Optimal MKA Security with FS and Eventual PCS for the Group Manager. To obtain security with respect to group manager corruptions, in addition to the security captured by user-mult, we create a new security game mgr-mult, in which we add to the user-mult game an additional oracle mgr-corrupt, which simply returns the secret state of the group manager to the adversary. Observe that there are now more trivial attacks which the adversary can use to win mgr-mult (e.g., corrupting the group manager and then challenging before every user has been updated or removed from the group). We therefore check a new mgr-safe predicate at the end of the game on the queries q1, . . . , qq in order to determine if the execution had any trivial attacks. In addition to that which ∈ user-safe checks for, mgr-safe also checks for every challenge epoch t∗ if the group manager was corrupted in some epoch t < t∗, and there was any ID G[t] that did not have its secrets updated by the group manager (in an operation for which the oob to ID is not corrupted), and was not removed by the group manager, after the corruption, but before t∗. Figure 5 denotes both of these changes. The predicate mgr-safe uses q2e() to additionally return the epoch corresponding to a query to q = mgr-corrupt(). In this case, q2e(q) corresponds to the epoch t that the group manager is in when the query is made (i.e., the epoch defined by the most recent group manager operation create-group, add-user, remove-user, update-user). mgr-mult
Optimal MKA Security with FS and Eventual PCS for the Group Manager. Now we introduce another security notion for MKA which, in addition to ensuring optimal security for the users, also ensures forward secrecy and eventual PCS for the group manager. If the secret state of the group manager is leaked at some point, all previous group secrets remain hidden from the attacker. Furthermore, once every user has their secrets updated by the group manager or has been removed from the group after her corruption, all future group secrets remain hidden from the attacker. To obtain these properties in addition to those captured by user-mult, we create a new security game mgr-mult, in which we add to the user-mult game an additional oracle mgr-corrupt, which simply returns the secret state of the group manager to the adversary. Observe that there are now more trivial attacks which the adversary can use to win mgr-mult (e.g., corrupting the group manager and then challenging before every user has been updated or removed from the group). We therefore check a new mgr-safe predicate at the end of the game on the queries q1, . . . , qq in order to determine if the execution had any trivial attacks. In addition to that which user-safe checks for, mgr-safe also checks for every challenge epoch t∗ if the group manager was corrupted in some epoch t t∗, and there was any ID G[t] that did not have its secrets updated by the group manager, and was not removed by the group manager, after the corruption, but before t∗. Figure 7 denotes both of these changes. The predicate mgr-safe uses q2e() to additionally return the epoch corresponding to a query to q = mgr-corrupt(). In this case, q2e(q) corresponds to the epoch defined by the most recent group manager operation (create-group, add-user, remove-user, update-user). mgr-corrupt(): return Γsec mgr-safe(q1, . . . , qq ): if ∃(i, j) s.t. qi = mgr-corrupt(), qj = chall(t∗) for some t∗, q2e(qi) ≤ t∗ and ∃IDi ∈ G[q2e(qi)] s.t. $qmi ∈ {update- return 0 return user-safe(q1, . . . , qq ) user(IDi), remove-user(IDi)} s.t. q2e(qi) < q2e(qmi ) ≤ t∗
