Improving the Boneh-Franklin Traitor Tracing Scheme

  • Authors:
  • Pascal Junod;Alexandre Karlov;Arjen K. Lenstra

  • Affiliations:
  • Nagravision SA, Cheseaux-sur-Lausanne, Switzerland and University of Applied Sciences Western Switzerland, Yverdon-les-Bains, Switzerland;Nagravision SA, Cheseaux-sur-Lausanne, Switzerland and EPFL IC LACAL, Lausanne, Switzerland;EPFL IC LACAL, Lausanne, Switzerland and Alcatel-Lucent Bell Laboratories, USA

  • Venue:
  • Irvine Proceedings of the 12th International Conference on Practice and Theory in Public Key Cryptography: PKC '09
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Traitor tracing schemes are cryptographically secure broadcast methods that allow identification of conspirators: if a pirate key is generated by k traitors out of a static set of *** legitimate users, then all traitors can be identified given the pirate key. In this paper we address three practicality and security issues of the Boneh-Franklin traitor-tracing scheme. In the first place, without changing the original scheme, we modify its tracing procedure in the non-black-box model such that it allows identification of k traitors in time $\tilde{O}(k^2)$, as opposed to the original tracing complexity $\tilde{O}(\ell)$. This new tracing procedure works independently of the nature of the Reed-Solomon code used to watermark private keys. As a consequence, in applications with billions of users it takes just a few minutes on a common desktop computer to identify large collusions. Secondly, we exhibit the lack of practical value of list-decoding algorithms to identify more than k traitors. Finally, we show that 2k traitors can derive the keys of all legitimate users and we propose a fix to this security issue.