Symmetric Key Broadcast Encryption: State-of-the-Art

Transcription

1 Symmetric Key Broadcast Encryption: State-of-the-Art Palash Sarkar (Based on joint work with Sanjay Bhattacherjee) Indian Statistical Institute India Research Network Meeting on Mobile Security 2015 Samsung R&D Institute India, Bangalore Palash Sarkar Symmetric Key BE 4th Dec, / 49

2 Research in Cryptology: A Personal Perspective Cryptographically useful Boolean functions. Design & analysis of block and stream ciphers and hash functions. Modes of operations for block and stream ciphers: Low-level, in-place, disk encryption. Schemes for authentication and encryption. Symmetric key broadcast encryption. Identity-based cryptography, digital signatures. Discrete log problem on finite fields and hyperelliptic curves. Secure and efficient implementations. Information security law and practical aspects of security. or, Google Palash Sarkar Palash Sarkar Symmetric Key BE 4th Dec, / 49

3 A Fledgling Start-Up Turing Laboratory: Structure: A project at the Applied Statistics Unit presently (i.e., up to March 2016) funded by the Indian Statistical Institute. People (current): One faculty member; two post-docs; three PhD students. Number of PhD students likely to increase. Number of post-docs/visitors depend on funding. Scope: Cryptology and related areas in a broad sense. Topics at the intersection of Math, Stat, CS and Engg. Goal: Gestation of ideas. To advance the current state-of-the-art. To formulate and investigate questions of foundational nature. Palash Sarkar Symmetric Key BE 4th Dec, / 49

4 Symmetric Key Broadcast Encryption: Background Palash Sarkar Symmetric Key BE 4th Dec, / 49

5 Conventional Symmetric Key Encryption Sender message M Receiver public channel Encrypt ciphertext Decrypt secret key K adversary secret key K Palash Sarkar Symmetric Key BE 4th Dec, / 49

6 Symmetric Key Broadcast Encryption Users Users Broadcast Users Centre Palash Sarkar Symmetric Key BE 4th Dec, / 49

7 Symmetric Key BE Functionality The centre pre-distributes secret information to the users. A broadcast takes place in a session. For each session: Some users are privileged and the rest are revoked. The actual message is encrypted once using a session key. The session key undergoes a number of separate encryptions; this determines the header. F Ks (M) E k1 (K s ) E kh (K s ) body header Correctness: The privileged users are able to decrypt. Security: The coalition of all the revoked users get no information about the message. Palash Sarkar Symmetric Key BE 4th Dec, / 49

8 Parameters of Interest Size of the header. User storage: size of the secret information required to be stored by the users. Time required by the centre to encrypt. Time required by a user to decrypt. Simplicity of implementation. Hdr sz and enc time are proportional to # enc of the session key. Requirement: Reduce header size, user storage and decryption time. Calls for trade-offs. Palash Sarkar Symmetric Key BE 4th Dec, / 49

9 Applications of BE AACS standard: content protection in optical discs: Disney, Intel, Microsoft, Panasonic, Warner Bros., IBM, Toshiba and Sony. Samsung is an AACS Authorised Certification Entity. Pay-TV: BSkyB in UK and Ireland has more than 10 million users; Cable TV Networks (Regulation) Amendment Act, 2011 (India). File Sharing in Encrypted File Systems. Encrypted to Mailing Lists. Military Broadcasts: Global Broadcast Service (US), Joint Broadcast System (Europe).... Real-life parameters of interest: Pay-TV bandwidth cost, set-top box booting time, high-end military receiver storage, resource-constrained devices. Palash Sarkar Symmetric Key BE 4th Dec, / 49

10 Subset Cover Schemes Identify a collection S consisting of subsets of users. Eg. S = {{u 1, u 2 }, {u 12, u 51, u 73 }, {u 2, u 11 },...}. Assign keys to each subset in S. To each user, assign secret information such that it is able to generate secret keys for each subset in S to which it belongs; and no more. During a broadcast, form a partition {S 1,..., S h } of the set of privileged users with S i S. The session key is encrypted using the keys for S 1,..., S h. Each privileged user can decrypt; no coalition of revoked users gains any information about the session key (or the message). Palash Sarkar Symmetric Key BE 4th Dec, / 49

