1 trace, revoke and self enforcement mechanisms for protecting information moni naor weizmann...
TRANSCRIPT
1
Trace, Revoke and Self Enforcement Mechanisms for Protecting Information
Moni Naor
Weizmann Institute of Science
2
Digital ContentDigital Content
• Very easy to generate, transfer and reproduce
• However - also easy to violate ownership:– Copyright– Privacy
Safe prediction: this phenomenon will only increase in the future.
3
Ownership ProtectionOwnership Protection
• Social Issue
• Technological developments can impact the ground rules: by imposing technical as well as social barriers
for the violators
Technology is neither a panacea nor irrelevant!
4
TechniquesTechniques
• Protecting content - – methods for discouraging/preventing redistribution of content - after decryption
• Watermarking• Fingerprinting
• Tamper Resistance • Hardware• Software
• Protecting cryptographic keys– Broadcast Encryption/Revocation– Tracing Traitors– Trace and Revoke
Solution may apply combination of techniques
5
Methods for Key ProtectionMethods for Key Protection
Goal of key protection mechanisms:• Create a legitimate channel of distribution of
content and disallow its abuse. • Illegitimate distribution should require the
establishment of alternative channels – should not be able to piggyback on the legitimate
channel
Alternative channels should be combated using other means
6
Techniques for Key ProtectionTechniques for Key Protection
How to send information only to intended recipients• Broadcast Encryption/RevocationHow to detect/prevent abuse• Traitor Tracing• Self Enforcement
7
Talk Plan• The stateless scenario for trace and revoke• The Subset Cover Framework for T&R schemes• Two subset cover schemes
– Complete Subset– Subset Difference
• “Implementation” Issues• Tracing:
– General - bifurcation property– Subset difference
• Security definition
8
The Broadcast Encryption ProblemThe Broadcast Encryption ProblemCenter transmits a message to a large group
A subset of users is revoked and should not
be able to decrypt the message subset changes dynamically
Receivers are Stateless independent of history
depend only on initial configuration
essential for “off-line” applications, useful
otherwise
Center revokednon-revoked
message M
9
TracingTracing The problem of Tracing Traitors:
Encryption allows to figure out who leaked the keys
black-box tracing
traitors can gather information, e.g. a clone
Trace and Revoke
trace leaked key(s)
revoke it/them - make box unusablePowerful
Combination!}
10
Key protection in MediaKey protection in Media
• Content is distributed on CD, DVD, memory-card...– content is encrypted
• Players/Recorders are the receivers– typically are Stateless– Receivers are given decryption keys at manufacturing
Goal:– Revoke non-compliant players
• revoked player cannot decode future content– Trace the identity of a "cloned"/"hacked" player
• black-box tracing
• Example: CPRM (DVD Audio)
11
DesiderataDesiderata
• Low bandwidth: Small message expansion - E(content) not much longer than original message.
• Amount of storage at the users - Iu - small– Also at the center
• Attentiveness - users need not be online - stateless• Resiliency to large coalitions of users who collude and
share their resources
12
Summary of ResultsSummary of ResultsDefine the Subset-CoverSubset-Cover framework
Family of algorithms, encapsulating previous methods
Rigorous security analysis Sufficient condition for an algorithm in framework to be secure
Provide the Subset-DifferenceSubset-Difference revocation algorithms r-flexible
concise message length
Tracing algorithm Works for any algorithm in framework satisfying the bifurcation
property
Seamless integration with the revocation algorithm
Withstands any coalition size
13
PreliminariesPreliminaries Notion: NN - set of n users
R - set of r users whose privileges are to be revoked;
Assumption: Stateless devices
Goal: encrypt so that a non-revoked user can decrypt correctly
No coalition of revoked users (of an arbitrary size)
can decrypt
14
Subset-Cover Revocation and Subset-Cover Revocation and Tracing AlgorithmsTracing Algorithms
n - total no. of users
r - no. revocations
t - no. of traitors (illegal users)
Scheme MessageLength
# Keysper device
ProcessingTime
# decrypt MessageLength fortraitors
CompleteSubtree
r log n/r log n log log n 1 t log n
SubsetDifference
2r-11.25r (avg.) 0.5 log2n
log napplicationsof a PRSG
1 5t
15
• Scheme Initiation -– a method to assign secret information to devices, Iu to u.
