6
$\begingroup$

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. It does not describe which user corresponds to which ciphertext part. User $i$ should decrypt using the corresponding $r_i$ value. How do the users know about that?

In some cases, they use some function $f(x)=k-\prod_{i=1}^{t} (x-v_{i})$ to get $k$ by replacing $v_{i}^{'}$ in place of $x$.

In real implementation, how to define such kind of function for unknown $x$ for $n$ receivers.

Example paper: Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security (PDF) by Fan et al.

$\endgroup$
  • $\begingroup$ Artjom.Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security.Authors....Chun-I Fan * and Yi-Fan Tseng I think you can give me correct answer. $\endgroup$ – myat Jun 9 '16 at 4:19
  • $\begingroup$ So, contrary to your title, you're not asking about finding the correct component but rather how to convert $k-\prod^t_{i=1}(x-v_i)$ to $\sum^{t-1}_{i=0}c_i x^i + x^t \bmod{q}$ over $\mathbb{Z}_q$ $\endgroup$ – Artjom B. Jun 9 '16 at 10:17
1
$\begingroup$

User $i$ should decrypt using the corresponding $r_i$ value. How do the users know about that?

From my understanding, a sender $S$ computes a polynomial $f(x)=\sum_{i\in\{0,...,t\}}c_ix^i$ which evaluates to $k$ if the the value of $x$ corresponds to the "share" of any of the designated user $ID_1,...,ID_t$ --- a share of a user $i$ as computed by $S$ is $v_i:=H_1(e(rQ_i,d_S))$, where $r=H_2(M,k)$. A receiver $i$, once it sees the polynomial, evaluates it on his share $v_i'=H_1(e(V,d_i))$ and if $v_i=v_i'$ it gets the gets back the key $k=f(v_i')$ (i.e., correctness). So, there is no correspondence between the users and the values of $c_i$s.

In real implementation, how to define such kind of function for unknown $x$ for $n$ receivers.

As done in the paper, one just sends the coefficients of the function $f(x)$.

P.S. I hope I am not missing something.

|improve this answer|||||
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.