I started to read about the broadcast encryption problem, specifically, the first, seminal work of FN93 followed by the subset cover technique presented at NNL01, and something really trivial and inherent bothers me.

Consider the complete subtree method presented at NNL01 (section 3.1), which is claimed to have information-theoretic security, and say that there is broadcast w.r.t. two keys of sets S1, S2. Every user in S2 has seen the ciphertext that corresponds to S1's encryption (and also knows the plaintext because it is in S2).

Therefore, since it is unbounded, it can find S1's key by brute-force, and break the security in all subsequent broadcasts that use S1's key again.

What am I missing? Are the receivers assumed to be computationally bounded? Or does this attack fail due to some other reasons?




Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.