11 Trivial Solutions Singleton set scheme: S = N. Each user has an independent key; separate encryptions of the message are made. Header size is the number of privileged users. User storage is one key per user. Power set scheme: S = 2 N. A key is assigned to each subset of users; a single encryption of the message is made to the key of the privileged set of users. Header size is just one encryption. Each user has to store 2 n 1 keys. Palash Sarkar Symmetric Key BE 4th Dec, / 49

12 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme Singleton Set scheme Palash Sarkar Symmetric Key BE 4th Dec, / 49

13 Schemes with Non-Trivial Trade-Offs Palash Sarkar Symmetric Key BE 4th Dec, / 49

14 Subset Difference Scheme Naor-Naor-Lotspiech (2001): patented, AACS standard. Assumes an underlying full binary tree Level Numbers Palash Sarkar Symmetric Key BE 4th Dec, / 49

15 Subsets in the collection S S i,j = T i \ T j : has all users that are in T i but not in T j i j Collection S: has all subsets S i,j such that j( i) is in the subtree T i. Palash Sarkar Symmetric Key BE 4th Dec, / 49

16 NNL-SD Parameters For n users out of which r are revoked: User storage needed: O(log 2 (n)). Header length in the worst case: 2r 1. Decryption time in the worst case: O(log n). Palash Sarkar Symmetric Key BE 4th Dec, / 49

17 Layered Subset Difference Scheme Halevy-Shamir (CRYPTO, 2002) Some levels are marked as special. Special Levels Layer Layer Palash Sarkar Symmetric Key BE 4th Dec, / 49

18 Layered SD Scheme T i special level T k T j Figure : Subset S i,j splits into S i,k (green leaves) and S k,j (grey leaves); i at a non-special level. Subsets S i,j where i and j are not in the same layer are not required any more. This results in reduction of user storage. Palash Sarkar Symmetric Key BE 4th Dec, / 49

19 HS-LSD Parameters For n users out of which r are revoked: User Storage needed: O(log 3/2 n). Maximum header length: 4r 2. Worst case decryption time: O(log n). Palash Sarkar Symmetric Key BE 4th Dec, / 49

20 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme Singleton Set scheme

21 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme Singleton Set scheme

22 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme Palash Sarkar Symmetric Key BE 4th Dec, / 49

23 Some Subsequent Schemes Goodrich, Sun and Tamassia (2004): User storage: O(log n). Header length: 2r 1. Decryption time: O(n). Cheon, Jho, Kim and Yoo (2008): A complicated scheme with a wide range of options. Header length can be reduced to below r, but, at the cost of greatly increasing the user storage. The decryption time is more than log n. Wang, Yang and Lin (2014): Header length smaller than that of the NNL-SD scheme. Increased user storage. Palash Sarkar Symmetric Key BE 4th Dec, / 49

24 An Overview of Recent Research Palash Sarkar Symmetric Key BE 4th Dec, / 49

25 Some Questions What is the expected header length of the NNL scheme? The NNL and the HS schemes are based on full binary trees; What happens if the number of users is not a power of two? Is the user storage achieved in the HS scheme the minimum possible? Is the (expected) header length achieved in the NNL scheme the minimum possible? What happens if we use trees of arity higher than 2? Palash Sarkar Symmetric Key BE 4th Dec, / 49

26 Some Answers Sanjay Bhattacherjee and Palash Sarkar. Complete tree subset difference broadcast encryption scheme and its analysis. Des. Codes Cryptography, 66(1-3): , Sanjay Bhattacherjee and Palash Sarkar. Concrete analysis and trade-offs for the (complete tree) layered subset difference broadcast encryption scheme. IEEE Transactions on Computers, 63(7): , Sanjay Bhattacherjee and Palash Sarkar. Tree based symmetric key broadcast encryption. Journal of Discrete Algorithms, 34, , Sanjay Bhattacherjee and Palash Sarkar. Reducing communication overhead of the subset difference scheme. IEEE Transactions on Computers, Palash Sarkar Symmetric Key BE 4th Dec, / 49

27 The Players Sanjay Bhattacherjee, presently post-doc at ENS-Lyon, France. PhD thesis available at: Implementations: id=0b7azs7qqqds0unb5ahp3wmjwcdq&usp=sharing_eil. Uploaded on 13th August, Palash Sarkar. Indian Statistical Institute: provided the infrastructure and the environment for carrying out the research. Palash Sarkar Symmetric Key BE 4th Dec, / 49

