Traitor Tracing - Encryption for Digital Content - page 129

in the presence of honest subscribers (i.e., using the same channel as the
one used to transmit to all users) without disrupting their operation : the
tracer will submit the tracing ciphertexts to the pirate decoder while the
other participants will be decrypting them correctly.
Observe that the combination of alfresco tracing with a history-recording
adversary yields a very powerful tracing mechanism. Indeed, it permits the
tracing to be performed in the presence of honest users while the receiving
decoder is history-recording. This setting enables us to tackle a scenario that is
known as pirate rebroadcasting. In this scenario, the adversary first decrypts
the content by using its traitor key material and then once it is in clear text
form, it rebroadcasts the content.
3.5 Traceability of Multiuser Encryption Schemes
In this section, we will discuss traceability of the multiuser encryption schemes
of Section 3.2 .
3.5.1 Traceability of Linear Length Multiuser Encryption Scheme
We will now show that the linear length multiuser encryption scheme ME L
described in Section 3.2 is a black box traitor tracing scheme against resettable
pirate decoders. Recall that resettable pirate decoders allow the tracer to reset
the adversary and to receive fresh responses forgetful of the history of the
interaction. This is the key fact in our choice of tracing queries; in particular
we will deviate from the normal set of random variables Q BB and query the
decoder with some special tracing ciphertexts that will yield the identification
of a traitor involved in piracy.
Recall that the linear length multiuser encryption scheme ME L transmits
a vector of ciphertext h E k 1 (m),..., E k n (m)i where ( E , D ) is the underlying
symmetric encryption scheme of ME L and the key k i is available to the i-th
receiver. We will, now, decribe the special tracing queries of a particular tracer,
denoted by T S , that is interacting with A. The tracing queries consist of the
special transmission Transmit L (ek,m) for s = 0,1,...,n by substituting the
first s ciphertexts with random strings.
Transmit L (ek,m) = h E k 1 (R 1 ), E k 2 (R 2 ),... E k s (R s ), E k s+1 (m),... E k n (m)i
(3.3)
where R i , for i = 1,...,s, is a random string of the same length as the
message m. Given that the adversary-tracer pair is σ-admissible the adver-
sary will be required to respond the queries of type Transmit L (ek,m) such
that the predicate R BB is satisfied with probability at least σ. On the other
hand note that the predicate necessarily fails with overwhelming probability