The paper addresses the problem of a center sending a message to a group of users, where a subset of these users is considered revoked and should not receive the content. The focus is on the *stateless receiver* scenario, where users do not update their state from session to session. The authors introduce the *Subset-Cover* framework, which abstracts various revocation schemes, including some previously known ones. They provide sufficient conditions for the security of revocation algorithms in this framework. Two explicit Subset-Cover revocation algorithms are described, which are flexible and can handle any number of revoked users. The first algorithm requires storage of $\log N$ keys and message lengths of $r \log N$ keys for revoking $r$ users. The second algorithm requires storage of $\frac{1}{2} \log^2 N$ keys and message lengths of $2r$ keys for revoking $r$ users. Both algorithms achieve significant improvements over previous methods in terms of message length and storage requirements. Additionally, the paper presents a general traitor tracing mechanism that can be integrated with any Subset-Cover revocation scheme that satisfies a "bifurcation property." This mechanism does not require an a priori bound on the number of traitors and does not significantly increase the message length compared to revoking the same set of traitors. The main contributions of the paper include: 1. Reducing the message length to $O(r)$ regardless of the coalition size while maintaining a single decryption at the user's end. 2. Seamless integration between revocation and tracing, without requiring any changes to the revocation algorithm. 3. Rigorous treatment of the security of such schemes, identifying the effect of parameter choice on overall security. The paper also discusses implementation issues, hierarchical revocation, public-key methods, and applications to copy protection and secure multicast.The paper addresses the problem of a center sending a message to a group of users, where a subset of these users is considered revoked and should not receive the content. The focus is on the *stateless receiver* scenario, where users do not update their state from session to session. The authors introduce the *Subset-Cover* framework, which abstracts various revocation schemes, including some previously known ones. They provide sufficient conditions for the security of revocation algorithms in this framework. Two explicit Subset-Cover revocation algorithms are described, which are flexible and can handle any number of revoked users. The first algorithm requires storage of $\log N$ keys and message lengths of $r \log N$ keys for revoking $r$ users. The second algorithm requires storage of $\frac{1}{2} \log^2 N$ keys and message lengths of $2r$ keys for revoking $r$ users. Both algorithms achieve significant improvements over previous methods in terms of message length and storage requirements. Additionally, the paper presents a general traitor tracing mechanism that can be integrated with any Subset-Cover revocation scheme that satisfies a "bifurcation property." This mechanism does not require an a priori bound on the number of traitors and does not significantly increase the message length compared to revoking the same set of traitors. The main contributions of the paper include: 1. Reducing the message length to $O(r)$ regardless of the coalition size while maintaining a single decryption at the user's end. 2. Seamless integration between revocation and tracing, without requiring any changes to the revocation algorithm. 3. Rigorous treatment of the security of such schemes, identifying the effect of parameter choice on overall security. The paper also discusses implementation issues, hierarchical revocation, public-key methods, and applications to copy protection and secure multicast.