A note on the security of KHL scheme

• Main Authors: WENG, Jian, ZHAO, Yunlei, DENG, Robert H., LIU, Shengli, YANG, Yanjiang, SAKURAI, Kouichi
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2015
• Subjects: Cryptography; Traitor-tracing; Broadcast encryption; Chosen-ciphertext attacks; Computer Sciences; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/2820; https://ink.library.smu.edu.sg/context/sis_research/article/3820/viewcontent/KHL_scheme_pv_2015.pdf
• Institution: Singapore Management University

A public key trace and revoke scheme combines the functionality of broadcast encryption with the capability of traitor tracing. In Asiacrypt 2003, Kim, Hwang and Lee proposed a public key trace and revoke scheme (referred to as KHL scheme), and gave the security proof to support that their scheme is z-resilient against adaptive chosen-ciphertext attacks, in which the adversary is allowed to adaptively issue decryption queries as well as adaptively corrupt up to z users. In the passed ten years, KHL scheme has been believed as one of the most efficient public key trace and revoke schemes with z-resilience against adaptive chosen-ciphertext attacks under the well-studied DDH assumption. However, in this paper, by giving a concrete attack, we indicate that KHL scheme is actually not secure against adaptive chosen-ciphertexts, even without corruption of any user. We then identify the flaws in the security proof for KHL-scheme, and discuss the consequences of the attack. (C) 2015 Elsevier B.V. All rights reserved.