Lower bounds for Subset Cover based Broadcast Encryption

In this paper, we prove lower bounds for a large class of Subset Cover schemes (including all existing schemes based on pseudo-random sequence generators). In particular, we show that For small r, bandwidth is Omega(r) For some r, bandwidth is Omega(n/log(s)) For large r, bandwidth is n - r where n is the number of users, r is the number of revoked users, and s is the space required per user. These bounds are all tight in the sense that they match known constructions up to small constants.