broadkey

A research library for broadcast key encapsulation: a server holds keys for n participants, picks any subset of them, and broadcasts one header from which exactly that subset recovers the same key. It implements the basic construction (section 3.2) of the Boneh-Gentry-Waters scheme, built on Oliver Günther's PBC_BKEM and the PBC pairing library.

It ships as a CPython extension, plus a server and client program speaking a plain-text wire protocol on stdin/stdout. On Linux x86_64 and aarch64, pip install broadkey pulls a wheel with PBC and GMP bundled; elsewhere it builds from source and needs both libraries.

import broadkey

server = broadkey.State()
pk, *keys = server.server_init(3).rstrip("\n").split("\n")

clients = []
for line in keys:
    c = broadkey.State()
    c.client_init("3\n%s\nindex %s" % (pk, line))
    clients.append(c)

header, k = server.server_key([0, 2]).split("\n")
assert clients[0].client_key(header) == k
assert clients[1].client_key(header) != k   # excluded

K is a hex-encoded group element, not a symmetric key. Run it through a KDF and encrypt with an AEAD; tests/test_messages.py does it with HKDF-SHA256 and AES-GCM.

Do not protect real data with it. The README lists the shortcomings itself:

• Hardcoded type-A parameters give roughly 80-bit security.
• Only the basic construction, secure against a static adversary. No CCA variant; nothing authenticates the header, recipient list or sender.
• An excluded participant gets no error, just a fixed public value. Exclusion only shows up when the AEAD layer fails.
• All private keys are generated in one process; distribution is the caller's problem.
• No constant-time or memory hygiene guarantees.
• PBC is no longer developed, and moving off it is a redesign because BGW here needs a symmetric pairing.

What it does have: input validation that rejects any group element outside the order-r subgroup, randomness only from /dev/urandom, and a test suite run under AddressSanitizer and UBSan in CI.