International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Traitor Tracing without Trusted Authority from Registered Functional Encryption

Authors:
Pedro Branco , Bocconi University, Milan, Italy
Russell W. F. Lai , Aalto University, Espoo, Finland
Monosij Maitra , Indian Institute of Technology Kharagpur, Kharagpur, India
Giulio Malavolta , Bocconi University, Milan, Italy
Ahmadreza Rahimi , Max Planck Institute for Security and Privacy, Bochum, Germany
Ivy K. Y. Woo , Aalto University, Espoo, Finland
Download:
Search ePrint
Search Google
Conference: ASIACRYPT 2024
Abstract: Traitor-tracing systems allow identifying the users who contributed to building a rogue decoder in a broadcast environment. In a traditional traitor-tracing system, a key authority is responsible for generating the global public parameters and issuing secret keys to users. All security is lost if the \emph{key authority itself} is corrupt. This raises the question: Can we construct a traitor-tracing scheme, without a trusted authority? In this work, we propose a new model for traitor-tracing systems where, instead of having a key authority, users could generate and register their own public keys. The public parameters are computed by aggregating all user public keys. Crucially, the aggregation process is \emph{public}, thus eliminating the need of any trusted authority. We present two new traitor-tracing systems in this model based on bilinear pairings. Our first scheme is proven adaptively secure in the generic group model. This scheme features a {\it transparent} setup, ciphertexts consisting of $6\sqrt{L}+4$ group elements, and a public tracing algorithm. Our second scheme supports a bounded collusion of traitors and is proven selectively secure in the standard model. Our main technical ingredients are new registered functional encryption (RFE) schemes for quadratic and linear functions which, prior to this work, were known only from indistinguishability obfuscation. To substantiate the practicality of our approach, we evaluate the performance a proof of concept implementation. For a group of $L = 1024$ users, encryption and decryption take roughly 50ms and 4ms, respectively, whereas a ciphertext is of size 6.7KB.
BibTeX
@inproceedings{asiacrypt-2024-34659,
  title={Traitor Tracing without Trusted Authority from Registered Functional Encryption},
  publisher={Springer-Verlag},
  author={Pedro Branco and Russell W. F. Lai and Monosij Maitra and Giulio Malavolta and Ahmadreza Rahimi and Ivy K. Y. Woo},
  year=2024
}