An efficient public key traitor tracing scheme

Authors: D. Boneh and M. Franklin

We construct a public key encryption scheme in which there is one public encryption key, and many private decryption keys. If a broadcaster encrypts once with the public key, then each legitimate receiver can decrypt with a different private key. If a coalition of receivers collude to create a new decryption key then there is an efficient algorithm to trace the new key to its creators. Hence, our system provides a simple and efficient solution to the ``traitor tracing problem''. Our tracing algorithm is deterministic, and catches all active traitors while never accusing innocent users, although it is only partially ``black box''. A minor modification to the scheme enables it to resist an adaptive chosen ciphertext attack. Our techniques apply error correcting codes to the discrete log representation problem.

In Proceedings Crypto '99, Lecture Notes in Computer Science, Vol. 1666, Springer-Verlag, pp. 338--353, 1999

Full paper: PostScript