What ~1.25 turned out to be or Complex poles and DVDs Ilya Mironov Microsoft Research, SVC October 3 rd, 2003

One-to-One Communications AliceBob

One-to-Many Communications Alice BobCarlZing

One-to-Many Communications Alice BobCarlZing

One-to-Many Communications Alice BobCarlZing

One-to-Many Communications Alice BobCarlZing

Broadcast Alice BobCarlZing

Broadcast Alice BobCarlZing

Real Life Examples of Broadcast Pay-per-view Pay-per-view Satellite radio, TV (“dishes”) Satellite radio, TV (“dishes”) DVD players DVD players Stateless receivers

Broadcast encryption source receivers k kk k kk kk k k k  One rogue user compromises the whole system  Very little overhead

Broadcast encryption source receivers k 1, k 2, k 3, k 4, k 5,…, k n k1k1 k2k2 k3k3 k4k4 k5k5 k6k6 k7k7 knkn … broadcast E[k 1,k], E[k 2,k],…, E[k n,k], E[k,M]

Broadcast encryption source receivers k 1, k 2, k 3, k 4, k 5,…, k n k1k1 k2k2 k3k3 k4k4 k5k5 k6k6 k7k7 knkn …  Too many keys  Simple user revocation

Botched attempts CSS (most famous for the DeCSS crack) CSS (most famous for the DeCSS crack) CPRM (IBM, Intel, Matsushita, Toshiba) Can revoke only 10,000 devices in 3Mb CPRM (IBM, Intel, Matsushita, Toshiba) Can revoke only 10,000 devices in 3Mb

Subset-cover framework (Naor-Naor-Lotspiech’01) S3S3 S5S5 S6S6 S1S1 S2S2 S4S4 S7S7 S8S8

S3S3 S5S5 S6S6 S1S1 S2S2 S4S4 S7S7 S8S8 k3k3 k4k4 k5k5 u receiver u knows keys:

Key distribution Based on some formal characteristic: e.g., DVD player’s serial number Based on some formal characteristic: e.g., DVD player’s serial number Using some real-life descriptors: Using some real-life descriptors: — CMU students/faculty — researchers — Pennsylvania state residents — college-educated

Broadcast using subset cover S3S3 S5S5 S6S6 S1S1 S8S8 S 10 header uses k 1, k 3, k 5, k 6, k 8, k 10

Subtree difference All receivers are associated with the leaves of a full binary tree k0k0 k 00 k 01 k 0…0 k 0…1 k 1…1

Subtree differences i j special set S i,j

Subtree difference

Greedy algorithm Easy greedy algorithm for constructing a subtree cover for any set of revoked users Easy greedy algorithm for constructing a subtree cover for any set of revoked users

Greedy algorithm Find a node such that both of its children have exactly one revoked descendant Find a node such that both of its children have exactly one revoked descendant

Greedy algorithm Add (at most) two sets to the cover Add (at most) two sets to the cover

Greedy algorithm Revoke the entire subtree Revoke the entire subtree

Greedy algorithm Could be less than two sets Could be less than two sets

Average-case analysis R - number of revoked users R - number of revoked users C – number of sets in the cover C ≤ 2R-1 averaged over sets of fixed size [NNL’01] averaged over sets of fixed size [NNL’01] E[C] ≤ 1.38R simulation experiments give [NNL’01] simulation experiments give [NNL’01] E[C] ~ R 1.25

Hypothesis 1.25… = 5/4

Different Model Revoke each user independently at random with probability p Revoke each user independently at random with probability p

Exact formula where If a user is revoked with probability p«1:

Exact formula where If a user is revoked with probability p«1:

Asymptotic p E[C]/E[R]

Asymptotic … … p

Exact formula where If a user is revoked with probability p«1:

Singularities of f Function f cannot be analytically continued beyond the unit disk

One approach 5 pages of dense computations – series, o, O, lim, etc. produce only the constant term

Mellin transform

Approximation where For small q

The Mellin Transform Poles at 0, -1, -2, -3, … and

Complex poles …

Mellin transform

Approximation where p = 1-q

Asymptotic E[C]/E[R] … … 3log 2 4/3 p

Average-case analysis R - number of revoked users C – number of sets in the cover If a user is revoked with probability p«1: E[C] ≈ E[R]

Knuth and de Bruijn Solution communicated by de Bruijn to Knuth for analysis of the radix- exchange sort algorithm (vol. 3, 1 st ed, p. 131) Solution communicated by de Bruijn to Knuth for analysis of the radix- exchange sort algorithm (vol. 3, 1 st ed, p. 131) De Bruijn, Knuth, Rice, “The average height of planted plane trees,” 1972 De Bruijn, Knuth, Rice, “The average height of planted plane trees,” 1972

Further reading Flajolet, Gourdon, Dumas, “Mellin transform and asymptotics: Harmonics sums”, Theor. Comp. Sc., 123(2), 1994 Flajolet, Gourdon, Dumas, “Mellin transform and asymptotics: Harmonics sums”, Theor. Comp. Sc., 123(2), 1994

Back-up slides

Halevy-Shamir scheme Noticed that subtree differences are decomposable: Noticed that subtree differences are decomposable:

Halevy-Shamir scheme Fewer special sets reduce memory requirement on receivers Fewer special sets reduce memory requirement on receivers

Improvement For practical parameters save additionally 20% compared to the Halevy-Shamir scheme For practical parameters save additionally 20% compared to the Halevy-Shamir scheme