traitor tracing scheme

Нашёл чтиво на эту тему: https://crypto.stackexchange.com/questions/39397/one-encryption-many-decrypti...

«This is known in the cryptographic literature as „traitor tracing“. See, e.g., the following seminal paper:

An efficient public key traitor tracing scheme. Dan Boneh and Matt Franklin. CRYPTO 1999, https://crypto.stanford.edu/~dabo/abstracts/traitors.html

They show a public-key encryption scheme where each possible recipient has their own private decryption key. If an authorized recipient discloses their decryption key, it's possible for the authority to figure out whose key it was. Moreover, they consider a further challenge — what if a coalition of authorized recipients pool everything they know, and come up with another decryption key that is different from each of theirs but still works, and they leak that new key? — and they show how to deal with that challenge as well.»