• The broadcast algorithm -– For message M and a set R of users to be revoked, produce
a ciphertext C to broadcast to all.• A decryption algorithm (at device)-
– a non-revoked device should produce M from ciphertext C. – Decryption should be based on the current message and the
secret information Iu only (i.e. stateless).– Impossible to produce M from ciphertext even when provided
with the secret information of all revoked users.
Components of a stateless systemComponents of a stateless system
16
• Can define it rigorously• Moral equivalent of an adaptive chosen ciphertext
attack
Definition of Security for a Definition of Security for a Stateless Broadcast SystemStateless Broadcast System
Separation between long and short term security requirement
17
Subset Cover FrameworkSubset Cover Framework
Framework encapsulates many previous schemes
• Idea: to revoke a set RR, partition the remaining users into subsets from some predetermined collection.
• Encrypt for each subset separately
Suggest schemes with low bandwidth, low storage that allow tracing
18
An algorithm in the framework:An algorithm in the framework:
Underlying collection of subsets (of devices) S1, S2 , ... ,SW Sj N.
• Each subset Sj associated with long-lived key Lj – A device u Sj should be able to deduce Lj from its secret
information Iu
• Given a revoked set RR, the non-revoked users NN \ RR are partitioned into m disjoint subsets
Si1, Si2
, ... , Sim (NN \ RR = Sij
)
– a session key K is encrypted m times with Li1, Li2
, ... , Lim .
19
Framework: Encryption PrimitivesFramework: Encryption PrimitivesSeparating Short Term from Long Lived KeysSeparating Short Term from Long Lived Keys
Fk : encrypts the message
K is a session key, fresh for each message
fast, not expanding plaintext (e.g. stream cipher)
EL : encrypts the session key
L are long lived keys
generally stronger than F
Can give precise definition for the required strength of EL and Fk
20
The Broadcast AlgorithmThe Broadcast Algorithm• Choose a session key K
• Given R, find a partition of N \ R into disjoint sets
Si1, Si2
, ... , Sim
NN \ RR = Sij
with associated keys Li1, Li2
, ... , Lim
• Encrypt message M
[i1, i2, …,im], ELil(K), ELi2(K), … , ELim(K) FK(M)
HEADER Body
21
The Decryption Step at uThe Decryption Step at u
[i1, i2, …,im], Cl=ELil(K), … , Cm=ELim(K) FK(M)
HEADER Body
Either
Find the subset ij such that u Sij , or
null if u R
Obtain Lij from the private information Iu
Compute DLij(Cj) to obtain K
Decrypt FK(M) with K to obtain the message.
u is revoked!
22
A Subset-Cover AlgorithmA Subset-Cover Algorithm
Specifies:Specifies: Evaluated based on:Evaluated based on:Collection of underlying subsetsKey assignment to each subset“Subset-Cover” method to cover the non-revoked devicesFor a device: how to find its subset S and its key Ls from its private information.
Header lengthStorage (# keys) at thedeviceProcessing at the device time # decryptionsFlexibility with respect to r
23
Two extreme examplesTwo extreme examples
• Collection of subsets: all Sj N W = 2n -1– Low bandwidth
For any R we have m=1 - use S1 = N \ R– No good key assignment - each user should store 2n-1 keys
• Collection of subsets: all Sj ={j}. W = n– High bandwidth
For any R we have m = |N \ R | - use all {Sj | j N \ R }
– Good key assignment - each user stores only 1 key
Challenge: find a scheme with small coverage m and succinct secret information Iu
24
Important Observation:Important Observation:Key Indistinguishability
Users Sj should not know long-lived key Lj Possible solution:
– Choose Lj independently. – Let Iu
= {L
j | u Sj } - can result in long Iu
Alternative: sufficient condition for security:Given {Iu | u Sj }, key Lj is computationally indistinguishable
from random
Yields (provably) large savings in storage at the receivers
25
Security Theorem (format)Security Theorem (format)
Any subset cover scheme where
• Fk : is sufficiently strong
• EL : is sufficiently strong
• The keys Lj satisfy the Key Indistinguishability propertyIs Secure…
26
The Complete Subtree MethodThe Complete Subtree MethodImagine a full-binary tree with n leaves corr. To NN
E.g. if n=232, a 32-levels complete binary tree
Underlying Subsets S1, S2 , … ,SW
for node vi in the full tree,
Si – set of all leaves in the subtree of vi.
