Method and apparatus for tracing the source of decryption keys used by a decoder

1. A method for determining at least one traced private key used by a decoder to decrypt an encrypted message, the method comprising:

defining an input ciphertext, the input ciphertext being associated with a tracing private key and having a sublinear size;

calling the decoder on the input ciphertext; and

associating the tracing private key with a set of traced private keys if the decoder is able to correctly decrypt the encrypted message in accordance with the input ciphertext, the set of traced private keys comprising at least one private key,

wherein the sublinear size of the input ciphertext is a square root of a first number, the first number representing a number of users to whom the encrypted message is broadcast,

wherein the tracing private key is structured such that, in order to decrypt the encrypted message, a first ciphertext component at a first position in an index of ciphertext components must be paired with a second ciphertext component at a second position in the index of ciphertext components, and

wherein the first position in the index of ciphertext components and the second position in the index of ciphertext components are defined by a tuple associated with a user of the tracing private key.

2. The method of claim 1 , further comprising:

revoking at least one private key in accordance with the set of traced private keys.

3. The method of claim 2 , wherein the revoking comprises:

encrypting future messages such that the future messages are decrypted by a new set of users, the new set of users excluding at least a user associated with the revoked at least one private key.

4. The method of claim 1 , wherein the decoder is treated as a black box oracle.

5. The method of claim 1 , wherein the encrypted message is sampled from a finite message space at random.

6. The method of claim 1 , further comprising:

iterating the defining, the calling, and the associating a predefined number of times.

7. The method of claim 1 , wherein the tracing private key is a secret tracing key.

8. The method of claim 1 , wherein the associating is performed in accordance with a public tracing algorithm.

9. The method of claim 1 , wherein the number of users is padded with at least one dummy user so that the first number is a square number.

10. A computer readable storage medium containing an executable program for determining at least one traced private key used by a decoder to decrypt an encrypted message, where the program performs a method comprising:

defining an input ciphertext, the input ciphertext being associated with a tracing private key and having a sublinear size;

calling the decoder on the input ciphertext; and

associating the tracing private key with a set of traced private keys if the decoder is able to correctly decrypt the encrypted message in accordance with the input ciphertext, the set of traced private keys comprising at least one private key,

wherein the sublinear size of the input ciphertext is a square root of a first number, the first number representing a number of users to whom the encrypted message is broadcast,

wherein the tracing private key is structured such that, in order to decrypt the encrypted message, a first ciphertext component at a first position in an index of ciphertext components must be paired with a second ciphertext component at a second position in the index of ciphertext components, and

wherein the first position in the index of ciphertext components and the second position in the index of ciphertext components are defined by a tuple associated with a user of the tracing private key.

11. The computer readable storage medium of claim 10 , further comprising:

revoking at least one private key in accordance with the set of traced private keys.

12. The computer readable storage medium of claim 11 , wherein the revoking comprises:

broadcasting future messages to a new set of users, the new set of users excluding at least a user associated with the revoked at least one private key.

13. The computer readable storage medium of claim 10 , wherein the decoder is treated as a black box oracle.

14. The computer readable storage medium of claim 10 , wherein the encrypted message is sampled from a finite message space at random.

15. The computer readable storage medium of claim 10 , further comprising:

iterating the defining, the calling, and the associating a predefined number of times.

16. The computer readable storage medium of claim 10 , wherein the tracing private key is a secret tracing key.

17. The computer readable storage medium of claim 10 , wherein the associating is performed in accordance with a public tracing algorithm.

18. The computer readable storage medium of claim 10 , wherein the number of users is padded with at least one dummy user so that the first number is a square number.

19. Apparatus for determining at least one traced private key used by a decoder to decrypt an encrypted message, the apparatus comprising:

a processor,

a memory in communication with the processor,

means for defining an input ciphertext, the input ciphertext being associated with a tracing private key and having a sublinear size;

means for calling the decoder on the input ciphertext; and

means for associating the tracing private key with a set of traced private keys if the decoder is able to correctly decrypt the encrypted message in accordance with the input ciphertext, the set of traced private keys comprising at least one private key,

wherein the sublinear size of the input ciphertext is a square root of a first number, the first number representing a number of users to whom the encrypted message is broadcast,

wherein the tracing private key is structured such that, in order to decrypt the encrypted message, a first ciphertext component at a first position in an index of ciphertext components must be paired with a second ciphertext component at a second position in the index of ciphertext components, and

wherein the first position in the index of ciphertext components and the second position in the index of ciphertext components are defined by a tuple associated with a user of the tracing private key.