Optimal Communication Complexity of

Generic Multicast Key Distribution

Saurabh Panjwani

UC San Diego

(Joint Work with Daniele Micciancio)

Multicast Multicast is a primitive which enables a source of

information to communicate with multiple receivers in a network with efficiency better than sending data individually to all the receivers.

(Efficiency means better utilization of sender resources and bandwidth.)

= Sender

= Receiver

Three unicast flows

= Others

Multicast Multicast is a primitive which enables a source of

information to communicate with multiple receivers in a network with efficiency better than sending data individually to all the receivers.

(Efficiency means better utilization of sender resources and bandwidth.)

= Sender

= Receiver

One multicast flow

= Others

Multicast Example Applications:

Electronic Conferences, Virtual rooms PayTV or Video-on-demand services Stock quotes

Security in multicast involves new challenges: How does one keep group communication secret ? How do multiple receivers authenticate a single sender

efficiently ? How do we authorize anyone to send data on a multicast

channel ?

Secrecy in Multicast In unicast, secrecy can be achieved by sharing a key

between the parties and using symmetric-key encryption.k

Ek(data)

A ?

data

Secrecy in Multicast Can we do the same for multicast ?

If group membership changes, the key should also change.

A?

data

data

data

k

Ek(data)

Multicast Key Distribution A group center distributes a shared ‘group key’ to all

members (senders & receivers). Sends messages to change the key whenever membership changes :

= Group member= Non-member

CenterRekey messages

? ?? k kk Goal: At any instant of time, only the members should

“know” the group key.

k' k' k'

Multicast Key Distribution Setup: Each user ui has a unique key ki that it shares

with the center.

u1

Center

u2 u5u4u3 u6u2

? ?? k kk

E (k); E (k); E (k)k1 k3 k5

= Group member= Non-member

For group with n members, center sends n rekey messages (per membership update).

Generate k

But we can do better…

k1 k2 k3 k4 k5 k6

Previous Work – Upper Bounds Wong, Gouda, Lam [WGL98]; Wallner, Harder,

Agee [WHA99] gave a protocol in which every join/leave operation in a group of size n involves sending 2log2(n) rekey messages.

Canetti, Garay, Itkis, Micciancio, Naor, Pinkas [CGIMNP99] improved this to log2(n). (Used pseudorandom generators in creation of rekey messages).

Best known upper bound – log2(n)

Previous Work – Lower Bounds Canetti, Malkin, Nissim [CMN99] gave the first

non-trivial lower bound: for a restricted class of protocols, in a group of size n, center must send (log(n)) rekey messages (per membership update).

Snoeyink, Suri and Varghese [SSV01] proved a bound for more general protocols. For groups of size n, rekey cost must be at leastlog3(n).

Best known lower bound – 3log3(n)

Interestingly, 3log3(n) > log2(n) (lower bound is higher than upper bound)

Why is this so? In the model used in [SSV01], every rekey

message must be of the form Ek(k').

Centerk

Eg: Take G(k) = G0(k) G1(k)…Gm(k)

G0(k)

Gm(k)

k

..G0(k)

Gm(k)

k

..G0(k)

Gm(k)

k

..

Why can’t pseudorandom generators be used?

Best known protocol uses

PRGs.

Why is this so? In the model used in [SSV01], every rekey

message must be of the form Ek(k').

Eg: Two auxiliary keys, k, k'. Center wants to send a key k'' to members u1 and u2

Why can’t nested encryption be used?

u1

Center

u2 u4u3

kk k' k k' k'

?k'' ?k''

E (k'');k1E

(k'')k2

One Possibility

k1 k2 k4k3

Why is this so? In the model used in [SSV01], every rekey

message must be of the form Ek(k').

Eg: Two auxiliary keys, k, k'. Center wants to send a key k'' to members u1 and u2

Why can’t nested encryption be used?

u1

Center

u2 u4u3

Ek(Ek'(k''))

Nested encryption has been used in

some protocols.

kk k' k k' k'

?k'' ?k''Saves communication by a factor of 2

Better possibility

k1 k2 k4k3

A More General Model

u1

Center

u3 u6u5k1 k3k2

Rekey messages can be generated by arbitrary combination of pseudorandom generators and symmetric-key encryption.

u2

E E (k'', G1(k'))G0(k2 )G1(k1 )

u4k4 k5 k6

Question: How good can you do under this model? We answer:

log2(n) is optimal

Our Model

u1

Center

u3 u6u5

Every user shares unique key with center. At any instant, a finite set of users are members.

All parties have black-box access to a pseudorandom generator G and an encryption-decryption pair (E,D) .

u2 u4k1 k2 k3 k4 k5 k6

Our Model

u1

Center

u3 u6u5

Membership is controlled by an adversary who issues one of three commands at every instant:

u2 u4k1 k2 k3 k4 k5 k6

Leave – Delete a member from the group.