28 NNL-SD Scheme: Limitations and Beyond Palash Sarkar Symmetric Key BE 4th Dec, / 49

29 Complete Tree SD Scheme Question: What happens when the number of users is not a power of two? Possible answer: Add dummy users to get to the next power of two. Revoked: Disastrous effect on header length. Privileged: Better but, still a measureable deterioration of header length. Solution: Use a complete binary tree. Completes (and also subsumes) the NNL-SD scheme to work for any number of users. Conceptually simple; working out the details is involved. Palash Sarkar Symmetric Key BE 4th Dec, / 49

30 CTSD: Maximum Header Length Theorem: The maximum header length in the CTSD method for n users is min(2r 1, n 2, n r). For the NNL-SD scheme, the bound of 2r 1 was known. Complete picture: if r n/4, the bound 2r 1 is appropriate; if n/4 < r n/2, the bound n/2 is appropriate; and if r > n/2, the bound n r is appropriate. Using the CTSD method is never worse than individual transmission to privileged users. Palash Sarkar Symmetric Key BE 4th Dec, / 49

31 CTSD: Expected Header Length Random experiment: Select a random subset of r users out of n users and revoke them. Random variable X i n,r : takes the value 1 if S i,j is in the header for some j and 0 otherwise. E[X i n,r ] = Pr[X i n,r = 1]. H n,r : expected header length for n users with r revoked users. H n,r = E[X i n,r ] = Pr[X i n,r = 1] where the sum is over all the n 1 internal nodes i in the tree. H n,r can be computed in O(r log n) time and O(1) space. Palash Sarkar Symmetric Key BE 4th Dec, / 49

32 NNL-SD: Expected Header Length Theorem: For all n 1, r 1, the expected header length H n,r H r, as n increases through powers of two, where ( r 1 ( H r = 3r ) i + 2 i=1 i ( ) ) i (2 ( 1) k k 3 k ) k (2 k. 1) k=1 r H r /r Palash Sarkar Symmetric Key BE 4th Dec, / 49

33 Minimising User Storage Palash Sarkar Symmetric Key BE 4th Dec, / 49

34 Halevy-Shamir LSD Scheme Special Levels Layer Layer The root is considered to be at a special level, and in addition we consider every level of depth k log (n) for k = 1... log (n) as special (wlog, we assume that these numbers are integers). Works for 2 l 0 users with l 0 = 4, 9, 16, 25 (in the practical range). Palash Sarkar Symmetric Key BE 4th Dec, / 49

35 Generalisation: Notion of Layering Strategy A choice of special levels is called a layering strategy. A layering strategy l is denoted by the numbers of the special levels l 0 > l 1 >... > l e 1 > l e = 0. The layering strategy has (e + 1) special levels. Let l = (l 0,..., l e ). In general, the layer lengths need not be (almost) equal. It is not necessary for the root node to be special. Leads to smaller storage. Palash Sarkar Symmetric Key BE 4th Dec, / 49

36 Layering Strategy and User Storage storage 0 (l) = e 1 l i + 1 e 1 (l i l i+1 )(l i l i+1 1). 2 i=0 i=0 Recursive description: storage 0 (l 0, l 1,..., l e ) = l 0 + (l 0 l 1 )(l 0 l 1 1) 2 Layering strategy with root as a non-special layer: storage 1 (l) = storage 0 (l) l 1. + storage 0 (l 1,..., l e ). Palash Sarkar Symmetric Key BE 4th Dec, / 49

37 Storage Minimal Layering Consider a tree of height l 0 : SML 0 (l 0 ): a layering strategy which minimises the user storage among all layering strategies; #SML 0 (l 0 ): user storage required by SML 0 (l 0 ); Root node is not special: SML 1 (l 0 ) and #SML 1 (l 0 ) correspond to the case where the root is not special. Palash Sarkar Symmetric Key BE 4th Dec, / 49

38 Computing SML Dynamic Programming: An O(l 3 ) time and O(l 2 ) space algorithm to compute #SML 0 (l 0 ). The actual layering strategy SML 0 (l 0 ) can also be recovered from the algorithm. Also possible to obtain #SML 1 (l 0 ) and SML 1 (l 0 ). Palash Sarkar Symmetric Key BE 4th Dec, / 49

