Symmetric-Key Broadcast Encryption: The Multi-sender Case

The problem of (stateless, symmetric-key) broadcast encryption, in which a central authority sends encrypted content that can be decrypted only by a designated subset of potential receivers, has been the focus of a significant amount of attention. Here, we consider a generalization of this problem in which all members of the group may act as both sender and receiver. The parameters of interest are the number of keys stored per user and the bandwidth required per transmission, as a function of the total number of users n and the number of revoked users r. As our main results, we show a multi-sender scheme allowing revocation of an arbitrary number of users, in which users store O(n) keys and the bandwidth is O(r log n/r). We then prove a matching lower bound on the storage in this case, showing that Ω(n) keys are necessary (regardless of the bandwidth) for unique predecessor schemes, a class of schemes capturing all recent constructions in the single-sender case. We also show a scheme with storage polylog(n) and bandwidth O(r) that can be used to revoke up to polylog(n) users.