In Crypto＇05, Boneh et al. presented two broadcast encryption schemes. Their work has exciting achievements： the header （also called ciphertexts） and the private keys are of constant size. In their paper, they give an open question to construct a traitor tracing algorithm for their broadcast encryption schemes, and combine the two systems to obtain an efficient trace-and-revoke system. In this paper, we give a negative answer to their open question. More precisely, we show that three or more insider users are able to collude to forge a valid private key for pirate decoding against their schemes. Moreover, we prove that there exists no traitor tracing algorithm to identify the colluders. Our pirate decoding can also similarly be applied to Lee et al.＇s broadcast encryption schemes in ISPEC＇06.
To deal with the key-exposure problem in signature systems, a new framework named parallel key-insulated signature (PKIS) was introduced, and a concrete PKIS scheme was proposed. Compared with traditional key-insulated signature (KIS) schemes, the proposed PKIS scheme allows a frequent updating for temporary secret keys without increasing the risk of helper key-exposure. Moreover, the proposed PKIS scheme does not collapse even if some (not all) of the helper keys and some of the temporary secret keys are simultaneously exposed. As a result, the security of the PKIS scheme is greatly enhanced, and the damage caused by key-exposure is successfully minimized.