39 Examples of SML Suppose there are 2 28 users, i.e., l 0 = 28: NNL-SD: layering: 28,0; storage: 406. ehs: layering: 28,22,16,10,5,0; storage: 146. SML 0 : layering: 28,21,15,10,6,3,1,0; storage: 140. SML 1 : layering: 22,16,11,7,4,2,0; storage: 119. Palash Sarkar Symmetric Key BE 4th Dec, / 49

40 Header Length Maximum Header Length: At most min (4r 2, n 2, n r). At most min (4r 3, n 2, n r) if the root level is special. Expected Header Length: The splitting of subsets complicates the analysis. An O(r log 2 n) time algorithm to compute the expected header length. A very useful tool to analyse various schemes. Palash Sarkar Symmetric Key BE 4th Dec, / 49

41 Constrained Minimisation Question: Is it possible to obtain expected header length close to that of NNL-SD, but, with lower user storage? For each level, consider the expected number of subsets arising from the nodes at that level. Suppose l is a level which maximises this quantity. Question: How to choose l? Answer: Extensive experimentation has shown that l = l 0 log 2 r is a good choice. Palash Sarkar Symmetric Key BE 4th Dec, / 49

42 Constrained Minimisation Layering Fix a value of r and set l = l 0 log 2 r. Level l is made special, so that subsets arising from level l are not split. All levels below l are made non-special. At most one level above l (mid-way between l and the root) is made special; all other levels are made non-special. l max = l 0 log 2 r Palash Sarkar Symmetric Key BE 4th Dec, / 49

43 A CML Example Number of users is n = 2 28 i.e., l 0 = 28 and suppose r min = NNL-SD: layering: 28,0; storage: 406. ehs: layering: 28,22,16,10,5,0; storage: 146; header lengths: (1.69, 1.63, 1.64, 1.67, 1.69, 1.72, 1.73, 1.74, 1.75, 1.75). CML: layering: 23, 18,0; storage: 219; header lengths: (1.14, 1.08, 1.04, 1.03, 1.01, 1.01, 1.00, 1.00, 1.00, 1.00). Header lengths for 10 equispaced values of r from 2 10 to 2 14 normalised by the header length of the NNL-SD scheme. Palash Sarkar Symmetric Key BE 4th Dec, / 49

44 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Palash Sarkar Symmetric Key BE 4th Dec, / 49

45 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme

46 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme SML-SD scheme

47 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme SML-SD scheme CML-SD scheme Palash Sarkar Symmetric Key BE 4th Dec, / 49

48 Header Length Reduction. Palash Sarkar Symmetric Key BE 4th Dec, / 49

49 Approach-I: k-ary Tree Use of a k-ary tree with k 2: Header length with k > 3 is usually lower than header length with k = 2, though this is not always true. The comparison of header lengths for k = 3 and k = 2 is very interesting. User storage grows. Palash Sarkar Symmetric Key BE 4th Dec, / 49

50 k-ary tree SD Performance Palash Sarkar Symmetric Key BE 4th Dec, / 49

51 Approach-II: Augmented Binary Tree SD Scheme To each node of the binary tree, append an additional binary tree having a levels. Leads to a clear decrease in header length compared to the NNL-SD scheme. The user storage increases. Two other parameters are introduced to obtain O(n log n) schemes with header-length/user-storage trade-offs which vary from the NNL-SD scheme to the power set scheme. Palash Sarkar Symmetric Key BE 4th Dec, / 49

52 a-abtsd Performance Palash Sarkar Symmetric Key BE 4th Dec, / 49

53 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme SML-SD scheme CML-SD scheme

54 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme SML-SD scheme CML-SD scheme

55 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme SML-SD scheme CML-SD scheme

56 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme SML-SD scheme CML-SD scheme

57 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme SML-SD scheme CML-SD scheme

58 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme SML-SD scheme CML-SD scheme a-abtsd schemes (for different values of a)

59 Pictorial Representation of S Intuition As S increases, header size decreases and user storage increases. Power Set scheme NNL-SD scheme HS-LSD scheme Singleton Set scheme k-sd schemes (for different values of k) SML-SD scheme CML-SD scheme a-abtsd schemes (for different values of a) Palash Sarkar Symmetric Key BE 4th Dec, / 49

60 Thank you for your kind attention! Palash Sarkar Symmetric Key BE 4th Dec, / 49