Description
We consider a generalisation of the encryption from "one-to-one'' to "one-to-many'' communication, i.e. broadcast encryption. The objective is to allow a center to send secret messages to a large number of receivers. The security notion in “one-to-many” communications needs to be extended beyond the notion of confidentiality in “one-to-one” encryption in order to meet practical requirements. Two main functionalities are studied: (1) traitor tracing which identifies the malicious users who leak their secrets to a pirate and (2) revocation which prevents malicious users and/or non-legitimate ones from decrypting broadcasted information.<br/> In the first part of the talk, we focus on combinatorial schemes. We consider the Exclusive Set System (ESS) which has been originally designed to support revocation. We propose a method to integrate the black-box tracing capacity in ESS by introducing a technique called "shadow group testing''.<br/> The second part of the talk discusses the techniques for constructing algebraic schemes which can overcome some limitations of combinatorial schemes. We propose a lattice-based traitor tracing of which the security is based on the hardness of a new variant of the Learning With Errors problem, namely k-LWE (for k traitors). We then prove the hardness of the k-LWE problem which implies that the proposed traitor tracing scheme is asymptotically as efficient as the Regev LWE-based encryption. Our technique can also be used to improve the Boneh-Freeman reduction from SIS to k-SIS from exponential loss to polynomial loss in k (thus answer their open problem of a tighter reduction from SIS to k-SIS). We finally consider the combination of algebraic and combinatorial methods and discuss some promising directions.
Prochains exposés
-
Polytopes in the Fiat-Shamir with Aborts Paradigm
Orateur : Hugo Beguinet - ENS Paris / Thales
The Fiat-Shamir with Aborts paradigm (FSwA) uses rejection sampling to remove a secret’s dependency on a given source distribution. Recent results revealed that unlike the uniform distribution in the hypercube, both the continuous Gaussian and the uniform distribution within the hypersphere minimise the rejection rate and the size of the proof of knowledge. However, in practice both these[…]-
Cryptographie
-
Primitive asymétrique
-
Mode et protocole
-
-
Post-quantum Group-based Cryptography
Orateur : Delaram Kahrobaei - The City University of New York