1
$\begingroup$

What is the best way of using both broadcast encryption and RSA private keys? I'm particularly interested in Broadcast Encryption as implemented by BGW 1, but I guess that the question stands for any broadcast encryption system.

My confusion comes from the fact that the initial phase of Broadcast Encryption takes in the number of users and creates one global Public Key and a Private Key for each user. But suppose that the users in the system already had RSA private keys assigned. Is there a way to mitigate the fact that we need to maintain two private keys per each user (one from RSA and one from Broadcast Encryption) ?

1 Boneh, Dan, Craig Gentry, and Brent Waters. "Collusion resistant broadcast encryption with short ciphertexts and private keys." Annual International Cryptology Conference. Springer Berlin Heidelberg, 2005.

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Considering that ciphertext size in this scheme is $O(\sqrt{n})$ for $n$ listeners I'd say you can just as well encrypt for everyone separately and save yourself the hassle. $\endgroup$
    – Elias
    Commented Apr 27, 2017 at 13:39
  • $\begingroup$ I think that's a valid point for small n. I would guess that the benefit of a BE system is that it scales better than encrypting separately for large number of users (>1M). $\endgroup$
    – stefanix
    Commented May 2, 2017 at 9:03

1 Answer 1

Reset to default
2
$\begingroup$

The Broadcast encryption scheme you link to uses elliptic curve groups based on the bilinear map (bilinear pairing). RSA is not elliptic curve based.

Is there a way to mitigate the fact that we need to maintain two private keys per each user (one from RSA and one from Broadcast Encryption) ?

This is not trivially possible. You would have to devise a scheme that combines those two primitives.

The only scheme I know of that combines RSA with bilinear pairing is Comparison-based encryption for fine-grained access control in clouds by Zhu et al. (DOI: 10.1145/2133601.2133614)

You might want to check that to see if you can salvage some of that, but I doubt that you will be successful.

Why integrating them is not a good idea in your case:

If your users already have their RSA private keys, then those RSA private keys are not linked in mathematically aside from following the same key generation process. In order to get the ciphertext size improvement of broadcast encryption (BE), you'd need to find some hidden property between all of the RSA private keys just by looking at the RSA public keys of your users. For that, you will either have to break RSA (not an easy feat) or you need to ask the users for their RSA private keys. If you ask for RSA private keys, you might as well just replace them with the BE private keys and skip the integration.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Replacing the RSA keys with BE private keys sounds tempting. However, I need the functionality of users signing stuff with their private keys.... which was the justification of using the RSA keys. Could then Elliptic Curve keys be used for both Broadcast Encryption and signing by users ? $\endgroup$
    – stefanix
    Commented May 2, 2017 at 8:53
  • $\begingroup$ Search for "broadcast signcryption" in your favorite search engine and you will probably find what you're looking for. It was not clear from your question that you wanted the private key holders to sign stuff. If this doesn't pan out, you can still ask a new question with a clear description of you what you want and what you literature study showed. $\endgroup$
    – Artjom B.
    Commented May 3, 2017 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.