w = 2n-1
Key assignment:
assign a key Li to every node vi in the tree
Device keys:
store all log n+1 keys along path to the root
E.g. if n=232, need 33 keys
Si…
ViLi
27
Complete Subtree: Key AssignmentComplete Subtree: Key Assignment
devices
Iu = { L1 , L2 , L3 , L4 , L5 , L6 }
u
L1
L2
L3
L4
L5
L6
28
Subset Cover of non-revoked devicesSubset Cover of non-revoked devicesComplete Subtree MethodComplete Subtree Method
revokednon-revoked
cover
29
Subset cover of non-revoked devicesSubset cover of non-revoked devices
Cover = all maximal sets Si (complete subtrees)
containing only non-revoked devices,
• Worst/Average case – r log n/r such sets
• Example: for n =232, r=216 and 7-bytes session-key:
total of 16*7 + 4=116 bytes/revocation (4+7*log216)
33 keys/device
30
The Subset-difference Method:The Subset-difference Method:Subset DefinitionSubset Definition
Imagine a full-binary tree with n leaves corr. To NN E.g. if n=232, a 32-levels complete binary tree
Subsets S1, S2 , … ,SW , w = n log n for a pair of nodes [Vi, Vj] in the full tree such that Vi is an ancestor of Vj , Sij – set of all leaves in the subtree of Vi but not in Vj.
vi
vj
Si,j
… … …
vi
vj
31
Subset Difference DefinitionSubset Difference Definition
Si,j = Set of all leaves in the subtree of Vi but not in Vj
vi
vj
… ……
Si,j
vi
vj
32
Subset Cover of non-Revoked DevicesSubset Cover of non-Revoked DevicesSubset-Difference MethodSubset-Difference Method
revokednon-revokedcover
Vi
Si,j = Vj
33
Cover is Very Small !!Cover is Very Small !!
Fundamental property:
Size of the subset cover in the difference-subset method is
At most 2r-1 in the worst case 1.25r in the average case !
34
Key AssignmentKey Assignment
GGM is practical!
GGM= Goldreich, Goldwasser & Micali
35
Key-AssignmentKey-AssignmentSubset-Difference MethodSubset-Difference Method
Naive approach to the key assignment:
assign a key Li,j to every pair [vi, vj] in the tree
impractical: each device must store O(n) keys…
Use G, a pseudo-random sequence generator that
triples the input length (k 3k) à la GGM
Use G to derive a labeling process
S – label @ node,
GL(S) – label @ left child, GR(S) – label @ right child
GM(S) – key @ node.G (S) = G_L (S) G_M (S) G_R (S)
S
G_L (S) G_R (S)
36
Key Assignment - cont.Key Assignment - cont.
Assign to each node
Vi a label LABELi
The key Li,j = GM of
the label LABELi,j at
node Vj derived from
LABELi down
towards Vj … ……
vi
vj
S=LABELi
G_L (S)
G_L(G_L (S))
G_L(G_L(G_L (S)))
G_R (S)
G_R(G_L(G_L (S)))
LABELi,j = G_R(G_L(G_L (S)))
Li,j = G_M (LABELi,j )
37
Key-AssignmentKey-AssignmentSubset-Difference MethodSubset-Difference Method
…
S=LABELi
G_L (S)
G_L(G_L (S))
G_L(G_L(G_L (S)))
LABELi,j = G_R(G_L(G_L (Li)))
Li,j = G_M (LABELi,j )
… …
G_R(G_L(G_L (S)))
G_R (S)
Vi
Vj
38
Providing Keys to DevicesProviding Keys to DevicesA device corresponds to a leaf u in
the tree
For every Vi ancestor of u whose
label is S u receives all labels@nodes that are
hanging off the path from Vi to u.