Leave

Join – Add a non-member to the group.

Join

Replace – Replace a member with a non-member (keeps the group size same).

Replace

A

Our Model

u1

Center

u3 u6u5

Center responds by sending rekey messages. A rekey message is derived from the grammar:

u2

E E (k'')G0(k2 )G1(k1 )

u4k1 k2 k3 k4 k5 k6

M K | EK(M)K random_key | G0(K) | G1(K) | .. | Gm(K)

Our Model – Security Definition

Center

u3 u5

What are the keys a user “knows” at any instant?

u2 u4k2 k3k4 k5

k; G0(k')k; k' G0(k') k; G1(k')

E E (kg )kG0(k' )

+

kg

E E (kg )kG0(k' )

+

?

E E (kg )kG0(k' )

+

?

E E (kg )kG0(k' )

+

kg

u1k1

E E (kg )kG0(k' ) E (kg );k1

E (kg )k1

+

kg

Our Model – Security Definition

u1

Center

u3 u5

What are the keys a user “knows” at any instant?

u2 u4k1 k2 k3k4 k5

E E (kg )kG0(k' ) E (kg );k1

Use an abstract encryption model for defining this notion (Similar to Dolev-Yao logic).

Connections between such an abstract framework and complexity-theoretic framework has been studied by Abadi-Rogaway [AR02], Micciancio-Warinschi [MW04], Abadi-Jurjens [AJ01], Gligor-Horvitz [GH03] etc.

Our Model – Security Definition Definition: A multicast key distribution protocol is secure

if for every sequence of adversarial commands, at every time instant t, there is a key kt such that -

Every member at time t knows kt

NO non-member at time t knows kt A very liberal definition !

Security against collusions of non-members?

But a weak definition only makes our lower bound stronger.

Our Result Theorem: The amortized communication complexity of

secure multicast key distribution is log2(n) - c. (c tends to 0 as number of adversarial commands increases).

Matches the cost of the best known protocol up to small ‘additive’ constant.

Amortized complexity means number of rekey messages sent per update command for a sequence of update commands.

Proof Idea View a multicast key distribution protocol as a game

played between center and adversary.

ACenter

Some of the root keys are labeled either member or non-member.

member

non-member

member

The playing board is an infinite forest on keys. A tree in this forest represents the set of pseudorandom keys derived from the root key.

Proof Idea View a multicast key distribution protocol as a game

played between center and adversary.

ACenter member

non-member

member

Adversary changes labels on the keys which are labeled member or non-member.

Center introduces rekey messages, modeled as hyper-edges over the keys.

k1

k

k'

Ek(Ek'(k1)

Proof Idea View a multicast key distribution protocol as a game

played between center and adversary.

ACenter member

non-member

member

A hyper-edge becomes useless once the key it points to becomes “reachable” from any non-member node.

Show that the adversary can select to delete and add members in a way such that a lot of hyper-edges become useless in every move.

Open Questions Does the bound hold even without replace

operations ? What about average-case communication

complexity ? What if other cryptographic primitives are used

for generating rekey messages (eg. PRFs, secret sharing) ?

Questions?

References [AR] M. Abadi, P. Rogaway. Reconciling Two Views of

Cryptography (or the Computational Soundness of Formal Encryption). Journal of Cryptology 15(2), 2002.

[CGIMNP] R. Canetti, J. Garay, G. Itkis, D. Micciancio, M. Naor, B. Pinkas. Multicast Security: A taxonomy and some efficient constructions. In Proc. of INFOCOM 1999.

[CMN] R. Canetti, T. Malkin, K. Nissim. Efficient communication-storage tradeoffs for multicast encryption. In Advances in Cryptology – EUROCRYPT 1999.

[MW] D. Micciancio, B. Warinschi. Completeness theorems for the Abadi-Rogaway Logic of Encrypted Expressions. Journal of Computer Security, 12(1), 2004.

[AJ] M.Abadi, J.Jurjens. Formal eavesdropping and its computational interpretation. In TACS 2001.

[SSV] J. Snoeyink, S. Suri, G. Varghese. A lower bound for Multicast Key Distribution. In Proc. of INFOCOM 2001.

[GH] V.Gligor, D.O.Horvitz. Weak Key Authenticity and the Computational Completeness of Formal Encryption. In CRYPTO 2003.

[WHA] D. Wallner, E. Harder, R. Agee. Key management for Multicast: Issues and Architecture. RFC 2627, June 1999.

[WGL] C. Wong, M. Gouda, S. Lam. Secure Group Communication using Key graphs. In Proc. of SIGCOMM 1998.

References