Lower Bound. Our lower bound involves a separation based scheme. In each coherence block we reserve the first symbol for channel training and use the remainder of the block for source emulation [9], [10] .
Lower Bound. Broadcast encryption is a mechanism that allows a sender to send a group key to a selected set of users. This can be regarded as a group key agreement of one message that is sent by the sender. In a symmetric key based broadcast encryption, the sender is a fixed authority. In this case, the user key size is combinatorially lower bounded. In addition, it is secure only against a limited number of users. In a public key broadcast encryption, the key size problem can be waived. But one still has to set the threshold for the number of bad users. Also the cipher text size depends on the number of users and hence could be large (e.g., it is O ( p n) in for n users). Further, users are initialized by a central authority which is not desired in our setting.
Lower Bound. For all m and α ∈ (0, 1], ν(m, α) ≥ 1+α
Lower Bound. (Achievability Scheme): Because of (3) we can find subspaces Π1, . . . , Πs, such that Πi ∩ Πj = 0 and q Π1 ⊕ ker F 1 = FL, q Π2 ⊕ Π1 ⊕ ker F 2 = FL, . key-reconciliation used ideas from network coding [10].
Lower Bound. (Achievability Scheme) Before giving the achievability scheme, let us define a nested message set, degraded channel wiretap scenario as follows Assume a wiretap channel scenario where there
Lower Bound. Needs at least (m+1) rounds of message exchanges ▪ “Oral” messages – messages can be forged / changed in any manner, but the receiver always knows the sender INDIAN INSTITUTE OF TECHNOLOGY KHARAGPUR Proof Theorem: There is no t-Byzantine-robust broadcast protocol for t ≥ X/0 0 0 0 0 0 0 Xxxxxxxx-0: X must decide 0 U T S 1 1 1 0 1 1 Scenario-1: U must decide 1 U T S 0 1 0 0 1 1 U T S Scenario-2: -- similar to Scenario-0 for T -- similar to Scenario-1 for U -- T decides 0 and U decides 1 16 INDIAN INSTITUTE OF TECHNOLOGY KHARAGPUR ▪ Algorithm Broadcast( N, t ) where t is the resilience For t = 0, Xxxxxxxxx( X, 0 ): Pulse 1 The general sends 〈value, xg〉 to all processes, the lieutenants do not send. Receive messages of pulse 1. The general decides on xg. Lieutenants decide as follows: if a message 〈value, x〉 was received from g in pulse-1 then decide on x else decide on udef INDIAN INSTITUTE OF TECHNOLOGY KHARAGPUR Pulse 1 The general sends 〈value, xg〉 to all processes, the lieutenants do not send. Receive messages of pulse 1. Lieutenant p acts as follows: if a message 〈value, x〉 was received from g in pulse-1 then xp = x else xp = udef ; Announce xp to the other lieutenants by acting as a general in Broadcastp( N – 1, t – 1 ) in the next pulse For t > 0, Broadcast( N, t ):
Lower Bound. The number k of updates a user is required to make before their state is guaranteed to heal plays a crucial role. We consider a security game parameterized by the number of users n and k. The adversary schedules who updates in each round, and we require that at any point the group key is secure assuming that every party that was corrupted in the past was asked to update at least k times (since their last corruption). Table 1 states our lower bound and upper bound, as well as existing ones. Our lower bound is roughly n1+1/k k/ log(k). The main message here is that we need to allow for logarithmically many rounds for healing (as in CoCoA) if we want a small logarithmic sender communication cost per user. In particular, if we insist on a constant number of rounds, the average cost per user will be of order n1/k. 1It is possible, as in [AAN+22a, AHKM22], to reduce recipient communication by introducing additional reliance on the server. We focus on sender communication. Upper bounds Scheme Communication Rounds Rand. corr. See TreeKEM and related n2 2 RC [BBR18] √ Xxxxxxxxx, Dodis, R¨osler CoCoA on k−1 n-ary trees n2 2 RC [BDR20] √ ¬ n k2 k−1 n k RC Sec. 5.2 CoCoA on 2-ary trees n log(n)2 log(n) RC [AAN+22a] CoCoALight on (k−1)/√2 n-ary trees n k (k−1)/√2 n k RC Sec. 5.3 Lower bounds Restrictions Communication Rounds Rand. corr. See ¬ ¬ None n2 2 RC [BDR20] NDW, NNE, PCU∗ n log(n)/ log(log(n)) log(n) RC Cor. 6 NDW, NNE, PCU∗ ε · n · (1+ε)k−√1 αεn · k/ log(k) k ¬RC Cor. 6 Table 1: Upper-bounds (top) and lower-bounds (bottom) in the no-information setting for Ω(n) corrupted users. Communication is measured as total number of ciphertexts sent to recover from corruption, col- umn “Rounds” indicates the number of update rounds after which schemes are required to recover from corruption, column “Rand. corr.”, whether the security model allows the adversary to learn internal ran- domness of algorithms. The protocol [BDR20] improves over TreeKEM in that concurrent operations do not degrade future performance, which is not captured in the table. Our lower-bounds require CGKA to not allow distributed work (NDW) and not use nested encryption (NNE). Our bound holds without the extra assumption requiring the protocols to have publicly-computable update cost (PCU). However, additional properties of it hold when this assumption is present. We refer the reader to the discussion in Section 1.3 below for more details. Here, αε ≈ ε is some constant depending on ε. ∈ ⌈ ⌉ · ∈ ⌈ ⌉ ⌈...
