Cryptography Reference
In-Depth Information
that came afterwards [
21
] is very similar in principle to this scheme. The
security and the correctness of this scheme as well as its traceability can be
analyzed as a combination to the analysis given in Theorem
3.22
and
3.24
for the Boneh-Naor and Kiayias-Yung schemes respectively and is a worthy
exercise for the reader. The transmission and the decryption are defined as
follows. Note that the encryption is stateful over a set States = [`].
• Transmit
SQ[
F
]
: Given a vector of input M = hm
1
,...,m
q
i and the en-
cryption key ek = {k
i,j
}
(i,j)∈[q]×[`]
, it first retrieves the state σ ∈{1,...,`}
from the set States and then transmits the encryption of the message M
with ek by using a symmetric encryption scheme (
E
,
D
) as follows:
hσ,
E
k
1,σ
(m
1
),
E
k
2,σ
(m
2
),...,
E
k
q,σ
(m
q
)i
The state σ is finally updated to (σ mod `) + 1.
• Receive
SQ[
F
]
: Given the key-material sk
u
= hk
w
1
,1
,k
w
2
,2
,...,k
w
`
,`
i for
any u ∈ [n] and a transmission of the form:
hi,c
1
,c
2
,...,c
q
i
it returns
D
k
w
i
,i
(c
w
i
).
A final note is due regarding the important issue of designing piracy detec-
tion mechanism so that the incrimination mechanism becomes legally binding.
In all the traitor tracing mechanisms we have presented in this chapter the
distributor is capable of framing innocent receivers by using the (known to it)
receiver's copy of the content/key information. In this light, it is also possible
for a malicious user to deny being implicated to a certain key-leakage or pirate
rebroadcasting incident. Non-repudiation is the concept that a receiver cannot
repudiate its implication or refute the validity of the evidence presented by
the distributor.
This problem was recognized as a fundamental for any traitor tracing
system and led to the introduction of asymmetric fingerprinting in [
95
]; this
was further discussed in [
12
,
94
,
96
]. The initial solutions for asymmetric
traitor tracing were based on generic secure function evaluation and thus
they were not very practical. Two very e
cient schemes were presented in
the context of public-key traitor tracing schemes by Watanabe et.al [
123
] and
Komaki et.al [
75
]. These two schemes were subsequently broken by Kiayias
and Yung in [
69
]. In this latter work, the first provable asymmetric public-key
traitor tracing scheme was presented.
