Device and method for traceable group encryption
AssigneeThomson Licensing
InventorsMarc JOYE, Benoit LIBERT
Life of this patent
Estimating the term…
Abstract
A group encryption system comprising at least one group member device, a group manager device, an opening authority device, a sender device and a tracing agent device. The sender device is configured to encrypt a plaintext using the public key of a group member. The group member device is configured to receive and decrypt the ciphertext using the corresponding private key, and also to claim or disclaim a ciphertext. The opening authority device is configured to disclose at least one user-specific trapdoor that makes it possible to trace, by the tracing agent device, all the ciphertexts for the specified user and only those ciphertexts.
Claims14
A device for encrypting a plaintext destined for a user having a public key, the device comprising:
- a processor configured to:
- obtain a tuple of traceability components for first elements of the public key;
- encrypt, using encryption exponents and second elements of the public key, the plaintext to obtain a first intermediary ciphertext;
- generate commitments to the encryption exponents;
- generate second intermediary ciphertexts by encrypting the first elements of the user's public key under a public key of an opening authority using a verification key;
- and
- generate, using a signature key, a signature over the tuple of traceability components, the first intermediary ciphertext, and the second intermediary ciphertexts;
- and
- an interface configured to output a ciphertext comprising the tuple of traceability components, the first intermediary ciphertext, the second intermediary ciphertexts, and the signature.
A method for encrypting a plaintext destined for a user having a public key, the method comprising, in a device:
- obtaining, by a processor, a tuple of traceability components for first elements of the public key;
- encrypting, by the processor using encryption exponents and second elements of the public key, the plaintext to obtain a first intermediary ciphertext;
- generate, by the processor, commitments to the encryption exponents;
- generate, by the processor, second intermediary ciphertexts by encrypting the first elements of the user's public key under a public key of an opening authority using a verification key;
- and
- generate, by the processor using a signature key, a signature over the tuple of traceability components, the first intermediary ciphertext, and the second intermediary ciphertexts;
- and
- outputting, by an interface, a ciphertext comprising the tuple of traceability components, the first intermediary ciphertext, the second intermediary ciphertexts, and the signature.
Dependencies are inferred from the claim text.