![](bg2.png)
Table 1: Comparison summary of communication, storage and other functionality.
Scheme Group Type |PP| |sk
u
| |CT| TRA Complexity Assumptions
(Boneh and Waters, 2006) composite, BL 9
√
N +5 (
√
N +1) in G 6
√
N in G,
√
N in G
T
public D3DH, DHSD, BSD
(Boneh et al., 2006) composite, BL 4
√
N +3 1 in G 5
√
N in G,
√
N in G
T
secret D3DH, DHSD, BSD
(Garg et al., 2010) prime, BL 4
√
N +1 (
√
N +1) in G 6
√
N in G,
√
N in G
T
public D3DH, XDH
(Boneh and Zhandry, 2014) − poly(log N,η) η poly(logN, η) public iO & FE security
(Nishimaki et al., 2016)−I − poly(η) poly(n) poly(n,|m|) public iO & FE security
(Nishimaki et al., 2016)−II − poly(logn) poly(n) |m|+poly(log n) public iO security
(Garg et al., 2016) composite, ML poly(logN) poly(logN) poly(logN) public FE security
Ours prime, ML poly(log N, η) 1 in G
~
ρ
2 in G
~
ρ
, 3η, log(N) public DHDHE and iO security
|PP| = public parameter size, |sk
u
| = user secret key size, |CT| = ciphertext size, TRA = traceability, BL = bilinear, ML = multilinear, FE = functional encryption,
D3DH = Decision (modified) 3-party Diffie-Hellman, DHSD = Diffie-Hellman Subgroup Decision, BSD = Bilinear Subgroup Decision, XDH = External
Diffie-Hellman, DHDHE = Decisional Hybrid Diffie-Hellman Exponent assumptions, G = Bilinear source group, G
T
= Bilinear target group, G
~
ρ
= Multilinear
intermediate group, n = arbitrary bit-length of user identity, |m| = message-bit length, N = total number of users in the system and, η = security parameter.
original private keys. A traitor tracing system runs
an efficient tracing algorithm that interacts with the
pirate decoder considering it as a black-box oracle
and outputs at least one identity of the traitors in the
coalition who was involved to create the malicious
program using his own private key. Pirate cable TV,
set-top decoders, encrypted satellite radio, pirate
decryption software posted on the Internet etc. are
few examples of pirate decoder box.
A naive approach to address this problem is the fol-
lowing. For a system having N users, the broadcaster
broadcasts N ciphertext under N different public keys
whereby a legitimate user can decrypt the ciphertext
corresponding to his own secret key. Consequently,
given any pirate decoder, it is easy to pinpoint at least
one traitor whose secret key is used to fabricate the
pirate decoder. However, this solution is inefficient as
the ciphertext size is linear in N. Although a PLKA
system has the capability of fraud detection, it is not
always possible to switch a general BE scheme into
a tracing scheme. Designing a PLKA traitor tracing,
with shorter size ciphertext, public parameter and the
user secret key is a challenging task.
Related Work. Traitor tracing was formally intro-
duced by (Chor et al., 1994), followed by a several
works in different flavors (Kiayias and Yung, 2001;
Boneh and Waters, 2006; Boneh et al., 2006; Garg
et al., 2010; Boneh and Zhandry, 2014; Nishimaki
et al., 2016; Garg et al., 2016).
In 2001, (Kiayias and Yung, 2001) proposed t-
collusion resistant tracing mechanism with ciphertext
size linear in t. A collusion of at most t-users are
allowed to construct a pirate decoder in such system.
The first fully collusion resistant PLKA with traitor
tracing was proposed by (Boneh and Waters, 2006;
Boneh et al., 2006) in composite order bilinear group
with sublinear size parameters. Later, (Garg et al.,
2010) developed a similar variant on prime order bili-
nar group setting. Depending on the tracing authority,
traitor tracing systems fall into two categories − (a)
publicly traceable that does not require any secret
inputs except the public parameter in the tracing
algorithm (Boneh and Waters, 2006; Garg et al.,
2010; Boneh and Zhandry, 2014; Nishimaki et al.,
2016; Garg et al., 2016), and (b) secretly traceable
which uses a secret tracing key to identify rogue users
(Boneh et al., 2006; Kiayias and Yung, 2001). In
2014, (Boneh and Zhandry, 2014) constructed a fully
collusion resistant PLKA traitor tracing with public
traceability utilizing the constrained pseudorandom
functions (cPRFs) and indistinguishability obfusca-
tion (iO). All the aforementioned PLKA schemes use
the Hybrid Coloring tracing approach of (Kiayias and
Yung, 2001). Adopting iO, (Nishimaki et al., 2016)
exhibited that a PLKA traitor tracing is an immediate
consequence of functional encryption (FE). In (Garg
et al., 2016), a FE scheme is designed in composite
order asymmetric multilinear group setting without
iO and provides another indirect construction of
traitor tracing. None of the schemes (Nishimaki
et al., 2016; Garg et al., 2016) provide explicit
construction of PLKA traitor tracing. As pointed out
by (Garg et al., 2010), the communication, storage,
and computational efficiency of prime order groups
are much higher compared to that of composite
order group. Our main focus in this work is to build
a PLKA traitor tracing scheme over prime order
multilinear groups (Coron et al., 2015; Gentry et al.,
2015) achieving order-of-magnitude improvements
in efficiency and storage without any security breach.
Our Contribution. We design a PLKA con-
struction coupling pseudorandom function (PRF)
of (Goldreich et al., 1986) with indistinguishability
obfuscation (iO) and adopting multilinear maps over
prime order group. Note that several recent attacks
have broken many assumptions on known multilinear
maps (Coron et al., 2015; Gentry et al., 2015).
Recently, (Gu, 2015) constructed a new variant of
the multilinear maps which seemed to thwart known
attacks. We skillfully integrate the tracing mecha-
nism of (Kiayias and Yung, 2001) in our PLKA,
yielding the first fully collusion resistant and publicly
Cost-effective Private Linear Key Agreement with Adaptive CCA Security from Prime Order Multilinear Maps and Tracing Traitors
357