Encrypting a broadcast message decryptable by a subset of receivers

Question

I wasn't certain how to title this request/problem, but here goes:

I'm A, and I want to send a message that is received by B, C, D.

Each receiving entity here is part of some set of domains D1, D2, D3:

B: {D1, D2}
C: {D2}
D: {D3}

How do I encrypt a message with a single key that I, A send to B, C, D such that it can only be decrypted by receivers in a given domain subset (e.g Msg(D1,D3) = B and D can decrypt the message)?

Assume it is possible to convey to A, B, C and D some security material ahead of time before having to send the message.

Answer 1

Perhaps Attribute-based Encryption is what you are looking for.

From the two schemes (KP-ABE, CP-ABE), CP-ABE can solve your problem. You can set the attributes of each identity according to their domain set and encrypt the file with policy using OR. The example you have given, Msg(D1,D3) can use (D1 OR D3) as a policy to encrypt.

For more detailed information on the mathematics behind the scheme, you can read this paper. Also, there is an opensource implementation available too Zeutro's OpenABE if you are interested.