Paper 2025/1600

Adaptively-Secure Unbounded Optimal DBE from Lattice Assumptions

Abstract

Distributed Broadcast Encryption (DBE) is a registration-based cryptographic paradigm in which users generate their own public/secret keys and register their public keys on a public bulletin board. Any sender can encrypt messages for any subset of registered users, and only intended recipients can decrypt, thereby enabling scalable, trustless, and provably secure communication. While Wee et al. (CRYPTO 2025) constructed the first unbounded optimal DBE from the succinct LWE assumption, their construction achieves only selective security. Until now, it was unknown how to achieve adaptive security for unbounded optimal DBE under standard lattice assumptions without relying on heavy primitives such as indistinguishability obfuscation or witness encryption. In this work, we present the first adaptively secure unbounded optimal DBE schemes from falsifiable lattice assumptions. Specifically, for the security parameter $\lambda$ and number of users $N$, we achieve the following: - A semi-statically secure DBE in the plain model for an arbitrary polynomial number of users, where the sizes of public parameters, user public/secret keys and ciphertext are all optimal (i.e., have size $\textsf{poly}(\lambda,\log N)$), based on the falsifiable $\textsf{poly}(\lambda,\log N$)-succinct LWE assumption. - An adaptively-secure DBE in the random oracle model supporting an arbitrary polynomial number of users, with optimal public parameters, user public/secret keys and ciphertext sizes, again under $\textsf{poly}(\lambda,\log N)$-succinct LWE assumption. - An adaptively-secure DBE in the plain model supporting a priori-maximum polynomially many users under the $\textsf{poly}(\lambda,\log N)$-succinct LWE assumption. Our construction achieves optimal sizes for both the user public/secret keys and the ciphertext, whereas the public parameters grow linearly with the number of users (i.e., have size $N \cdot \textsf{poly}(\lambda,\log N)$).