),... ,(x

This algorithm is able to distinguish invalid input in

which the subscriber u

is not revoked from an in-

valid input in which u

is revoked. Since we have

constructed M

DDH

using A

dist

as a subroutine, we

can conclude that M

DDH

can solve the DDH prob-

lem.

Theorem 4.4. Given the traitor tracing scheme de-

scribed in Section 3 and a pirate decoder constructed

by a coalition of k traitors, a tracer is able to identify

at least one of the traitors with non-negligible proba-

bility.

REFERENCES

Boneh, D. (1998). The Decision Difﬁe-Hellman Problem.

In ANTS, volume 1423 of LNCS, pages 48–63.

Boneh, D. and Franklin, M. K. (1999). An efﬁcient public

key traitor tracing scheme. In CRYPTO, volume 1666

of LNCS, pages 338–353.

Chor, B., Fiat, A., and Naor, M. (1994). Tracing traitors. In

CRYPTO, volume 839 of LNCS, pages 257–270.

Chor, B., Fiat, A., Naor, M., and Pinkas, B. (2000). Tracing

traitors. In IEEE Transactions on Information Theory,

volume 46, pages 893–910.

Dodis, Y. and Fazio, N. (2002). Public key broadcast en-

cryption for stateless receivers. In DRM Workshop,

volume 2696 of LNCS, pages 61–80.

Dwork, C., Lotspiech, J. B., and Naor, M. (1996). Digital

signets: Self-enforcing protection of digital informa-

tion. In STOC, pages 489–498.

Kiayias, A. and Pehlivanoglu, S. (2009). On the security

of a public-key traitor tracing scheme with sublinear

ciphertext size. In DRM Workshop, pages 1–10. ACM.

Kiayias, A. and Pehlivanoglu, S. (2011). Attacking traitor

tracing schemes using history recording and abrupt

decoders. In ISC, volume 7001 of LNCS, pages 17–31.

Kiayias, A. and Yung, M. (2001). On crafty pirates and foxy

tracers. In DRM Workshop, volume 2320 of LCNS.

Kurosawa, K. and Desmedt, Y. (1998). Optimum traitor

tracing and asymmetric schemes. In EUROCRYPT,

pages 145–157.

Kurosawa, K. and Yoshida, T. (2002). Linear code implies

public-key traitor tracing. In Public Key Cryptogra-

phy, volume 2274 of LNCS, pages 172–187.

Matsushita, T. (2002). A ﬂexibly revocable key-distribution

scheme for efﬁcient black-box tracing. In ICICS, vol-

ume 2513 of LNCS, pages 197–208.

Matsushita, T. and Imai, H. (2004). A public-key black-box

traitor tracing scheme with sublinear ciphertext size

against self-defensive pirates. In ASIACRYPT,volume

3329 of LNCS, pages 260–275.

Matsushita, T. and Imai, H. (2006). Hierarchical key as-

signment for black-box tracing with efﬁcient cipher-

text size. In ICICS, volume 4307 of LNCS, pages 92–

111.

Naor, M. and Pinkas, B. (1998). Threshold traitor tracing.

In CRYPTO, volume 1462 of LNCS, pages 502–517.

Naor, M. and Pinkas, B. (2010). Efﬁcient trace and revoke

schemes. Int. J. Inf. Sec., 9(6):411–424.

AnImprovedPublic-keyTracingSchemewithSublinearCiphertextSize

307