1. A Signature-like Primitive for Broadcast-encryption- based Systems Jeffrey Lotspiech IBM Almaden Research Center

2. Overview Motivation Broadcast encryption basics The scheme Attacks/defensesConclusion

3. Motivation – “Broadcast Encryption” A term describing a class of key management schemes “One-way” cryptographic flow “One-way” cryptographic flow Essential for protection of physical media (e.g., DVDs) Over one billion CPRM devices licensed so far (e.g., SD cards, DVD RAM/R/RW) Over one billion CPRM devices licensed so far (e.g., SD cards, DVD RAM/R/RW) Used for AACS (new generation of DVDs) Used for AACS (new generation of DVDs) Not based on identity Great for high-privacy applications Great for high-privacy applications Not so great for forensics Not so great for forensics Very friendly to consumer electronic devices

4. Motivation – “Electronic Sell-through” Download of a movie onto a recordable DVD Richer format compared to broadcast recording, therefore only for server/client download, not recorders Richer format compared to broadcast recording, therefore only for server/client download, not recorders Possible attack: “Garage replicator” Possible attack: “Garage replicator” There would be additional security if there were a “server blessing” E.g., a server-signed token for the individual disc E.g., a server-signed token for the individual disc Easily accomplished by a public key infrastructure Easily accomplished by a public key infrastructure But, high overhead calculation

5. Devices How Does Broadcast Encryption Work? Devices organized into overlapping subsets; each subset associated with a key Each device in many different subsets Each device knows the key for every subset it is a member of x x x Licensing agency picks subsets that cover all innocent devices and exclude all compromised devices Encrypts the media key in each selected subset key Devices

6. Media Key Block Identify subsets Encrypt Media Key for each Media key block

7. EST Binding Table Produced by Server EST Binding Table Produced by Server … (Associated w/disc) k1k1 k2k2 k3k3 knkn... Binding Table E E E E … + KmKm Media ID “Type 6” MKB (associated w/Movie)

8. Hierarchy of Binding Tables Possible k1k1 k2k2 k3k3 knkn... …… hash1 +,e hash2 K’s KmKm

9. Attacks A set of device keys helps very little Binding table is valid for only one entry (e.g., 1/1000 th of the market, under control of content owners) Binding table is valid for only one entry (e.g., 1/1000 th of the market, under control of content owners) Licensing agency can respond effectively by subdividing new MKBs E.g., doubling size of binding table reduces attack to 1/1,000,000 th of the market E.g., doubling size of binding table reduces attack to 1/1,000,000 th of the market Makes “Garage Replicator” attack uneconomic Other uses of stolen devices keys are more effective Other uses of stolen devices keys are more effective

10. Conclusions Only authorized servers can make widely playable EST downloads By using broadcast encryption instead of public key signatures: Transactions per second at the server greatly increased (for a given server cost) Transactions per second at the server greatly increased (for a given server cost) No difference in “disc insertion time” at player for pre-recorded versus EST download. No difference in “disc insertion time” at player for pre-recorded versus EST download.