International Association
for Cryptologic Research

Broadcast encryption (BE) is a cryptographic primitive that allows a broadcaster to encrypt a content to a specific group of users called privileged users and prevent revoked users from decrypting the content. In BE schemes, a group of users, called traitor s may leak their keys and allow illegal reception of the content. Such malicious users can be detected through traitor tracing (TT) schemes. The ultimate goal in a content distribution system would be combining traitor tracing and broadcast encryption (trace and revoke mechanisms) so that any receiver key found to be compromised in a tracing process would be revoked in the future transmissions.

In this paper, we propose a generic method to transform a broadcast encryption scheme into a trace and revoke scheme. This transformation involves imposing a fingerprinting code over the underlying BE transmissions. In conventional usage of fingerprinting codes, this will inflate the public key size with an additional data linear in the length of the code. To restrain from such increase in public key size, we introduce a new property, called public samplability, of a fingerprinting code. This property enables us to simulate the code independently from the actual code generated for tracing purposes. We have proved this property for the open fingerprinting code of [10].

We have instantiated our generic transformation with the BE schemes of [4, 12, 19]: we introduce (i) trace and revoke schemes with constant private key size and short ciphertext size, (ii) the first ID-based trace and revoke scheme, (iii) the first publicly traceable scheme with constant private key size and (iv) the first trace and revoke scheme against pirate rebroadcasting attack in the public key setting.