These labels are all derived from S.
u can compute all keys of the sets it
belongs to rooted at Vi , and only
them.u
sVi
39
Providing Keys to DevicesProviding Keys to Devices
u
sVi
Total # of labels u has to store is
0.5log2 n + 0.5 log n + 1 :
k labels for each ancestor Vi
which is k levels above u
k=1, …, log n+1
For n=232, about 530 labels
Requires log n on-the-fly
applications of G to derive a key
40
Only 13 bytes per Single RevocationOnly 13 bytes per Single Revocation
For N= 232 and 7-bytes session-key
total of 1.25 * 7 + 4 < 13 bytes/revocations
530 labels/device
[i1, i2, …,im] ELi1(K), ELi2(K), … , ELim(K) FK(M)
4r bytes 9r bytes
41
Tracing TraitorsTracing Traitors• Some Users leak their keys to pirates• Pirates construct unauthorized decryption devices and
sell them at discount • Trace and Revoke for all subset cover algorithms
satisfying bifurcation property• More efficient procedure for subset difference
E(Content)
K1 K3 K8
ContentPirate Box
42
Tracing AlgorithmTracing AlgorithmAssumptions on illegal device: can examine box reaction on encrypted messages
reset button, no “locking” strategy
decodes with probability > q (say 0.5)
Goal: output one of the two a user u contained in the box
a partition S = Si1 , Si2, …, Sim that disables the box
Evaluation: performance requirement from revocation scheme
number of queries
encrypted messages
U1, U2, …, Ut
u
S = Si1 , Si2, …, Sim
43
Subset TracingSubset Tracing
Given an illegal decoder and a subset-cover
partition S, output: decoder is no longer decoding
a subset Sij containing a traitor
S = Si1 , Si2, …, Sim
illegal decoder
SubsetTracing not decrypting
Sij contains a traitor
44
Why is Subset-Tracing Possible?Why is Subset-Tracing Possible?
Consider a partition S = Si1 , Si2, …, Sim:
Header contains the correct key – decodes
Header contains all random keys – does not decode
Using a hybrid technique, find a subset j that has
gap at least l / m.
p0=1
pj-1
pj
pm=0
ELi1(K),…,ELij-1(K),ELij(K),ELij+1(K),…, ELim(K) FK(M)
ELi1(R),…,ELij-1(R),ELij(K),ELij+1(K),…, ELim(K) FK(M)
ELi1(R),…,ELij-1(R),ELij(R),ELij+1(K),…, ELim(K) FK(M)
ELi1(R),…,ELij-1(R),ELij(R),ELij+1(R),…, ELim(R) FK(M)
Sij contains a traitor!
45
Definition: Bifurcation PropertyDefinition: Bifurcation Property
Any subset Si can be partitioned into (roughly) two
equal sets Si1 and Si2
.
Si = Si1 U Si2
Bifurcation value:
Max { |Si1/Si|, |Si2/Si|}Vi
Vj
L R
Bifurcation value = 2/3
L
Vj
RVi
L
46
The Tracing AlgorithmThe Tracing AlgorithmStart with an initial partition S = Si1 , Si2, …, Sim.Repeat Apply “Subset-Tracing” to S If “not decrypting” , done. Otherwise, Sj contains a traitor
Split Sj into Sj1 and Sj2
Add Sj1 and Sj2 to S
S1 S2 Sm
Subset Tracing
Sj
S1 S2 SmSj1 Sj2
47
The Tracing AlgorithmThe Tracing Algorithm
S1 S2 Sm
Subset Tracing
Sj
S1 S2 SmSj1 Sj2
Subset Tracing
Sk
S1 S2 Sk1 Sk2
Subset Tracing not decrypting - done
48
Efficiency: tracing Efficiency: tracing tt traitors traitors
A subset is partitioned only if it has a traitor
contains more than 1 element
Therefore – at most t log n iterations
actually, t log (n/t)
Results in a partition of size at most t log (n/t)
Subset Difference: Only t subsets actually contain a traitor; Can the others be merged?
