2

I was reading the paper, entitled "Multiparty Key Exchange, Efficient Traitor Tracing, and More from Indistinguishability Obfuscation", by Boneh et al. On page 23, the authors have claimed the following.

"Remark 6.2. We note that for private linear broadcast, there are only a polynomial number of recipient sets, meaning selective and adaptive security are equivalent."

How can we prove this Remark? Is it possible to transform a selective secure private linear broadcast encryption scheme to an adaptive secure scheme (for the system which can accommodate at most a polynomial number of users)?

SEJPM
  • 46,697
  • 9
  • 103
  • 214
Mriganka Mandal
  • 23
  • 4

1 Answers1

2

There is a generic reduction from breaking selective security of a protocol $\mathsf{P}$ to breaking its adaptive security: the adaptive reduction for $\mathsf{P}$ simply guesses (at random) the information $w$ (in your case, the recipient set) that the adversary commits to in the selective experiment. Therefore, if $w$ comes from a universe $\mathcal{W}$ (which in your case is the set of recipient sets) and if $\mathsf{P}$ is at least $\epsilon$-secure then $\mathsf{P}$ is also at least $\epsilon\cdot|\mathcal{W}|$-secure. Since the universe $\mathcal{W}$ in the case of private linear broadcast is only of polynomial size, the adaptive security of $\mathsf{P}$ follows.$^*$

I think this idea is folklore, but the earliest formal statement I found goes back to [BB] (Theorem 7.1); you can read more about it in [J+]

[BB] Boneh and Boyen, Efficient Selective-ID Secure Identity-Based Encryption Without Random Oracles, Eurocrypt 2004

[J+] Jafargholi et al., Be Adaptive, Avoid Overcommitting, Crypto 2017

$^*$ In most cases the universe is of exponential size and this lead to an exponential loss in security. But there are examples where this is the best we know!

ckamath
  • 5,488
  • 2
  • 25
  • 42