![](bg2.png)
has been applied to (Kurosawa and Yoshida, 2002).
They suggested an efficient black-box tracing scheme
against abrupt pirate decoders, keeping the size of the
header sublinear in the number of receivers. In a sub-
sequent work Matsushita and Imai (2006) extended
their previous scheme presented in (Matsushita and
Imai, 2004) in order to reduce the header size. Ki-
ayias and Pehlivanoglu (2009) showed that the traitor
tracing scheme of Matsushita and Imai (2004) is sus-
ceptible to an attack that allows an illicit decoder to
avoid tracing and accuse an innocent user. In this pa-
per, we analyze the attack described by Kiayias and
Pehlivanoglu (2009) which (a) exploits the distance
between normal ciphertext from tracing ones and (b)
is able to distinguish two consecutive tracing cipher-
text with non-negligible probability. We improve the
black-box tracing algorithm described by Matsushita
and Imai (2004), showing that the restriction on the
geometry of traitors suggested in (Kiayias and Pehli-
vanoglu, 2009) can be omitted. In particular, we sug-
gest a way to repair the black-box tracing algorithm
(Matsushita and Imai, 2004) in order to reduce the
distance between normal and tracing ciphertext and
moreover close the gap between two consecutive trac-
ing ciphertext, making the scheme no more suscepti-
ble to the attack.
The paper is organized as follows. In Section 2
we recall the attack proposed by Kiayias and Pehli-
vanoglu (2009) on the Matsushita and Imai protocol.
In Section 3, we suggest a new solution that repairs
the scheme totally. Finally, in Section 4, a security
proof of the protocol is presented.
2 THE ATTACK
Due to space limitations, the authors do not describe
the Matsushita and Imai protocol (Matsushita and
Imai, 2004). However, we briefly introduce the main
parameters used in such protocol Let n be the number
of users and k be the maximum number of traitors in a
coalition. Let p and q be two primes such that q | p−1
and q ≥ n+ 2k− 1. G
q
is a subgroup of Z
∗
p
of order q,
g is a generator of subgroup G
q
and U = {u
1
,...,u
n
}
is the set of all user where U ⊆ Z
q
\{0}. Let ctr
j
be a counter used in the tracing phase in order to
decide if the considered user u
j
is a traitor or not. For
generating the public key and users’ private keys, the
protocol splits the set of user U in ℓ disjoint subset
U
0
,U
1
,...,U
ℓ−1
, |U
i
| = 2k with i = 0,...,ℓ − 1
and chooses a
0
,a
1
,...,a
2k−1
,b
0
,b
1
,...,b
ℓ−1
∈
R
Z
q
. The public key will be e =
(p,q,g,g
a
0
,...,g
a
2k−1
,g
b
0
,...,g
b
ℓ−1
) =
(p,q,g,y
0,0
,...,y
0,2k−1
,y
1,0
,...,y
1,l−1
). The pri-
vate key of user u ∈ U
i
, with 0 ≤ i ≤ ℓ − 1, is
(u,i, f
i
(u)), where f
i
(u) =
∑
2k−1
j=0
a
i, j
u
j
mod q with
a
i, j
= a
j
if j 6= i mod 2k or a
i, j
= b
i
otherwise. The
encrypted headers sent to users can be represented
as H = (H
0
,H
1
,...,H
ℓ−1
). Each group U
i
receives
the header H
i
= (
ˆ
h
i
,h
i,0
,...,h
i,2k−1
) where
ˆ
h
i
= g
r
i
with r
i
∈ {R
0
,R
1
} where R
0
,R
1
∈
R
Z
q
are random
numbers. It is important to note that the header H
i
can contain either the blinded session key s ∈
R
G
q
—chosen by the data supplier— or a revoking value
—computed using a random value z
i
∈
R
Z
q
—.
In (Kiayias and Pehlivanoglu, 2009), authors showed
that the public-key black-box traitor tracing scheme
in (Matsushita and Imai, 2004) is vulnerable to
self-defense mechanism. The attack (Kiayias and
Pehlivanoglu, 2009) relies on the possibility to
distinguish normal ciphertext from tracing ones,
monitoring the headers H
i
=
ˆ
h
i
,h
i,0
,...,h
i,2k−1
sent
to a coalition of k non-revoked traitors that belong to
different subgroups U
i
, i > t. When tracing is dis-
abled, each subgroup of users U
i
receives
ˆ
h
i
= g
r
i
—
recall that r
i
∈ {R
0
,R
1
} uniformly at random. On the
other hand, when tracing is enabled, these subgroups
of users receive
ˆ
h
i
= g
R
0
. Therefore, the probability
that k traitors receive the same
ˆ
h
i
is 1/2
k
when normal
ciphertext is sent, while is 1 when tracing. The statis-
tical distance between these probability distribution
converges to 1 when the number of traitors grows
(see (Kiayias and Pehlivanoglu, 2009), Theorem 1).
Monitoring header H
i
, a pirate decoder is able to
distinguish these distributions with a non-negligible
probability and trigger a self-defensive mechanism.
Moreover, the pirate decoder is able to distinguish
the gap between two consecutive tracing ciphertexts
CTrace(e, j − 1,s) and CTrace(e, j,s) when j = 1
mod 2k. In the first case, i.e. CTrace(e, j − 1,s), all
subgroups U
0
,...U
ℓ−1
will receive either r
i
= R
0
or r
i
= R
1
at random. In the second case, i.e.
CTrace(e, j, s), there exists a subgroup U
t
, which
contains u
j
, such that X ∩ U
t
6=
/
0 and X ∩ U
t
6= U
t
.
Hence, subgroup U
t
will receive r
i
= R
1
, subgroups
U
0
...U
t−1
receive r
i
= R
0
or r
i
= R
1
at random,
and finally, subgroups U
t+1
...U
ℓ−1
receive r
i
= R
0
.
Exploiting the gap between CTrace(e, j − 1,s) and
CTrace(e, j, s), a pirate decoder is able to recognize
two consecutive tracing ciphertexts and trigger
a self-defense mechanism. As consequences of
such mechanism, counter ctr
j
of traitor u
j
will be
not increased, the probability that the difference
ctr
j−1
− ctr
j
gets the maximum value is dramatically
reduced, tracing is avoided, and an innocent user
is in fact accused with a non-negligible probability
(see (Kiayias and Pehlivanoglu, 2009), Corollary
1). The main problem of the Matsushita and Imai
AnImprovedPublic-keyTracingSchemewithSublinearCiphertextSize
303