Bridging broadcast encryption and group key agreement

  • Authors:
  • Qianhong Wu;Bo Qin;Lei Zhang;Josep Domingo-Ferrer;Oriol Farràs

  • Affiliations:
  • Department of Computer Engineering and Mathematics, UNESCO Chair in Data Privacy, Universitat Rovira i Virgili, Tarragona, Catalonia, Spain;Department of Computer Engineering and Mathematics, UNESCO Chair in Data Privacy, Universitat Rovira i Virgili, Tarragona, Catalonia, Spain;Software Engineering Institute, East China Normal University, Shanghai, China;Department of Computer Engineering and Mathematics, UNESCO Chair in Data Privacy, Universitat Rovira i Virgili, Tarragona, Catalonia, Spain;Department of Computer Engineering and Mathematics, UNESCO Chair in Data Privacy, Universitat Rovira i Virgili, Tarragona, Catalonia, Spain

  • Venue:
  • ASIACRYPT'11 Proceedings of the 17th international conference on The Theory and Application of Cryptology and Information Security
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

Broadcast encryption (BE) schemes allow a sender to securely broadcast to any subset of members but requires a trusted party to distribute decryption keys. Group key agreement (GKA) protocols enable a group of members to negotiate a common encryption key via open networks so that only the members can decrypt the ciphertexts encrypted under the shared encryption key, but a sender cannot exclude any particular member from decrypting the ciphertexts. In this paper, we bridge these two notions with a hybrid primitive referred to as contributory broadcast encryption (CBE). In this new primitive, a group of members negotiate a common public encryption key while each member holds a decryption key. A sender seeing the public group encryption key can limit the decryption to a subset of members of his choice. Following this model, we propose a CBE scheme with short ciphertexts. The scheme is proven to be fully collusion-resistant under the decision n-Bilinear Diffie-Hellman Exponentiation (BDHE) assumption in the standard model. We also illustrate a variant in which the communication and computation complexity is sub-linear with the group size. Of independent interest, we present a new BE scheme that is aggregatable. The aggregatability property is shown to be useful to construct advanced protocols.