Yes, can get down to O(t) subsets !
49
Frontier subsetsFrontier subsetsIdea: merge those that were not shown to have a traitor
Frontier Subsets:
Problem: can the non-frontier sets be merged to yield
few subsets-difference sets?
B and C are in the Frontier
B1, B2 are in the frontier, C is not
Merge C with the non-frontier subsets
A
B C
C B1 B2
50
This can be done for Subset-DifferenceThis can be done for Subset-Difference
Lemma:
given k sets of the subset-difference form, possible to
cover the rest with at most 3k sets of the
subset-difference form.
At every step, 2t frontiers sets
The merge results in 3t more set
A partition contains at most 5t sets.
51
““Implementation” IssuesImplementation” Issues
• Specifying the subsets for quick determination• Implementing EL and Fk
• Prefix Truncation (reducing header length)• Public Keys
52
Prefix TruncationPrefix Truncation If EL is a block cipher and K is shorter than its block size
Replace
EL(K) [Prefix K EL(U)] K
where U is a random string of the same length as the key for EL
[i1, i2, …,im, ELil(K), ELi2(K), … , ELim(K) FK(M)
reduction in length
security is preserved
[i1, i2, …,im, U, [Prefix K ELi1(U)] K), …,[Prefix K ELim(U)] K)] FK(M)
53
Working with public keysWorking with public keys
• Any PKC can ``work” with any subset cover algorithmProblems:• The key assignment yields private keys –
– Need an efficient way to generate public-keys from private. Good method: Diffie-Hellman - gLi
• Low overhead: want to use prefix truncation. Idea: choose random x and h and broadcast: [(gx ,h), h(gL1 )x ))K, gx , h(gL2 )x ))K ... gx , h(gLm )x ))K], Fk(M)
54
PublicPublic keys - unresolved issueskeys - unresolved issues
• Size of public-key file – Need to publish the public-key of every subset - size W. Could be large– Possible solution: identity based encryption - works only for the
information theoretic case
• Immunity to chosen ciphertext attacks with prefix truncation– Cramer-Shoup, Fujiskai-Okamoto require ``per key” treatment– Possible to use Schnorr like proofs of knowledge with random oracles.
55
Comparison to Other MethodsComparison to Other MethodsStateless version
• Broadcast Encryption [Fiat Naor]– message length O(t log2 t), t is the coalition size
• Logical Key Hierarchy (LKH) – tree based methods for member-revocation – [Wallner et. al], [Wong et. al]: message length (2r log n) – [Canetti et. al]: improved to O(r log n)
• Trace & Revoke– [Naor Pinkas] , ([Anzai et. al]): transmit O(r) long DH keys,
O(t) keys/device and O(r) decryptions
56
Tracing - Comparison
• Combinatorial Schemes - black-box testing [CFN,NP]• Public-key Tracing - Boneh and Franklin black-box
confirmation• Integration with revocation [GSY]
57
Other Models
• Content Tracing: detects users redistributing content after decoding– Watermarking: [Boneh, Shaw]
– Dynamic tracing traitors: [Fiat, Tassa]• improvements: [Berkamn et. al], [Safani-Naini]
• Preventing leakage of keys– Legally: yield a proof for traitor's liability [Pfitzmann]
– Self enforcement: deter users from revealing personal information [DLN: Signets]
58
Further WorkFurther Work• Reduce Size of public-key file
– GGM in public key mode
• Public key - Immunity to chosen ciphertext attacks • Broadcast encryption with ``medium” sized sets and no hierarchy• Better lower bounds
– Information theoretic case– Computational case
• Better constructions– LSD, Halevy-Shamir– Generalizations?
• Tracing Traitors• Social/economical Implications? Restricted formats
59
Multicast Security
Group Membership:• re-keying event: all users update their group key and labels
– requires all users to be connected
Instead, add an header with legitimate users only.
Backward secrecy
lacks backward secrecy
needs re-keying when a new user is added to the group
Instead, assign users consecutively
“revoked” the unused ones
use hierarchical revocation