Traitor Tracing - Encryption for Digital Content - page 127

the content in the cleartext form, or “no”, in case of responding arbitrarily or
jamming.
In our exposition, we will use the threshold σ to impose the adversarial
constraint related to the success probability of the pirate decoder in decrypting
regular transmissions. This is of particular importance, since tracing would be
impossible against a pirate decoder that is not required to operate correctly
at least some of the time.
Definition 3.16. For some s ∈ N, an s-ary multiuser encryption scheme
ME = (KeyDist,Transmit,Receive) is a black box traitor tracing scheme
for t-coalitions with success probability α against σ-pirates if there exists a
tracer T such that the tracing game TG = hKeyDist,Q BB ,R BB i against t-
coalitions is winnable by T with probability α against σ-adversaries.
Here Q BB , contains all random variables Transmit(ek,M) for any M ∈
M s where (tk,ek,sk 1 ,...,sk n ) ← KeyDist(1 n ). In case the scheme ME is
stateful over a set of States, Q BB is parameterized with States as well. On the
other hand, R BB (C,tk,ek,sk 1 ,...,sk n ,q,a) is equal to 1 if and only if a ∈ M
whenever q is sampled from Transmit(ek,M) where M is selected from M s .
Note that for simplicity in the above definition we defined Q BB to contain
random variables for each fixed M ∈ M s but depending on the occasion we
may consider more general plaintext distributions; this is consistent with the
fact that the intention here is to define Q BB as capturing the normal system
operation and occasionally we may be able to take advantage of the way a
system operates to facilitate our tracing procedures.
As stated above, one may also consider a more general view of the black box
tracing model, that is related to the case that the pirate decoder is a tamper
resistant box, such as a music player and the response of the decoder is not
the exact decryption of the transmission but rather the actual rendering of
the cleartext transmission on a display device. In such case, the tracer can still
extract useful information by observing whether the given ciphertext results
in music being played or not. It is possible to address such definitions in our
framework by having R determine exactly what input should be given to the
tracer (as opposed to disclosing a).
Among the different variations of the tracing game described in Defini-
tion 3.12 , tracing with resetting and tracing against abrupt adversaries are
relevant to black-box tracing as they are defining the capabilities of the pirate
decoder the tracer has access to. We would like to motivate these cases briefly
in the following paragraphs for the context of the present section.
A pirate decoder is said to be resettable if the tracer has the capability to
reset the pirate decoder to its initial state and the decoder is available for a
new query. This gives the tracer the advantage of asking queries that will be
handled independently during the tracing process, i.e., effectively preventing
the decoder from using previous querying information submitted by the tracer
in order to decide its present action.