Abstract. We propose a new public key trace and revoke scheme secure against adaptive chosen ciphertext attack. Our scheme is more efficient than the DF scheme suggested by Y. Dodis and N. Fazio [9] . Our scheme reduces the length of enabling block of the DF scheme by (about) half. Additionally, the computational overhead of the user is lower than that of the DF scheme; instead, the computational overhead of the server is increased. The total computational overhead of the user and the server is the same as that of the DF scheme, and therefore, our scheme is more practical, since the computing power of the user is weaker than that of the server in many applications. In addition, our scheme is secure against adaptive chosen ciphertext attack under only the decision Diffie-Hellman (DDH) assumption and the collision-resistant hash function H assumption, whereas the DF scheme also needs the one-time MAC (message authentication code) assumption.
REF improved that scheme by reducing the length of the enabling block by approximately one-half and reducing the computational overhead of the user at the expense of increasing the computational overhead of the server (this is an improvement since the computing power of the user is usually weaker than that of the server).
An efficient public key trace and revoke scheme secure against adaptive chosen ciphertext attack
In Advances in Cryptology — Asiacrypt 2003, volume 2894 of LNCS
Computer Science